<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:cpe="http://cpe.mitre.org/XMLSchema/cpe/1.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="OracleLinux6CISBenchmark" resolved="false" xml:lang="en">
  <status date="2016-06-15">accepted</status>
  <title xml:lang="en">Oracle Linux 6 CIS Benchmark</title>
  <description xml:lang="en">This document provides prescriptive guidance for establishing a secure configuration posture for Oracle Linux 6 systems running on x86 and x64 platforms. This document was tested against Oracle Linux 6.7.</description>
  <reference>
    <dc:title>Oracle Linux 6 CIS Benchmark</dc:title>
    <dc:creator>Benchmark Editor</dc:creator>
    <dc:publisher>McAfee</dc:publisher>
    <dc:identifier>http://csrc.nist.gov/</dc:identifier>
    <dc:source>compliance.mcafee.com</dc:source>
  </reference>
  <platform idref="cpe:/o:oracle:linux:6" />
  <version>1.0.0</version>
  <model system="urn:xcscoring:default" />
  <model system="urn:xcscoring:flat" />
  <Profile id="Level1_Server" abstract="false">
    <title xml:lang="en">Level 1 - Server</title>
    <description xml:lang="en">Items in this profile intend to:
      1. be practical and prudent;
      2. provide a clear security benefit; and
      3. not inhibit the utility of the technology beyond acceptable means.
      This profile is intended for servers.</description>
    <select idref="FilesystemConfiguration-DisableMountingOfCramfsFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfFreevxfsFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfJffs2Filesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfHfsFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfHfsplusFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfSquashfsFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfUdfFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-DisableMountingOfVfatFilesystems" selected="true" />
    <select idref="FilesystemConfiguration-SetNodevOptionFor_TmpPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNosuidOptionFor_TmpPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNoexecOptionFor_TmpPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNodevOptionFor_Var_TmpPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNosuidOptionFor_Var_TmpPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNoexecOptionFor_Var_TmpPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNodevOptionFor_HomePartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNodevOptionFor_Dev_shmPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNosuidOptionFor_Dev_shmPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNoexecOptionFor_Dev_shmPartitionIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNodevOptionForRemovableMediaPartitionsIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNosuidOptionForRemovableMediaPartitionsIn_Etc_fstab" selected="true" />
    <select idref="FilesystemConfiguration-SetNoexecOptionForRemovableMediaPartitionsIn_Etc_fstab" selected="true" />
    <select idref="Service_Autofs_Status_Runlevel2" selected="true" />
    <select idref="Service_Autofs_Status_Runlevel3" selected="true" />
    <select idref="Service_Autofs_Status_Runlevel4" selected="true" />
    <select idref="Service_Autofs_Status_Runlevel5" selected="true" />
    <select idref="ConfigureSoftwareUpdates-VerifyThatGpgcheckIsGloballyActivated" selected="true" />
    <select idref="ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" selected="true" />
    <select idref="TestForAideRPMPackage" selected="true" />
    <select idref="TestTheEnable_DisableStatusFor-PRELINKING" selected="true" />
    <select idref="AdvancedIntrusionDetectionEnvironment-ImplementPeriodicExecutionOfFileIntegrity" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Boot_grub_grub.conf" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Boot_grub_grub.conf" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Boot_grub_grub.conf" selected="true" />
    <select idref="Configuration-SetBootLoaderPassword" selected="true" />
    <select idref="TestTheEnable_DisableStatusFor-SingleUserModePasswordRequest" selected="true" />
    <select idref="TestTheEnable_DisableStatusFor-InteractiveBoot" selected="true" />
    <select idref="AdditionalProcessHardening-RestrictCoreDumps-HardCore" selected="true" />
    <select idref="AdditionalProcessHardening-RestrictCoreDumps-Fs.suid_dumpable" selected="true" />
    <select idref="AdditionalProcessHardening-RestrictCoreDumps-Kernel.randomize_va_space" selected="true" />
    <select idref="AdditionalProcessHardening-EnsurePrelinkDisabled" selected="true" />
    <select idref="EnsureMessageOfDayConfiguredProperly-Etc_motd" selected="true" />
    <select idref="EnsureLocalLoginWarningBannerConfiguredProperly-Etc_issue" selected="true" />
    <select idref="EnsureRemoteLoginWarningBannerConfiguredProperly-Etc_issue.net" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_motd" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_motd" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_motd" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_issue" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_issue" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_issue" selected="true" />
    <select idref="Testthegroupownerofthefile-etc-issue.net" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_issue.net" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_issue.net" selected="true" />
    <select idref="EnsureGDMLoginBannerConfigured" selected="true" />
    <select idref="EnsureGDMLoginBannerConfigured-Etc_dconf_profile_gdm" selected="true" />
    <select idref="DisableChargen-dgram" selected="true" />
    <select idref="DisableChargen-stream" selected="true" />
    <select idref="DisableDaytime-dgram" selected="true" />
    <select idref="DisableDaytime-stream" selected="true" />
    <select idref="DisableDiscard-dgram" selected="true" />
    <select idref="DisableDiscard-stream" selected="true" />
    <select idref="DisableEcho-dgram" selected="true" />
    <select idref="DisableEcho-stream" selected="true" />
    <select idref="DisableTime-dgram" selected="true" />
    <select idref="DisableTime-stream" selected="true" />
    <select idref="DisableRexec" selected="true" />
    <select idref="DisableRlogin" selected="true" />
    <select idref="DisableRsh" selected="true" />
    <select idref="DisableTalk" selected="true" />
    <select idref="DisableTelnet" selected="true" />
    <select idref="DisableTftp" selected="true" />
    <select idref="DisableRsync" selected="true" />
    <select idref="DisableXinetd-Runlevel2" selected="true" />
    <select idref="DisableXinetd-Runlevel3" selected="true" />
    <select idref="DisableXinetd-Runlevel4" selected="true" />
    <select idref="DisableXinetd-Runlevel5" selected="true" />
    <select idref="EnsureTimeSynchronizationIsInUse-NtpRPMPackage" selected="true" />
    <select idref="EnsureTimeSynchronizationIsInUse-ChronyRPMPackage" selected="true" />
    <select idref="EnsureNtpConfigured-AddOPTIONSInEtc_sysconfig_ntpd" selected="true" />
    <select idref="EnsureNtpConfigured-AddServerLinesToEtc_ntp.conf" selected="true" />
    <select idref="EnsureNtpConfigured-RestrictLinesInEtc_ntp.conf" selected="true" />
    <select idref="ConfigureNetworkTimeProtocol_NTP_In_Etc_Chrony.conf" selected="true" />
    <select idref="ConfigureNetworkTimeProtocol_NTP_In_Etc_sysconfig_chronyd" selected="true" />
    <select idref="EnsureXWindowSystemIsNotInstalled" selected="true" />
    <select idref="Service-Avahi-daemon-RunningState-runlevel2" selected="true" />
    <select idref="Service-Avahi-daemon-RunningState-RunLevel3" selected="true" />
    <select idref="Service-Avahi-daemon-RunningState-Runlevel4" selected="true" />
    <select idref="Service-Avahi-daemon-RunningState-Runlevel5" selected="true" />
    <select idref="DisableAvahiServer-RemoveZeroconf" selected="true" />
    <select idref="DisablePrintServer-CUPSAtrunlevel2" selected="true" />
    <select idref="DisablePrintServer-CUPSAtRunlevel3" selected="true" />
    <select idref="DisablePrintServer-CUPSAtRunlevel4" selected="true" />
    <select idref="DisablePrintServer-CUPSAtRunlevel5" selected="true" />
    <select idref="Service_Dhcpd_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Dhcpd_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Dhcpd_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Dhcpd_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Slapd_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Slapd_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Slapd_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Slapd_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Nfs_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Nfs_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Nfs_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Nfs_RunningState_Runlevel5" selected="true" />
    <select idref="DisableNFSAndRPCrpcbindAtRunlevel2" selected="true" />
    <select idref="DisableNFSAndRPCrpcbindAtRunlevel3" selected="true" />
    <select idref="DisableNFSAndRPCnfsbindAtRunlevel4" selected="true" />
    <select idref="DisableNFSAndRPCnfsbindAtRunlevel5" selected="true" />
    <select idref="Service_Named_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Named_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Named_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Named_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Vsftpd_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Vsftpd_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Vsftpd_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Vsftpd_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Httpd_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Httpd_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Httpd_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Httpd_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Dovecot_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Dovecot_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Dovecot_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Dovecot_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Smb_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Smb_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Smb_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Smb_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Squid_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Squid_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Squid_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Squid_RunningState_Runlevel5" selected="true" />
    <select idref="Service_Snmpd_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Snmpd_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Snmpd_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Snmpd_RunningState_Runlevel5" selected="true" />
    <select idref="ConfigureMailTransferAgentForLocal-OnlyMode" selected="true" />
    <select idref="Service_Ypserv_RunningState_Runlevel2" selected="true" />
    <select idref="Service_Ypserv_RunningState_Runlevel3" selected="true" />
    <select idref="Service_Ypserv_RunningState_Runlevel4" selected="true" />
    <select idref="Service_Ypserv_RunningState_Runlevel5" selected="true" />
    <select idref="RemoveNISClient" selected="true" />
    <select idref="RemoveRshClient" selected="true" />
    <select idref="RemoveTalkClient" selected="true" />
    <select idref="RemoveTelnetClient" selected="true" />
    <select idref="RemoveLDAPClient" selected="true" />
    <select idref="DisableIPForwarding-Net.ipv4.ip_forward" selected="true" />
    <select idref="DisablePacketRedirectSending-Net.ipv4.conf.all.send_redirects" selected="true" />
    <select idref="DisablePacketRedirectSending-Net.ipv4.conf.default.send_redirects" selected="true" />
    <select idref="DisableSourceRoutedPacketsAccept-Net.ipv4.conf.all.accept_source_route" selected="true" />
    <select idref="DisableSourceRoutedPacketsAccept-Net.ipv4.conf.default.accept_source_route" selected="true" />
    <select idref="DisableICMPRedirectsAccept-Net.ipv4.conf.all.accept_redirects" selected="true" />
    <select idref="DisableICMPRedirectsAccept-Net.ipv4.conf.default.accept_redirects" selected="true" />
    <select idref="DisableSecureICMPRedirectsAccept-Net.ipv4.conf.all.secure_redirects" selected="true" />
    <select idref="DisableSecureICMPRedirectsAccept-Net.ipv4.conf.default.secure_redirects" selected="true" />
    <select idref="EnableSuspiciousPacketsLog-Net.ipv4.conf.all.log_martians" selected="true" />
    <select idref="EnableSuspiciousPacketsLog-Net.ipv4.conf.default.log_martians" selected="true" />
    <select idref="IgnoreBroadcastICMPRequests-Net.ipv4.icmp_echo_ignore_broadcasts" selected="true" />
    <select idref="IgnoreBogusICMPResponses-Net.ipv4.icmp_ignore_bogus_error_responses" selected="true" />
    <select idref="EnableReversePathFiltering-Net.ipv4.conf.all.rp_filter" selected="true" />
    <select idref="EnableReversePathFiltering-Net.ipv4.conf.default.rp_filter" selected="true" />
    <select idref="EnableTCPSYNCookies-Net.ipv4.tcp_syncookies" selected="true" />
    <select idref="DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.all.accept_ra" selected="true" />
    <select idref="DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.default.accept_ra" selected="true" />
    <select idref="DisableIPv6RedirectsAccept-Net.ipv6.conf.all.accept_redirects" selected="true" />
    <select idref="DisableIPv6RedirectsAccept-Net.ipv6.conf.default.accept_redirects" selected="true" />
    <select idref="DisableIPv6" selected="true" />
    <select idref="TheSpecifiedRPMPackageShouldBeInstalled_tcpwrappers" selected="true" />
    <select idref="TheSpecifiedRPMPackageShouldBeInstalled_tcp_wrappers-libs" selected="true" />
    <select idref="EnsureEtc_hosts.allowIsConfigured" selected="true" />
    <select idref="EnsureEetc_hosts.denyIsConfigured" selected="true" />
    <select idref="TestThePermissionsOfTheFile-etchosts.allow" selected="true" />
    <select idref="TestTheOwnerOfTheFile-etchosts.allow" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_hosts.allow" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_hosts.deny" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_hosts.deny" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_hosts.deny" selected="true" />
    <select idref="UncommonNetworkProtocols-DisableDCCP" selected="true" />
    <select idref="UncommonNetworkProtocols-DisableSCTP" selected="true" />
    <select idref="UncommonNetworkProtocols-DisableRDS" selected="true" />
    <select idref="UncommonNetworkProtocols-DisableTIPC" selected="true" />
    <select idref="InstallIPtables" selected="true" />
    <select idref="ConfigureLoopbackInterfaceTraffic-INPUT" selected="true" />
    <select idref="ConfigureLoopbackInterfaceTraffic-DROP" selected="true" />
    <select idref="ConfigureLoopbackInterfaceTraffic-OUTPUT" selected="true" />
    <select idref="WirelessNetworkInterfacesShouldBeDisabled" selected="true" />
    <select idref="TestTheRsyslogRunningStatus" selected="true" />
    <select idref="TestTheRsyslogRunningStatus-Runlevel3" selected="true" />
    <select idref="TestTheRsyslogRunningStatus-Runlevel4" selected="true" />
    <select idref="TestTheRsyslogRunningStatus-Runlevel5" selected="true" />
    <select idref="ConfigureRsyslogToSendLogsToARemoteLogHost" selected="true" />
    <select idref="AcceptRemoteRsyslogMessagesOnlyOnDesignatedLogHosts" selected="true" />
    <select idref="TestForTheRsyslogRPMPackage" selected="true" />
    <select idref="EnsurePermissionsOnAllLogfilesAreConfigured" selected="true" />
    <select idref="EnsureRsyslogDefaultFilePermissionsConfigured" selected="true" />
    <select idref="TestForService-Crond-RunningStaterunlevel2" selected="true" />
    <select idref="TestTheService-Crond-RunningState-Runlevel3" selected="true" />
    <select idref="TestForService-Crond-RunningState-Runlevel4" selected="true" />
    <select idref="TestForService-Crond-RunningState-Runlevel5" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_crontab" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_crontab" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_crontab" selected="true" />
    <select idref="TestTheOwnerOfThe_Etc_cron.hourlyDirectory" selected="true" />
    <select idref="TestTheGroupOwnerOfTheDirectory-_Etc_cron.hourly" selected="true" />
    <select idref="TestThePermissionsOfTheDirectory-_Etc_cron.hourly" selected="true" />
    <select idref="TestTheOwnerOfDirectory-_Etc_cron.daily" selected="true" />
    <select idref="TestTheGroupOwnerOfDirectory-_Etc_cron.daily" selected="true" />
    <select idref="TestThePermissionsOfTheDirectory-_Etc_cron.daily" selected="true" />
    <select idref="TestTheOwnerOfTheDirectory-_Etc_cron.weekly" selected="true" />
    <select idref="TestTheGroupOwnerOfTheDirectory-_Etc_cron.weekly" selected="true" />
    <select idref="TestThePermissionsOfTheDirectory-_Etc_cron.weekly" selected="true" />
    <select idref="TestTheGroupOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" selected="true" />
    <select idref="TestTheOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" selected="true" />
    <select idref="TestThePermissionsOfTheDirectory-_Etc_cron.monthly" selected="true" />
    <select idref="TestTheOwnerOf_Etc_cron.dDirectory" selected="true" />
    <select idref="TestTheGroupOwnerOfTheDirectory-_Etc_cron.d" selected="true" />
    <select idref="TestThePermissionsOfTheDirectory-_Etc_cron.d" selected="true" />
    <select idref="TestTheExistenceOfTheFile-_Etc_cron.deny" selected="true" />
    <select idref="TestIfTheFile-_Etc_at.allowExists" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-Etc_at.allow" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_at.allow" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_at.allow" selected="true" />
    <select idref="TestTheExistenceOfTheFile-_Etc_at.deny" selected="true" />
    <select idref="TestIfTheFile-_Etc_cron.allowExists" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_cron.allow" selected="true" />
    <select idref="TestTheGroupOwerOfTheFile-_Etc_cron.allow" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_cron.allow" selected="true" />
    <select idref="FileGroupFor_Etc_ssh_sshd_config" selected="true" />
    <select idref="FileOwnerFor_Etc_ssh_sshd_config" selected="true" />
    <select idref="FilePermissionsFor_Etc_ssh_sshd_config" selected="true" />
    <select idref="TestTheConfigurationStatusFor-SSHProtocolRHEL6" selected="true" />
    <select idref="SetSSHLogLevel" selected="true" />
    <select idref="SetSSHX11Forwarding" selected="true" />
    <select idref="SetSSHMaxAuthTries" selected="true" />
    <select idref="SetSSHIgnoreRhosts" selected="true" />
    <select idref="SetSSHHostbasedAuthentication" selected="true" />
    <select idref="SetSSHRootLogin" selected="true" />
    <select idref="SetSSHPermitEmptyPasswords" selected="true" />
    <select idref="SetSSHEnvironmentOptions" selected="true" />
    <select idref="UseOnlyApprovedCipherInCounterMode" selected="true" />
    <select idref="EnsureOnlyApprovedMACAlgorithmsAreUsed" selected="true" />
    <select idref="SetSSHClientAliveInterval" selected="true" />
    <select idref="SetSSHClientAliveCountMax" selected="true" />
    <select idref="SetSSHLoginGraceTime" selected="true" />
    <select idref="LimitAccessViaSSH" selected="true" />
    <select idref="SSHWarningBanner" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-Minlen" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-Minlen" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-dcredit" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-dcredit" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-Ocredit" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-Ocredit" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-Ucredit" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-Ucredit" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-Lcredit" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-Lcredit" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-Retry" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-Retry" selected="true" />
    <select idref="Pam_cracklib_system-auth_file-Try_first_pass" selected="true" />
    <select idref="Pam_cracklib_password-auth_file-Try_first_pass" selected="true" />
    <select idref="SetLockoutForFailedPasswordAttempts-pam_faillock" selected="true" />
    <select idref="PasswordHistory_system-auth_file" selected="true" />
    <select idref="PasswordHistory_password-auth_file" selected="true" />
    <select idref="PasswordHashingAlgorithm_system-auth_file" selected="true" />
    <select idref="PasswordHashingAlgorithm_password-auth_file" selected="true" />
    <select idref="SetPasswordExpirationDays" selected="true" />
    <select idref="SetPasswordChangeMinimumNumberOfDays" selected="true" />
    <select idref="SetPasswordExpiringWarningDays" selected="true" />
    <select idref="TestTheConfigurationStatusFor-DurationOfInactiveUserAccountsLock" selected="true" />
    <select idref="DisableSystemAccounts" selected="true" />
    <select idref="TestTheGroupOwnerOfTheAccount-Root" selected="true" />
    <select idref="DefaultUserUmask-Etc_bashrc" selected="true" />
    <select idref="DefaultUserUmask-Etc_profile" selected="true" />
    <select idref="EnsureRootLoginIsRestrictedToSystemConsole" selected="true" />
    <select idref="LimitAccessToTheRootAccountFromSu" selected="true" />
    <select idref="RestrictAccessToTheSuCommand-UsersListInTheWheelStatement-_Etc_group" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_passwd" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_passwd" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_passwd" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_shadow" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_shadow" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_shadow" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_group" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_group" selected="true" />
    <select idref="TestTheOwnerOfTheFile-_Etc_group" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_gshadow" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_gshadow" selected="true" />
    <select idref="TestTheOwnerOfThe_Etc_gshadowFile" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_passwd-" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_passwd-" selected="true" />
    <select idref="TestTheOwnerOfThe_Etc_passwd-File" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_shadow-" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_shadow-" selected="true" />
    <select idref="TestTheOwnerOfThe_Etc_shadow-File" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_group-" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_group-" selected="true" />
    <select idref="TestTheOwnerOfThe_Etc_group-File" selected="true" />
    <select idref="TestThePermissionsOfTheFile-_Etc_gshadow-" selected="true" />
    <select idref="TestTheGroupOwnerOfTheFile-_Etc_gshadow-" selected="true" />
    <select idref="TestTheOwnerOfThe_Etc_gshadow-File" selected="true" />
    <select idref="EnsurePasswordFieldsAreNotEmpty" selected="true" />
    <select idref="VerifyNoLegacy___EntriesExistIn_Etc_passwdFile" selected="true" />
    <select idref="VerifyNoLegacy___EntriesExistIn_Etc_shadowFile" selected="true" />
    <select idref="VerifyNoLegacy___EntriesExistIn_Etc_groupFile" selected="true" />
    <select idref="VerifyNoUID0AccountsExistOtherThanRoot" selected="true" />
    <select idref="CheckThatUsersAreAssignedHomeDirectories" selected="true" />
    <select idref="CheckPermissionsOnUserHomeDirectories" selected="true" />
    <select idref="CheckUserHomeDirectoryOwnership" selected="true" />
    <select idref="CheckUserDotFilePermissions" selected="true" />
    <select idref="CheckForPresenceOfUser.forwardFiles" selected="true" />
    <select idref="CheckForPresenceOfUser.netrcFiles" selected="true" />
    <select idref="CheckPermissionsOnUser.netrcFiles" selected="true" />
    <select idref="CheckForPresenceOfUser.rhostsFiles" selected="true" />
    <select idref="CheckGroupsIn_Etc_passwd" selected="true" />
    <select idref="CheckForDuplicateUIDs" selected="true" />
    <select idref="CheckForDuplicateGIDs" selected="true" />
    <select idref="CheckForDuplicateUserNames" selected="true" />
    <select idref="CheckForDuplicateGroupNames" selected="true" />
  </Profile>
  <Profile id="Level2_Server" abstract="false">
    <title xml:lang="en">Level 2 - Server</title>
    <description xml:lang="en">This profile extends the "Level 1 - Server" profile. Items in this profile exhibit one or more of the following characteristics:
      1. are intended for environments or use cases where security is paramount.
      2. acts as defense in depth measure.
      3. may negatively inhibit the utility or performance of the technology.
      This profile is intended for servers.</description>
    <select idref="FilesystemConfiguration-CreateSeparatePartitionFor_Tmp" selected="true" />
    <select idref="FilesystemConfiguration-CreateSeparatePartitionFor_Var" selected="true" />
    <select idref="FilesystemConfiguration-CreateSeparatePartitionFor_Var_Tmp" selected="true" />
    <select idref="FilesystemConfiguration-CreateSeparatePartitionFor_Var_log" selected="true" />
    <select idref="FilesystemConfiguration-CreateSeparatePartitionFor_Var_log_audit" selected="true" />
    <select idref="FilesystemConfiguration-CreateSeparatePartitionFor_Home" selected="true" />
    <select idref="ConfigureSELinux-SELinuxShouldNotBeDisabledIn_Boot_grub_grub.conf" selected="true" />
    <select idref="ConfigureSELinux-SELinux-EnforcingShouldNotBeDisabledIn_Boot_grub_grub.conf" selected="true" />
    <select idref="TestTheConfigurationStatusFor-SELinuxState" selected="true" />
    <select idref="TestTheConfigurationStatusFor-SELinuxPolicy" selected="true" />
    <select idref="TheSetroubleshootRPMPackageShouldNOTBeInstalled" selected="true" />
    <select idref="TheMcstransRPMPackageShouldNOTBeInstalled" selected="true" />
    <select idref="EnsureSELinuxInstalled" selected="true" />
    <select idref="ConfigureAuditLogStorageSize" selected="true" />
    <select idref="DisableSystemOnAuditLogFull" selected="true" />
    <select idref="KeepAllAuditingInformation" selected="true" />
    <select idref="TestAuditdServiceRunningStatusrun_level2" selected="true" />
    <select idref="TestAuditdServiceRunningStatus-RunLevel3" selected="true" />
    <select idref="TestTheAuditdServiceRunningStatus-RunLevel4" selected="true" />
    <select idref="TestTheAuditdServiceRunningStatus-RunLevel5" selected="true" />
    <select idref="EnableAuditingForProcessesThatStartPriorToAuditd" selected="true" />
    <select idref="RecordEventsThatModifyDateAndTimeInformation" selected="true" />
    <select idref="RecordEventsThatModifyUser_GroupInformation" selected="true" />
    <select idref="RecordEventsThatModifyTheSystem_sNetworkEnvironment" selected="true" />
    <select idref="RecordEventsThatModifyTheSystem_sMandatoryAccessControls" selected="true" />
    <select idref="CollectLoginAndLogoutEvents" selected="true" />
    <select idref="CollectSessionInitiationInformation" selected="true" />
    <select idref="CollectDiscretionaryAccessControlPermissionModificationEvents" selected="true" />
    <select idref="CollectUnsuccessfulUnauthorizedAccessAttemptsToFiles" selected="true" />
    <select idref="CollectSuccessfulFileSystemMounts" selected="true" />
    <select idref="CollectFileDeletionEventsByUser" selected="true" />
    <select idref="CollectChangesToSystemAdministrationScope" selected="true" />
    <select idref="CollectChangesToSystemAdministrationScope-Sudoers.d" selected="true" />
    <select idref="CollectSystemAdministratorActions_Sudolog" selected="true" />
    <select idref="CollectKernelModuleLoadingAndUnloading" selected="true" />
    <select idref="MakeTheAuditConfigurationImmutable" selected="true" />
  </Profile>
  <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var9" xml:lang="en" type="string" operator="equals" interactive="false">
    <value selector="">xinetd</value>
  </Value>
  <Group id="CIS_1InstallUpdates_PatchesAndAdditionalSecuritySoftware" xml:lang="en">
    <title xml:lang="en">CIS 1 Install Updates, Patches and Additional Security Software</title>
    <description xml:lang="en">Directories that are used for system-wide functions can be further protected by placing them on separate partitions. This provides protection for resource exhaustion and enables the use of mounting options that are applicable to the directory's intended use.</description>
    <Group id="CIS_1.1FilesystemConfiguration" xml:lang="en">
      <title xml:lang="en">CIS 1.1 Filesystem Configuration</title>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/tmp</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var0" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/tmp</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var1" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/tmp</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomevarEtc.__var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/var</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomevarvartempEtc.__var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/var/tmp</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomevarlogEtc.__var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/var/log</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomevarlogauditEtc.__var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/var/log/audit</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var2" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/home</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/dev/cdrom</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/dev/cdrom</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/dev/cdrom</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var6" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/dev/shm</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var7" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/dev/shm</value>
      </Value>
      <Value id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var8" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">/dev/shm</value>
      </Value>
      <Rule id="FilesystemConfiguration-CreateSeparatePartitionFor_Tmp" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Create Separate Partition for /tmp</title>
        <description xml:lang="en">This check verifies that the separate Partition is created for /tmp.</description>
        <rationale xml:lang="en">Since the /tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, 
          making /tmp its own file system allows an administrator to set the noexec option on the mount, making /tmp useless for an attacker to install executable code. 
          It would also prevent an attacker from establishing a hardlink to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would 
          be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08727</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-CreateSeparatePartitionFor_Tmp" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For new installations, check the box to "Review and modify partitioning" and create a separate partition for /tmp.
          For systems that were previously installed, use the Logical Volume Manager (LVM) to create partitions.</fixtext>
        <fix id="F-FilesystemConfiguration-CreateSeparatePartitionFor_Tmp" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487644" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNodevOptionFor_TmpPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nodev option for /tmp Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nodev option is set for /tmp partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices in /tmp.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08725</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNodevOptionFor_TmpPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nodev to the fourth field (mounting options). See the fstab(5) manual page for more information. # mount -o remount,nodev /tmp</fixtext>
        <fix id="F-FilesystemConfiguration-SetNodevOptionFor_TmpPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487649" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNosuidOptionFor_TmpPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nosuid option for /tmp Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nosuid option is set for /tmp partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot create set userid files in /tmp.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08730</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNosuidOptionFor_TmpPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nosuid to the fourth field (mounting options). See the fstab(5) manual page for more information.</fixtext>
        <fix id="F-FilesystemConfiguration-SetNosuidOptionFor_TmpPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var0" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487652" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNoexecOptionFor_TmpPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set noexec option for /tmp Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that noexec option is set for /tmp partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /tmp.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08731</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNoexecOptionFor_TmpPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add noexec to the fourth field (mounting options). See the fstab(5) manual page for more information. # mount -o remount,noexec /tmp</fixtext>
        <fix id="F-FilesystemConfiguration-SetNoexecOptionFor_TmpPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var1" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487655" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-CreateSeparatePartitionFor_Var" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Create Separate Partition for /var</title>
        <description xml:lang="en">This check will verify that Separate Partition for /var is created.</description>
        <rationale xml:lang="en">Since the /var directory may contain world-writable files and directories, there is a risk of resource exhaustion if it is not bound to a separate partition.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02163</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For new installations, during installation create a custom partition setup and specify a separate partition for /var.
          For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.</fixtext>
        <fix id="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomevarEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487644" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-CreateSeparatePartitionFor_Var_Tmp" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Create Separate Partition for /var/tmp</title>
        <description xml:lang="en">This check will verify that Separate Partition for /var/tmp is created.</description>
        <rationale xml:lang="en">Since the /var/tmp directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. In addition, making /var/tmp its own
          file system allows an administrator to set the noexec option on the mount, making /var/tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hardlink 
          to a system setuid program and wait for it to be updated. Once the program was updated, the hardlink would be broken and the attacker would have his own copy of the program. If the program happened to 
          have a security vulnerability, the attacker could continue to exploit the known flaw.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08734</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var_Tmp" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For new installations, during installation create a custom partition setup and specify a separate partition for /var/tmp.
          For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.</fixtext>
        <fix id="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var_Tmp" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomevarvartempEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487644" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNodevOptionFor_Var_TmpPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nodev option for /var/tmp Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nodev option is set for /var/tmp partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /var/tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices in /var/tmp.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.8</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNodevOptionFor_TmpPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the /var/tmp partition. See the fstab(5) manual page for more information.
          Run the following command to remount /var/tmp:
          # mount -o remount,nodev /var/tmp</fixtext>
        <fix id="F-FilesystemConfiguration-SetNodevOptionFor_TmpPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487649" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNosuidOptionFor_Var_TmpPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nosuid option for /var/tmp Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nosuid option is set for /var/tmp partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot create set userid files in /tmp.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.9</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNosuidOptionFor_TmpPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nosuid to the fourth field (mounting options). See the fstab(5) manual page for more information.</fixtext>
        <fix id="F-FilesystemConfiguration-SetNosuidOptionFor_TmpPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var0" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487652" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNoexecOptionFor_Var_TmpPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set noexec option for /var/tmp Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that noexec option is set for /var/tmp partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /tmp.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.10</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNoexecOptionFor_TmpPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add noexec to the fourth field (mounting options). See the fstab(5) manual page for more information. # mount -o remount,noexec /tmp</fixtext>
        <fix id="F-FilesystemConfiguration-SetNoexecOptionFor_TmpPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var1" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487655" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-CreateSeparatePartitionFor_Var_log" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Create Separate Partition for /var/log</title>
        <description xml:lang="en">This check ensures that the separate partition is created for /var/log directory.</description>
        <rationale xml:lang="en">There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08728</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var_log" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For new installations, check the box to "Review and modify partitioning" and create a separate partition for /var/log.
          For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.</fixtext>
        <fix id="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var_log" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomevarlogEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487644" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-CreateSeparatePartitionFor_Var_log_audit" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Create Separate Partition for /var/log/audit</title>
        <description xml:lang="en">This check ensures that separate partition is created for /var/log/audit directory.</description>
        <rationale xml:lang="en">There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free
          space is left and performs actions based on the results. If other processes (such as syslog) consume space in the same partition as auditd, it may not perform as desired.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.12</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08729</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var_log_audit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For new installations, check the box to "Review and modify partitioning" and create a separate partition for /var/log/audit. 
          For systems that were previously installed, create a new partition and configure /etc/fstab as appropriate.</fixtext>
        <fix id="F-FilesystemConfiguration-CreateSeparatePartitionFor_Var_log_audit" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomevarlogauditEtc.__var" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487644" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-CreateSeparatePartitionFor_Home" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Create Separate Partition for /home</title>
        <description xml:lang="en">This check ensures that separate partition is created for /home directory.</description>
        <rationale xml:lang="en">If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.13</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02163</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-CreateSeparatePartitionFor_Home" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For new installations, check the box to "Review and modify partitioning" and create a separate partition for /home.
          For systems that were previously installed, use the Logical Volume Manager (LVM) to create partitions.</fixtext>
        <fix id="F-FilesystemConfiguration-CreateSeparatePartitionFor_Home" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var2" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487644" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNodevOptionFor_HomePartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nodev option for /home Partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nodev option is set for /home partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the user partitions are not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.14</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01534</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNodevOptionFor_HomePartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nodev to the fourth field (mounting options). See the fstab(5) manual page for more information. # mount -o remount,nodev /home</fixtext>
        <fix id="F-FilesystemConfiguration-SetNodevOptionFor_HomePartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var2" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487649" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNodevOptionFor_Dev_shmPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nodev option for /dev/shm partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nodev option is set for /dev/shm partition in /etc/fstab</description>
        <rationale xml:lang="en">Since the /dev/shm filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in /dev/shm partitions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.15</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08726</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNodevOptionFor_Dev_shmPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nodev to the fourth field (mounting options of entries that have mount points that contain /dev/shm. See the fstab(5) manual page for more information. # mount -o remount,nodev /dev/shm</fixtext>
        <fix id="F-FilesystemConfiguration-SetNodevOptionFor_Dev_shmPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var6" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487649" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNosuidOptionFor_Dev_shmPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nosuid option for /dev/shm partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nosuid option is set for /dev/shm partition in /etc/fstab</description>
        <rationale xml:lang="en">Setting this option on a file system prevents users from introducing privileged programs onto the system and allowing non-root users to execute them.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.16</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08732</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNosuidOptionFor_Dev_shmPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nosuid to the fourth field (mounting options). Look for entries that have mount points that contain /dev/shm. See the fstab(5) manual page for more information. # mount -o remount,nosuid /dev/shm</fixtext>
        <fix id="F-FilesystemConfiguration-SetNosuidOptionFor_Dev_shmPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var7" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487652" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNoexecOptionFor_Dev_shmPartitionIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set noexec option for /dev/shm partition in /etc/fstab</title>
        <description xml:lang="en">This check will verify that noexec option is set for /dev/shm partition in /etc/fstab</description>
        <rationale xml:lang="en">Setting this option on a file system prevents users from executing programs from shared memory. This deters users from introducing potentially malicious software on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.17</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08733</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNoexecOptionFor_Dev_shmPartitionIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add noexec to the fourth field (mounting options). Look for entries that have mount points that contain /dev/shm. See the fstab(5) manual page for more information. # mount -o remount,noexec /dev/shm</fixtext>
        <fix id="F-FilesystemConfiguration-SetNoexecOptionFor_Dev_shmPartitionIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var8" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487655" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNodevOptionForRemovableMediaPartitionsIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nodev option for removable media Partitions in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nodev option is set for removable media partitions in /etc/fstab</description>
        <rationale xml:lang="en">Removable media containing character and block special devices could be used to circumvent security controls by allowing non-root users to access sensitive device files such as /dev/kmem or the raw disk partitions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.18</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01535</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNodevOptionForRemovableMediaPartitionsIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add "nodev" to the fourth field (mounting options). Look for entries that have mount points that contain words such as floppy or cdrom. See the fstab(5) manual page for more information.</fixtext>
        <fix id="F-FilesystemConfiguration-SetNodevOptionForRemovableMediaPartitionsIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var3" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487649" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNosuidOptionForRemovableMediaPartitionsIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set nosuid option for removable media Partitions in /etc/fstab</title>
        <description xml:lang="en">This check will verify that nosuid option is set for removable media partitions in /etc/fstab</description>
        <rationale xml:lang="en">Setting this option on a file system prevents users from introducing privileged programs onto the system and allowing non-root users to execute them.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.19</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01535</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNosuidOptionForRemovableMediaPartitionsIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add nosuid to the fourth field (mounting options). Look for entries that have mount points that contain words such as floppy or cdrom. See the fstab(5) manual page for more information.</fixtext>
        <fix id="F-FilesystemConfiguration-SetNosuidOptionForRemovableMediaPartitionsIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var4" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487652" />
        </check>
      </Rule>
      <Rule id="FilesystemConfiguration-SetNoexecOptionForRemovableMediaPartitionsIn_Etc_fstab" xml:lang="en" selected="false">
        <title xml:lang="en">Filesystem Configuration - Set noexec option for removable media Partitions in /etc/fstab</title>
        <description xml:lang="en">This check will verify that noexec option is set for removable media partitions in /etc/fstab</description>
        <rationale xml:lang="en">Setting this option on a file system prevents users from executing programs from the removable. This deters users from being to introduce potentially malicious software on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.20</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01535</ident>
        <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-SetNoexecOptionForRemovableMediaPartitionsIn_Etc_fstab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/fstab file and add noexec to the fourth field (mounting options). Look for entries that have mount points that contain words such as floppy or cdrom. See the fstab(5) manual page for more information.</fixtext>
        <fix id="F-FilesystemConfiguration-SetNoexecOptionForRemovableMediaPartitionsIn_Etc_fstab" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsThePartitionNameForEg._tmpdevshmhomeEtc.__var5" export-name="oval:com.mcafee.oval:var:2487648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487655" />
        </check>
      </Rule>
      <Group id="CIS_1.1.1DisableUnusedFilesystems" xml:lang="en">
        <title xml:lang="en">CIS 1.1.1 Disable unused filesystems</title>
        <Rule id="FilesystemConfiguration-DisableMountingOfCramfsFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of cramfs filesystems</title>
          <description xml:lang="en">This check will verify that cramfs filesystem is disabled</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08765</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfCramfsFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install cramfs /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfCramfsFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402410" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfFreevxfsFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of freevxfs filesystems</title>
          <description xml:lang="en">This check will verify that freevxfs filesystem is disabled</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08766</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfFreevxfsFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install freevxfs /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfFreevxfsFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402411" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfJffs2Filesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of jffs2 filesystems</title>
          <description xml:lang="en">This check will verify that jffs2 filesystem is disabled</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08769</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfJffs2Filesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install jffs2 /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfJffs2Filesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402412" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfHfsFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of hfs filesystems</title>
          <description xml:lang="en">This check will verify that hfs filesystem is disabled</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08767</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfHfsFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install hfs /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfHfsFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402413" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfHfsplusFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of hfsplus filesystems</title>
          <description xml:lang="en">This check will verify that hfsplus filesystem is disabled</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08768</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfHfsplusFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install hfsplus /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfHfsplusFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402414" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfSquashfsFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of squashfs filesystems</title>
          <description xml:lang="en">This check will verify that squashfs filesystem is disabled</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08770</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfSquashfsFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install squashfs /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfSquashfsFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402415" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfUdfFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of udf filesystems</title>
          <description xml:lang="en">This check will verify that udf filesystem is disabled.</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08771</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfUdfFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install udf /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfUdfFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402416" />
          </check>
        </Rule>
        <Rule id="FilesystemConfiguration-DisableMountingOfVfatFilesystems" xml:lang="en" selected="false">
          <title xml:lang="en">Filesystem Configuration - Disable Mounting of vfat filesystems</title>
          <description xml:lang="en">This check will verify that vfat filesystem is disabled.</description>
          <rationale xml:lang="en">Removing support for unneeded filesystem types reduces the local attack surface of the server. If this filesystem type is not needed, disable it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.1.8</ident>
          <fixtext xml:lang="en" fixref="F-FilesystemConfiguration-DisableMountingOfVfatFilesystems" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit or create the file /etc/modprobe.d/CIS.conf and add the following line: install udf /bin/true</fixtext>
          <fix id="F-FilesystemConfiguration-DisableMountingOfVfatFilesystems" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412330" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_1.1.22DisableAutomounting" xml:lang="en">
        <title xml:lang="en">CIS 1.2.22 Disable Automounting</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var3" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledAutofs_var47" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var4" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledAutofs_var48" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var5" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledAutofs_var49" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var6" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledAutofs_var50" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Autofs_Status_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - autofs - status - runlevel 2</title>
          <description xml:lang="en">This check verifies if whether the autofs service is enabled or disabled on the system.</description>
          <rationale xml:lang="en">With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.22</ident>
          <fixtext xml:lang="en" fixref="F-Service_Autofs_Status_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable autofs:
          # chkconfig autofs off</fixtext>
          <fix id="F-Service_Autofs_Status_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var3" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledAutofs_var47" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7755" />
          </check>
        </Rule>
        <Rule id="Service_Autofs_Status_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - autofs - status - runlevel 3</title>
          <description xml:lang="en">This check verifies if whether the autofs service is enabled or disabled on the system.</description>
          <rationale xml:lang="en">With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.22</ident>
          <fixtext xml:lang="en" fixref="F-Service_Autofs_Status_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable autofs:
          # chkconfig autofs off</fixtext>
          <fix id="F-Service_Autofs_Status_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var4" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledAutofs_var48" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7755" />
          </check>
        </Rule>
        <Rule id="Service_Autofs_Status_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - autofs - status - runlevel 4</title>
          <description xml:lang="en">This check verifies if whether the autofs service is enabled or disabled on the system.</description>
          <rationale xml:lang="en">With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.22</ident>
          <fixtext xml:lang="en" fixref="F-Service_Autofs_Status_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable autofs:
          # chkconfig autofs off</fixtext>
          <fix id="F-Service_Autofs_Status_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var5" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledAutofs_var49" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7755" />
          </check>
        </Rule>
        <Rule id="Service_Autofs_Status_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - autofs - status - runlevel 5</title>
          <description xml:lang="en">This check verifies if whether the autofs service is enabled or disabled on the system.</description>
          <rationale xml:lang="en">With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.1.22</ident>
          <fixtext xml:lang="en" fixref="F-Service_Autofs_Status_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable autofs:
          # chkconfig autofs off</fixtext>
          <fix id="F-Service_Autofs_Status_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledAutofs_var6" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledAutofs_var50" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7755" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_1.2ConfigureSoftwareUpdates" xml:lang="en">
      <title xml:lang="en">CIS 1.2 Configure Software Updates</title>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var24" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">gpg-pubkey</value>
      </Value>
      <Value id="GpgcheckShouldBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var41" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">2</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var45" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var42" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">3</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var46" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var43" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">4</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var47" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var44" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">5</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var48" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Rule id="ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" xml:lang="en" selected="false">
        <title xml:lang="en">Configure Software Updates - Verify Red Hat GPG Key is Installed</title>
        <description xml:lang="en">This check is to ensure that the GPG Key RPM package should exist on the system.</description>
        <rationale xml:lang="en">It is important to ensure that updates are obtained from a valid source to protect against spoofing that could lead to the inadvertent installation of malware on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.2.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08764</ident>
        <fixtext xml:lang="en" fixref="F-ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Update your package manager GPG keys in accordance with site policy.</fixtext>
        <fix id="F-ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var24" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
        </check>
      </Rule>
      <Rule id="ConfigureSoftwareUpdates-VerifyThatGpgcheckIsGloballyActivated" xml:lang="en" selected="false">
        <title xml:lang="en">Configure Software Updates - Verify that gpgcheck is Globally Activated</title>
        <description xml:lang="en">This check verifies that gpgcheck is Globally Activated in /etc/yum.conf file.</description>
        <rationale xml:lang="en">It is important to ensure that an RPM's package signature is always checked prior to installation to ensure that the software is obtained from a trusted source.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.2.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08735</ident>
        <fixtext xml:lang="en" fixref="F-ConfigureSoftwareUpdates-VerifyThatGpgcheckIsGloballyActivated" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit /etc/yum.conf and set 'gpgcheck=1' in the [main] section.
          Edit any failing files in /etc/yum.repos.d/* and set all instances of gpgcheck to '1'.</fixtext>
        <fix id="F-ConfigureSoftwareUpdates-VerifyThatGpgcheckIsGloballyActivated" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="GpgcheckShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:401602" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:401598" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_1.3AdvancedIntrusionDetectionEnvironment_AIDE_" xml:lang="en">
      <title xml:lang="en">CIS 1.3 Advanced Intrusion Detection Environment (AIDE)</title>
      <description xml:lang="en">AIDE is a file integrity checking tool, similar in nature to Tripwire. While it cannot prevent intrusions, it can detect unauthorized changes to configuration files by alerting when the files are changed.</description>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var23" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">aide</value>
      </Value>
      <Value id="WhatIsTheExpectedSettingForPRELINKINGInetcsysconfigprelink_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Rule id="TestForAideRPMPackage" xml:lang="en" selected="false">
        <title xml:lang="en">Test for aide RPM package</title>
        <description xml:lang="en">This check verifies if aide rpm package is installed on a system.</description>
        <rationale xml:lang="en">Install AIDE to make use of the file integrity features to monitor critical files for changes that could affect the security of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.3.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05106</ident>
        <fixtext xml:lang="en" fixref="F-TestForAideRPMPackage" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Use yum to install AIDE (-y option may be used to assume yes at all prompts):
          # yum install aide - Output messages from Yum install 
          aide.'hardware platform' 'package version' installed
            Initialize AIDE:
            # /usr/sbin/aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
            Note: The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Set PRELINKING=no in /etc/sysconfig/prelink and run /usr/sbin/prelink -ua to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.</fixtext>
        <fix id="F-TestForAideRPMPackage" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var23" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
        </check>
      </Rule>
      <Rule id="TestTheEnable_DisableStatusFor-PRELINKING" xml:lang="en" selected="false">
        <title xml:lang="en">Test the enable / disable status for -PRELINKING</title>
        <description xml:lang="en">This check is to verify that PRELINKING is configured appropriately in /etc/sysconfig/prelink</description>
        <rationale xml:lang="en">Install AIDE to make use of the file integrity features to monitor critical files for changes that could affect the security of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.3.1</ident>
        <fixtext xml:lang="en" fixref="F-TestTheEnable_DisableStatusFor-PRELINKING" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Use yum to install AIDE (-y option may be used to assume yes at all prompts):
          # yum install aide - Output messages from Yum install 
          aide.'hardware platform' 'package version' installed
          Initialize AIDE:
          # /usr/sbin/aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
          Note: The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Set PRELINKING=no in /etc/sysconfig/prelink and run /usr/sbin/prelink -ua to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.</fixtext>
        <fix id="F-TestTheEnable_DisableStatusFor-PRELINKING" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheExpectedSettingForPRELINKINGInetcsysconfigprelink_var" export-name="oval:com.mcafee.oval:var:250002" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249998" />
        </check>
      </Rule>
      <Rule id="AdvancedIntrusionDetectionEnvironment-ImplementPeriodicExecutionOfFileIntegrity" xml:lang="en" selected="false">
        <title xml:lang="en">Advanced Intrusion Detection Environment - Implement Periodic Execution of File Integrity</title>
        <description xml:lang="en">This check is to verify that periodic file checking is configured for root user in /var/spool/cron/root</description>
        <rationale xml:lang="en">Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.3.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09935</ident>
        <fixtext xml:lang="en" fixref="F-AdvancedIntrusionDetectionEnvironment-ImplementPeriodicExecutionOfFileIntegrity" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Execute the following command: # crontab -u root -e
          Add the following line to the crontab: 0 5 * * * /usr/sbin/aide --check
          Note: The checking in this instance occurs every day at 5am. Alter the frequency and time of the checks in compliance with site policy.</fixtext>
        <fix id="F-AdvancedIntrusionDetectionEnvironment-ImplementPeriodicExecutionOfFileIntegrity" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402023" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_1.4SecureBootSettings" xml:lang="en">
      <title xml:lang="en">CIS 1.4 Secure Boot Settings</title>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var19" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var19" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var21" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheExpectedSettingForPROMPTInetcsysconfiginit_var0" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Rule id="TestTheOwnerOfTheFile-_Boot_grub_grub.conf" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the file - /boot/grub/grub.conf</title>
        <description xml:lang="en">This check verifies if the owner of the file - /boot/grub/grub.conf is set as per the user input.</description>
        <rationale xml:lang="en">Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot
          parameters may be able to identify weaknesses in security upon boot and be able to exploit them.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.4.1</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Boot_grub_grub.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on your grub configuration:
          # chown root:root /boot/grub/grub.conf
          # chmod og-rwx /boot/grub/grub.conf
          Notes:
          This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.</fixtext>
        <fix id="F-TestTheOwnerOfTheFile-_Boot_grub_grub.conf" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var19" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249384" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Boot_grub_grub.conf" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /boot/grub/grub.conf</title>
        <description xml:lang="en">This check verifies if the group owner of the file - /boot/grub/grub.conf is set as per the user input.</description>
        <rationale xml:lang="en">Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot
          parameters may be able to identify weaknesses in security upon boot and be able to exploit them.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.4.1</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Boot_grub_grub.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on your grub configuration:
          # chown root:root /boot/grub/grub.conf
          # chmod og-rwx /boot/grub/grub.conf
          Notes:
          This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Boot_grub_grub.conf" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var19" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249385" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Boot_grub_grub.conf" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /boot/grub/grub.conf</title>
        <description xml:lang="en">This check verifies if the permissions of the file - /boot/grub/grub.conf are set as per the user input.</description>
        <rationale xml:lang="en">Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot
          parameters may be able to identify weaknesses in security upon boot and be able to exploit them.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.4.1</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Boot_grub_grub.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on your grub configuration:
          # chown root:root /boot/grub/grub.conf
          # chmod og-rwx /boot/grub/grub.conf
          Notes:
          This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Boot_grub_grub.conf" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var21" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var21" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var21" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var21" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var21" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var21" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var21" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var21" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var21" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249386" />
        </check>
      </Rule>
      <Rule id="Configuration-SetBootLoaderPassword" xml:lang="en" selected="false">
        <title xml:lang="en">Configuration - Set Boot Loader Password</title>
        <description xml:lang="en">This check will verify that grub require a password to boot the operating system.</description>
        <rationale xml:lang="en">Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. turning off SELinux at boot time).</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.4.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01576</ident>
        <fixtext xml:lang="en" fixref="F-Configuration-SetBootLoaderPassword" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Use grub-md5-crypt to produce an encrypted password:
          # grub-md5-crypt Password: Retype password: [Encrypted Password]
          Set the password parameter to[Encrypted Password] in /etc/grub.conf: password --md5 [Encrypted Password]</fixtext>
        <fix id="F-Configuration-SetBootLoaderPassword" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249942" />
        </check>
      </Rule>
      <Rule id="TestTheEnable_DisableStatusFor-SingleUserModePasswordRequest" xml:lang="en" selected="false">
        <title xml:lang="en">Test the enable / disable status for - Single user mode password request</title>
        <description xml:lang="en">This check is to verify that Single user mode password request is set appropriately in /etc/sysconfig/init.</description>
        <rationale xml:lang="en">Requiring authentication in single user mode prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.4.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01577</ident>
        <fixtext xml:lang="en" fixref="F-TestTheEnable_DisableStatusFor-SingleUserModePasswordRequest" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit /etc/sysconfig/init and set SINGLE to '/sbin/sulogin':
          SINGLE=/sbin/sulogin</fixtext>
        <fix id="F-TestTheEnable_DisableStatusFor-SingleUserModePasswordRequest" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:432815" />
        </check>
      </Rule>
      <Rule id="TestTheEnable_DisableStatusFor-InteractiveBoot" xml:lang="en" selected="false">
        <title xml:lang="en">Test the enable / disable status for -Interactive Boot</title>
        <description xml:lang="en">This check is to verify that Interactive Boot is configured appropriately in /etc/sysconfig/init</description>
        <rationale xml:lang="en">Turn off the PROMPT option on the console to prevent console users from potentially overriding established security settings.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.4.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05283</ident>
        <fixtext xml:lang="en" fixref="F-TestTheEnable_DisableStatusFor-InteractiveBoot" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the PROMPT parameter in /etc/sysconfig/init to no. PROMPT=no</fixtext>
        <fix id="F-TestTheEnable_DisableStatusFor-InteractiveBoot" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheExpectedSettingForPROMPTInetcsysconfiginit_var0" export-name="oval:com.mcafee.oval:var:249946" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249935" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_1.5AdditionalProcessHardening" xml:lang="en">
      <title xml:lang="en">CIS 1.5 Additional Process Hardening</title>
      <Value id="WhatIsTheHardCoreParameterValue_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheFs.suid_dumpableVariableValue_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="AddressSpaceLayoutRandomizationShouldBeEnabledOrNot_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">2</value>
      </Value>
      <Value id="ExecShieldProtectionShouldBeEnabledOrNot_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var28" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">prelink</value>
      </Value>
      <Rule id="AdditionalProcessHardening-RestrictCoreDumps-HardCore" xml:lang="en" selected="false">
        <title xml:lang="en">Additional Process Hardening - Restrict Core Dumps - hard core</title>
        <description xml:lang="en">This check will verify that core dumps are disabled.</description>
        <rationale xml:lang="en">Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5)). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.5.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05990</ident>
        <fixtext xml:lang="en" fixref="F-AdditionalProcessHardening-RestrictCoreDumps-HardCore" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/security/limits.conf file. * hard core 0
          Add the following line to the /etc/sysctl.conf file. fs.suid_dumpable = 0</fixtext>
        <fix id="F-AdditionalProcessHardening-RestrictCoreDumps-HardCore" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheHardCoreParameterValue_var" export-name="oval:com.mcafee.oval:var:402395" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402388" />
        </check>
      </Rule>
      <Rule id="AdditionalProcessHardening-RestrictCoreDumps-Fs.suid_dumpable" xml:lang="en" selected="false">
        <title xml:lang="en">Additional Process Hardening - Restrict Core Dumps - fs.suid_dumpable</title>
        <description xml:lang="en">This check will verify the fs.suid_dumpable variable value.</description>
        <rationale xml:lang="en">Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5)). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.5.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05990</ident>
        <fixtext xml:lang="en" fixref="F-AdditionalProcessHardening-RestrictCoreDumps-Fs.suid_dumpable" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/security/limits.conf file. * hard core 0
          Add the following line to the /etc/sysctl.conf file. fs.suid_dumpable = 0</fixtext>
        <fix id="F-AdditionalProcessHardening-RestrictCoreDumps-Fs.suid_dumpable" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheFs.suid_dumpableVariableValue_var" export-name="oval:com.mcafee.oval:var:402399" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402389" />
        </check>
      </Rule>
      <Rule id="AdditionalProcessHardening-RestrictCoreDumps-Kernel.randomize_va_space" xml:lang="en" selected="false">
        <title xml:lang="en">Additional Process Hardening - Restrict Core Dumps - kernel.randomize_va_space</title>
        <description xml:lang="en">This check will verify the Address Space Layout Randomization is enabled or not in /etc/sysctl.conf.</description>
        <rationale xml:lang="en">Randomly placing virtual memory regions will make it difficult for to write memory page exploits as the memory placement will be consistently shifting.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.5.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05436</ident>
        <fixtext xml:lang="en" fixref="F-AdditionalProcessHardening-RestrictCoreDumps-Kernel.randomize_va_space" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/sysctl.conf file. kernel.randomize_va_space = 2</fixtext>
        <fix id="F-AdditionalProcessHardening-RestrictCoreDumps-Kernel.randomize_va_space" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="AddressSpaceLayoutRandomizationShouldBeEnabledOrNot_var" export-name="oval:com.mcafee.oval:var:402409" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402405" />
        </check>
      </Rule>
      <Rule id="AdditionalProcessHardening-EnsurePrelinkDisabled" xml:lang="en" selected="false">
        <title xml:lang="en">Additional Process Hardening - Ensure prelink is disabled</title>
        <description xml:lang="en">This check is to ensure that the prelink RPM package should exist on the system.</description>
        <rationale xml:lang="en">The prelinking feature can interfere with the operation of AIDE, because it changes binaries. Prelinking can also increase the vulnerability of the system if a malicious user is able to compromise a common library such as libc.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.5.4</ident>
        <fixtext xml:lang="en" fixref="F-ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Update your package manager GPG keys in accordance with site policy.</fixtext>
        <fix id="F-ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var28" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_1.6MandatoryAccessControl" xml:lang="en">
      <title xml:lang="en">CIS 1.6 Mandatory Access Control</title>
      <description xml:lang="en">Mandatory Access Control (MAC) provides an additional layer of access restrictions to processes on top of the base Discretionary Access Controls.</description>
      <Value id="WhatIsTheExpectedSELinuxState_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">enforcing</value>
      </Value>
      <Value id="WhatIsTheExpectedSELinuxPolicy_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">targeted</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var25" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">setroubleshoot</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var26" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">mcstrans</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var29" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">libselinux</value>
      </Value>
      <Rule id="EnsureSELinuxInstalled" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure SELinux is installed</title>
        <description xml:lang="en">This check is to ensure that the libselinux RPM package should exist on the system.</description>
        <rationale xml:lang="en">Without a Mandatory Access Control system installed only the default Discretionary Access Control system will be available.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.2</ident>
        <fixtext xml:lang="en" fixref="F-ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to install libselinux:
          # yum install libselinux</fixtext>
        <fix id="F-ConfigureSoftwareUpdates-VerifyRedHatGPGKeyIsInstalled" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var29" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
        </check>
      </Rule>
      <Group id="CIS_1.6.1ConfigureSELinux" xml:lang="en">
        <title xml:lang="en">CIS 1.6.1 Configure SELinux</title>
        <description xml:lang="en">SELinux requires a complex policy to allow all the actions required of a system under normal operation.</description>
        <Rule id="ConfigureSELinux-SELinuxShouldNotBeDisabledIn_Boot_grub_grub.conf" xml:lang="en" selected="false">
          <title xml:lang="en">Configure SELinux - SELinux should not be disabled in /boot/grub/grub.conf</title>
          <description xml:lang="en">This check is to verify that SELinux is not disabled in /boot/grub/grub.conf</description>
          <rationale xml:lang="en">SELinux must be enabled at boot time in /etc/grub.conf to ensure that the controls it provides are not overwritten.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05376</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureSELinux-SELinuxShouldNotBeDisabledIn_Boot_grub_grub.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit /boot/grub/grub.conf and remove all instances of selinux=0 and enforcing=0 on all kernel lines.</fixtext>
          <fix id="F-ConfigureSELinux-SELinuxShouldNotBeDisabledIn_Boot_grub_grub.conf" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402022" />
          </check>
        </Rule>
        <Rule id="ConfigureSELinux-SELinux-EnforcingShouldNotBeDisabledIn_Boot_grub_grub.conf" xml:lang="en" selected="false">
          <title xml:lang="en">Configure SELinux - SELinux - enforcing should not be disabled in /boot/grub/grub.conf</title>
          <description xml:lang="en">This check is to verify that SELinux is not disabled in /boot/grub/grub.conf</description>
          <rationale xml:lang="en">SELinux must be enabled at boot time in /etc/grub.conf to ensure that the controls it provides are not overwritten.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05377</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureSELinux-SELinux-EnforcingShouldNotBeDisabledIn_Boot_grub_grub.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit /boot/grub/grub.conf and remove all instances of selinux=0 and enforcing=0 on all kernel lines.</fixtext>
          <fix id="F-ConfigureSELinux-SELinux-EnforcingShouldNotBeDisabledIn_Boot_grub_grub.conf" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:250013" />
          </check>
        </Rule>
        <Rule id="TestTheConfigurationStatusFor-SELinuxState" xml:lang="en" selected="false">
          <title xml:lang="en">Test the configuration status for - SELinux state</title>
          <description xml:lang="en">This check is to verify that SELinux state is set appropriately in /etc/selinux/config file.</description>
          <rationale xml:lang="en">SELinux must be enabled at boot time in to ensure that the controls it provides are in effect at all times.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05377</ident>
          <fixtext xml:lang="en" fixref="F-TestTheConfigurationStatusFor-SELinuxState" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/selinux/config file to set the SELINUX parameter: SELINUX=enforcing</fixtext>
          <fix id="F-TestTheConfigurationStatusFor-SELinuxState" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheExpectedSELinuxState_var" export-name="oval:com.mcafee.oval:var:250028" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:402020" />
          </check>
        </Rule>
        <Rule id="TestTheConfigurationStatusFor-SELinuxPolicy" xml:lang="en" selected="false">
          <title xml:lang="en">Test the configuration status for - SELinux policy</title>
          <description xml:lang="en">This check is to verify that SELinux policy is set appropriately in /etc/selinux/config file.</description>
          <rationale xml:lang="en">Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that least the default recommendations are met.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05378</ident>
          <fixtext xml:lang="en" fixref="F-TestTheConfigurationStatusFor-SELinuxPolicy" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/selinux/config file to set the SELINUXTYPE parameter: SELINUXTYPE=targeted
          Note: If your organization requires stricter policies, make sure they are added to the /etc/selinux/config file.</fixtext>
          <fix id="F-TestTheConfigurationStatusFor-SELinuxPolicy" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheExpectedSELinuxPolicy_var" export-name="oval:com.mcafee.oval:var:250052" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:250048" />
          </check>
        </Rule>
        <Rule id="TheSetroubleshootRPMPackageShouldNOTBeInstalled" xml:lang="en" selected="false">
          <title xml:lang="en">The setroubleshoot RPM package should NOT be installed</title>
          <description xml:lang="en">This check is to ensure that the setroubleshoot RPM package should not exist on the system.</description>
          <rationale xml:lang="en">The SETroubleshoot service is an unnecessary daemon to have running on a server, especially if X Windows is disabled.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05108</ident>
          <fixtext xml:lang="en" fixref="F-TheSetroubleshootRPMPackageShouldNOTBeInstalled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># yum erase setroubleshoot</fixtext>
          <fix id="F-TheSetroubleshootRPMPackageShouldNOTBeInstalled" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var25" export-name="oval:com.mcafee.oval:var:242779" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
          </check>
        </Rule>
        <Rule id="TheMcstransRPMPackageShouldNOTBeInstalled" xml:lang="en" selected="false">
          <title xml:lang="en">The mcstrans RPM package should NOT be installed</title>
          <description xml:lang="en">This check is to ensure that the user specified RPM package should not exist on the system</description>
          <rationale xml:lang="en">Since this service is not used very often, disable it to reduce the amount of potentially vulnerable code running on the system.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.6.1.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05541</ident>
          <fixtext xml:lang="en" fixref="F-TheMcstransRPMPackageShouldNOTBeInstalled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to uninstall mcstrans:
          # yum erase mcstrans</fixtext>
          <fix id="F-TheMcstransRPMPackageShouldNOTBeInstalled" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var26" export-name="oval:com.mcafee.oval:var:242779" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_1.7WarningBanners" xml:lang="en">
      <title xml:lang="en">CIS 1.7 Warning Banners</title>
      <description xml:lang="en">Presenting a warning message prior to the normal user login may assist in the prosecution of trespassers on the computer system.</description>
      <Rule id="EnsureGDMLoginBannerConfigured" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure GDM login banner is configured</title>
        <description xml:lang="en">This rule ensures that the GDM login banner is set appropriately as per the user input.</description>
        <rationale xml:lang="en">Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the
          system and any monitoring policies that are in place.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01598</ident>
        <fixtext xml:lang="en" fixref="F-EnsureGDMLoginBannerConfigured" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Create the /etc/dconf/profile/gdm file with the following contents:
          user-db:user
          system-db:gdm
          file-db:/usr/share/gdm/greeter-dconf-defaults
          Create or edit the banner-message-enable and banner-message-text options
          in /etc/dconf/db/gdm.d/01-banner-message:
          [org/gnome/login-screen]
          banner-message-enable=true
          banner-message-text='Authorized uses only. All activity may be monitored and reported.'
          Run the following command to update the system databases:
          # dconf update
          Notes: Additional options and sections may appear in the /etc/dconf/db/gdm.d/01-bannermessage file.
          If a different GUI login service is in use, consult your documentation and apply an equivalent banner.</fixtext>
        <fix id="F-EnsureGDMLoginBannerConfigured" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487485" />
        </check>
      </Rule>
      <Rule id="EnsureGDMLoginBannerConfigured-Etc_dconf_profile_gdm" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure GDM login banner setting is configured - /etc/dconf/profile/gdm</title>
        <description xml:lang="en">This rule ensures that the GDM login banner is set appropriately as per the user input.</description>
        <rationale xml:lang="en">Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the
          system and any monitoring policies that are in place.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01598</ident>
        <fixtext xml:lang="en" fixref="F-EnsureGDMLoginBannerConfigured-Etc_dconf_profile_gdm" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Create the /etc/dconf/profile/gdm file with the following contents:
          user-db:user
          system-db:gdm
          file-db:/usr/share/gdm/greeter-dconf-defaults
          Create or edit the banner-message-enable and banner-message-text options
          in /etc/dconf/db/gdm.d/01-banner-message:
          [org/gnome/login-screen]
          banner-message-enable=true
          banner-message-text='Authorized uses only. All activity may be monitored and reported.'
          Run the following command to update the system databases:
          # dconf update
          Notes: Additional options and sections may appear in the /etc/dconf/db/gdm.d/01-bannermessage file.
          If a different GUI login service is in use, consult your documentation and apply an equivalent banner.</fixtext>
        <fix id="F-EnsureGDMLoginBannerConfigured-Etc_dconf_profile_gdm" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487814" />
        </check>
      </Rule>
      <Group id="CIS_1.7.1CommandLineWarningBanners" xml:lang="en">
        <title xml:lang="en">CIS 1.7.1 Command Line Warning Banners</title>
        <description xml:lang="en">The /etc/motd, /etc/issue, and /etc/issue.net files govern warning banners for standard command line logins for both local and remote users.</description>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var2" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var1" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="EnsureMessageOfDayConfiguredProperly-Etc_motd" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure message of the day is configured properly - /etc/motd</title>
          <description xml:lang="en">The contents of the /etc/motd file are displayed to users after login and function as a message of the day for authenticated users. This rule ensures that the pattern matching the text \m, \r, \s and \v is not present in the /etc/motd file.</description>
          <rationale xml:lang="en">Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. 
        Authorized users can easily get this information by running the "uname -a" command once they have logged in.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01742</ident>
          <fixtext xml:lang="en" fixref="F-EnsureMessageOfDayConfiguredProperly-Etc_motd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/motd, /etc/issue and /etc/issue.net files and remove any lines containing \m, \r, \s or \v.</fixtext>
          <fix id="F-EnsureMessageOfDayConfiguredProperly-Etc_motd" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242757" />
          </check>
        </Rule>
        <Rule id="EnsureLocalLoginWarningBannerConfiguredProperly-Etc_issue" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure local login warning banner is configured properly - /etc/issue</title>
          <description xml:lang="en">The contents of the /etc/issue file are displayed to users prior to login for local terminals. This rule ensures that the pattern matching the text \m, \r, \s and \v is not present in the /etc/issue file.</description>
          <rationale xml:lang="en">Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. 
            Authorized users can easily get this information by running the "uname -a" command once they have logged in.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01742</ident>
          <fixtext xml:lang="en" fixref="F-EnsureLocalLoginWarningBannerConfiguredProperly-Etc_issue" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/issue file with the appropriate contents according to your site policy,
            remove any instances of \m, \r, \s, or \v:
            # echo "Authorized uses only. All activity may be monitored and reported." &gt; /etc/issue</fixtext>
          <fix id="F-EnsureLocalLoginWarningBannerConfiguredProperly-Etc_issue" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242756" />
          </check>
        </Rule>
        <Rule id="EnsureRemoteLoginWarningBannerConfiguredProperly-Etc_issue.net" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure remote login warning banner is configured properly - /etc/issue.net</title>
          <description xml:lang="en">The contents of the /etc/issue.net file are displayed to users prior to login for remote connections from configured services. This rule ensures that the pattern matching the text \m, \r, \s and \v is not present in the /etc/issue.net file.</description>
          <rationale xml:lang="en">Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. 
            Authorized users can easily get this information by running the "uname -a" command once they have logged in.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01742</ident>
          <fixtext xml:lang="en" fixref="F-EnsureRemoteLoginWarningBannerConfiguredProperly-Etc_issue.net" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/issue.net file with the appropriate contents according to your site policy,
            remove any instances of \m, \r, \s, or \v:
            # echo "Authorized uses only. All activity may be monitored and reported." &gt; /etc/issue.net</fixtext>
          <fix id="F-EnsureRemoteLoginWarningBannerConfiguredProperly-Etc_issue.net" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242766" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheFile-_Etc_motd" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the file - /etc/motd</title>
          <description xml:lang="en">This rule ensures that the group owner of the file /etc/motd is set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/motd file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.4</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_motd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/motd:
            # chown root:root /etc/motd
            # chmod 644 /etc/motd</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_motd" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var2" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78795" />
          </check>
        </Rule>
        <Rule id="TestTheOwnerOfTheFile-_Etc_motd" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the file - /etc/motd</title>
          <description xml:lang="en">This rule ensures that the owner of the file /etc/motd is set
            appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/motd file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.4</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_motd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/motd:
            # chown root:root /etc/motd
            # chmod 644 /etc/motd</fixtext>
          <fix id="F-TestTheOwnerOfTheFile-_Etc_motd" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var2" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78877" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheFile-_Etc_motd" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the file - /etc/motd</title>
          <description xml:lang="en">This rule ensures that the permissions of the file /etc/motd are
            set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/motd file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.4</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_motd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/motd:
            # chown root:root /etc/motd
            # chmod 644 /etc/motd</fixtext>
          <fix id="F-TestThePermissionsOfTheFile-_Etc_motd" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var2" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var2" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var2" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var2" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var2" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var2" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var2" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var2" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var2" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78716" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheFile-_Etc_issue" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the file - /etc/issue</title>
          <description xml:lang="en">This rule ensures that the group owner of the file /etc/issue is set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/issue file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.5</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_issue" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/issue:
            # chown root:root /etc/issue
            # chmod 644 /etc/issue</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_issue" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var1" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78791" />
          </check>
        </Rule>
        <Rule id="TestTheOwnerOfTheFile-_Etc_issue" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the file - /etc/issue</title>
          <description xml:lang="en">This rule ensures that the owner of the file /etc/issue is set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/issue file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.5</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_issue" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/issue:
            # chown root:root /etc/issue
            # chmod 644 /etc/issue</fixtext>
          <fix id="F-TestTheOwnerOfTheFile-_Etc_issue" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var1" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78873" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheFile-_Etc_issue" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the file - /etc/issue</title>
          <description xml:lang="en">This rule ensures that the permissions of the file /etc/issue are set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/issue file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.5</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_issue" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/issue:
            # chown root:root /etc/issue
            # chmod 644 /etc/issue</fixtext>
          <fix id="F-TestThePermissionsOfTheFile-_Etc_issue" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var1" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var1" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var1" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var1" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var1" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var1" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var1" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var1" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var1" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78712" />
          </check>
        </Rule>
        <Rule id="Testthegroupownerofthefile-etc-issue.net" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the file - /etc/issue.net</title>
          <description xml:lang="en">This rule ensures that the group owner of the file /etc/issue.net is set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/issue.net file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.6</ident>
          <fixtext xml:lang="en" fixref="F-Testthegroupownerofthefile-etc-issue.net" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/issue.net:
            # chown root:root /etc/issue.net
            # chmod 644 /etc/issue.net</fixtext>
          <fix id="F-Testthegroupownerofthefile-etc-issue.net" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var0" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78792" />
          </check>
        </Rule>
        <Rule id="TestTheOwnerOfTheFile-_Etc_issue.net" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the file - /etc/issue.net</title>
          <description xml:lang="en">This rule ensures that the owner of the file /etc/issue.net is set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/issue.net file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.6</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_issue.net" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/issue.net:
            # chown root:root /etc/issue.net
            # chmod 644 /etc/issue.net</fixtext>
          <fix id="F-TestTheOwnerOfTheFile-_Etc_issue.net" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var0" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78874" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheFile-_Etc_issue.net" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the file - /etc/issue.net</title>
          <description xml:lang="en">This rule ensures that the permissions of the file /etc/issue.net are set appropriately as per the user input.</description>
          <rationale xml:lang="en">If the /etc/issue.net file does not have the correct ownership it could be modified by unauthorized users with incorrect or misleading information.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">1.7.1.6</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_issue.net" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/issue.net:
            # chown root:root /etc/issue.net
            # chmod 644 /etc/issue.net</fixtext>
          <fix id="F-TestThePermissionsOfTheFile-_Etc_issue.net" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var0" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var0" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var0" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var0" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var0" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var0" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var0" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var0" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var0" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78713" />
          </check>
        </Rule>
      </Group>
    </Group>
  </Group>
  <Group id="CIS_2OSServices" xml:lang="en">
    <title xml:lang="en">CIS 2 OS Services</title>
    <Group id="CIS_2.1RemoveLegacyServices" xml:lang="en">
      <title xml:lang="en">CIS 2.1 Remove Legacy Services</title>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">true</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var62" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">2</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var66" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var63" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">3</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var67" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var64" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">4</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var68" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var65" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">5</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var69" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Rule id="DisableChargen-dgram" xml:lang="en" selected="false">
        <title xml:lang="en">Disable chargen-dgram</title>
        <description xml:lang="en">chargen-dram is a network service that responds with 0 to 512 ASCII characters for each datagram it receives. Disabling this service will reduce the
          remote attack surface of the system. This rule ensures that the chargen-dgram service is disabled on a system.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04914</ident>
        <fixtext xml:lang="en" fixref="F-DisableChargen-dgram" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable the chargen-dgram service by running the following command: # chkconfig chargen-dgram off</fixtext>
        <fix id="F-DisableChargen-dgram" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8874" />
        </check>
      </Rule>
      <Rule id="DisableChargen-stream" xml:lang="en" selected="false">
        <title xml:lang="en">Disable chargen-stream</title>
        <description xml:lang="en">chargen-stream is a network service that responds with 0 to 512 ASCII characters for each connection it receives. This rule ensures that the chargen-stream
          service is disabled on a system.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04914</ident>
        <fixtext xml:lang="en" fixref="F-DisableChargen-stream" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable the chargen-stream service by running the following command: # chkconfig chargen-stream off</fixtext>
        <fix id="F-DisableChargen-stream" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8856" />
        </check>
      </Rule>
      <Rule id="DisableDaytime-dgram" xml:lang="en" selected="false">
        <title xml:lang="en">Disable daytime-dgram</title>
        <description xml:lang="en">daytime-dram is a network service that responds with the server's current date and time. Disabling this service will reduce the remote attack
          surface of the system. This rule ensures that the daytime-dram service is disabled on a system.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04924</ident>
        <fixtext xml:lang="en" fixref="F-DisableDaytime-dgram" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable the daytime-dgram service by running the following command: # chkconfig daytime-dgram off</fixtext>
        <fix id="F-DisableDaytime-dgram" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8875" />
        </check>
      </Rule>
      <Rule id="DisableDaytime-stream" xml:lang="en" selected="false">
        <title xml:lang="en">Disable daytime-stream</title>
        <description xml:lang="en">daytime-stream is a network service that responds with the
          server's current date and time. Disabling this service will reduce the remote attack
          surface of the system. This rule ensures that daytime-stream service is disabled on a
          system.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04924</ident>
        <fixtext xml:lang="en" fixref="F-DisableDaytime-stream" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable the daytime-stream service by running the following command: # chkconfig daytime-stream off</fixtext>
        <fix id="F-DisableDaytime-stream" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8865" />
        </check>
      </Rule>
      <Rule id="DisableDiscard-dgram" xml:lang="en" selected="false">
        <title xml:lang="en">Disable discard-dgram</title>
        <description xml:lang="en">discard is a network service that simply discards all data it receives. This service is intended for debugging and testing purposes. It is recommended that this service be disabled.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.3</ident>
        <fixtext xml:lang="en" fixref="F-DisableDiscard-dgram" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable discard-dgram:
          # chkconfig discard-stream off</fixtext>
        <fix id="F-DisableDiscard-dgram" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:429107" />
        </check>
      </Rule>
      <Rule id="DisableDiscard-stream" xml:lang="en" selected="false">
        <title xml:lang="en">Disable discard-stream</title>
        <description xml:lang="en">discard is a network service that simply discards all data it receives. This service is intended for debugging and testing purposes. It is recommended that this service be disabled.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.3</ident>
        <fixtext xml:lang="en" fixref="F-DisableDiscard-stream" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable discard-stream:
          # chkconfig discard-dgram off</fixtext>
        <fix id="F-DisableDiscard-stream" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412435" />
        </check>
      </Rule>
      <Rule id="DisableEcho-dgram" xml:lang="en" selected="false">
        <title xml:lang="en">Disable echo-dgram</title>
        <description xml:lang="en">echo-dgram is a network service that responds to clients with the data sent to it by the client. Disabling this service will reduce the remote attack
          surface of the system. This rule ensures that the echo-dgram service is disabled on a system.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09927</ident>
        <fixtext xml:lang="en" fixref="F-DisableEcho-dgram" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable the echo-dgram service by running the following command: # chkconfig echo-dgram off</fixtext>
        <fix id="F-DisableEcho-dgram" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8873" />
        </check>
      </Rule>
      <Rule id="DisableEcho-stream" xml:lang="en" selected="false">
        <title xml:lang="en">Disable echo-stream</title>
        <description xml:lang="en">echo-stream is a network service that responds to clients with the data sent to it by the client. Disabling this service will reduce the remote attack
          surface of the system. This rule ensures that the echo-stream service is disabled on a system.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09928</ident>
        <fixtext xml:lang="en" fixref="F-DisableEcho-stream" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable the echo-stream service by running the following command: # chkconfig echo-stream off</fixtext>
        <fix id="F-DisableEcho-stream" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8853" />
        </check>
      </Rule>
      <Rule id="DisableTime-dgram" xml:lang="en" selected="false">
        <title xml:lang="en">Disable time-dgram</title>
        <description xml:lang="en">time is a network service that responds with the server's current date and time as a 32 bit integer. This service is intended for debugging and testing purposes. It is recommended
          that this service be disabled.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.5</ident>
        <fixtext xml:lang="en" fixref="F-DisableTime-dgram" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable time-dgram:
          # chkconfig time-dgram off</fixtext>
        <fix id="F-DisableTime-dgram" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8857" />
        </check>
      </Rule>
      <Rule id="DisableTime-stream" xml:lang="en" selected="false">
        <title xml:lang="en">Disable time-stream</title>
        <description xml:lang="en">time is a network service that responds with the server's current date and time as a 32 bit integer. This service is intended for debugging and testing purposes. It is recommended
          that this service be disabled.</description>
        <rationale xml:lang="en">Disabling this service will reduce the remote attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.5</ident>
        <fixtext xml:lang="en" fixref="F-DisableTime-stream" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable time-stream:
          # chkconfig time-stream off</fixtext>
        <fix id="F-DisableTime-stream" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8896" />
        </check>
      </Rule>
      <Rule id="DisableRexec" xml:lang="en" selected="false">
        <title xml:lang="en">Disable rexec</title>
        <description xml:lang="en">The Berkeley rsh-server (rsh, rlogin, rexec) package contains legacy services that exchange credentials in clear-text.</description>
        <rationale xml:lang="en">These legacy services contain numerous security exposures and have been replaced with the more secure SSH package.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.6</ident>
        <fixtext xml:lang="en" fixref="F-DisableRexec" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable rsh, rlogin, and rexec:
          # chkconfig rexec off
          # chkconfig rlogin off
          # chkconfig rsh off</fixtext>
        <fix id="F-DisableRexec" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8870" />
        </check>
      </Rule>
      <Rule id="DisableRlogin" xml:lang="en" selected="false">
        <title xml:lang="en">Disable rlogin</title>
        <description xml:lang="en">The Berkeley rsh-server (rsh, rlogin, rexec) package contains legacy services that exchange credentials in clear-text.</description>
        <rationale xml:lang="en">These legacy services contain numerous security exposures and have been replaced with the more secure SSH package.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.6</ident>
        <fixtext xml:lang="en" fixref="F-DisableRlogin" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable rsh, rlogin, and rexec:
          # chkconfig rexec off
          # chkconfig rlogin off
          # chkconfig rsh off</fixtext>
        <fix id="F-DisableRlogin" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8892" />
        </check>
      </Rule>
      <Rule id="DisableRsh" xml:lang="en" selected="false">
        <title xml:lang="en">Disable rsh</title>
        <description xml:lang="en">The Berkeley rsh-server (rsh, rlogin, rexec) package contains legacy services that exchange credentials in clear-text.</description>
        <rationale xml:lang="en">These legacy services contain numerous security exposures and have been replaced with the more secure SSH package.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01480</ident>
        <fixtext xml:lang="en" fixref="F-DisableRsh" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to disable rsh, rlogin, and rexec:
          # chkconfig rexec off
          # chkconfig rlogin off
          # chkconfig rsh off</fixtext>
        <fix id="F-DisableRsh" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8866" />
        </check>
      </Rule>
      <Rule id="DisableTalk" xml:lang="en" selected="false">
        <title xml:lang="en">Disable talk</title>
        <description xml:lang="en">The talk software makes it possible for users to send and receive messages across systems through a terminal session. The talk client (allows initiate of talk sessions) is installed by default.</description>
        <rationale xml:lang="en">The software presents a security risk as it uses unencrypted protocols for communication.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08745</ident>
        <fixtext xml:lang="en" fixref="F-DisableTalk" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable talk:
          # chkconfig talk off</fixtext>
        <fix id="F-DisableTalk" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8855" />
        </check>
      </Rule>
      <Rule id="DisableTelnet" xml:lang="en" selected="false">
        <title xml:lang="en">Disable telnet</title>
        <description xml:lang="en">The telnet-server package contains the telnet daemon, which accepts connections from users from other systems via the telnet protocol.</description>
        <rationale xml:lang="en">The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow a user with access to sniff network traffic the ability to steal
          credentials. The ssh package provides an encrypted session and stronger security.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.8</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04953</ident>
        <fixtext xml:lang="en" fixref="F-DisableTelnet" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable telnet:
          # chkconfig telnet off</fixtext>
        <fix id="F-DisableTelnet" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8893" />
        </check>
      </Rule>
      <Rule id="DisableTftp" xml:lang="en" selected="false">
        <title xml:lang="en">Disable tftp</title>
        <description xml:lang="en">Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot machines from a boot server. The packages
          tftp and atftp are both used to define and support a TFTP server.</description>
        <rationale xml:lang="en">TFTP does not support authentication nor does it ensure the confidentiality or integrity of data. It is recommended that TFTP be removed, unless there is a specific need for TFTP. In
          that case, extreme caution must be used when configuring the services.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.9</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01484</ident>
        <fixtext xml:lang="en" fixref="F-DisableTftp" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable tftp:
          # chkconfig tftp off</fixtext>
        <fix id="F-DisableTftp" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8872" />
        </check>
      </Rule>
      <Rule id="DisableRsync" xml:lang="en" selected="false">
        <title xml:lang="en">Disable rsync</title>
        <description xml:lang="en">The rsyncd service can be used to synchronize files between systems over network links.</description>
        <rationale xml:lang="en">The rsyncd service presents a security risk as it uses unencrypted protocols for communication.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.10</ident>
        <fixtext xml:lang="en" fixref="F-DisableRsync" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable rsync:
          # chkconfig rsync off</fixtext>
        <fix id="F-DisableRsync" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:87714" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:76371" />
        </check>
      </Rule>
      <Rule id="DisableXinetd-Runlevel2" xml:lang="en" selected="false">
        <title xml:lang="en">Disable xinetd</title>
        <description xml:lang="en">The eXtended InterNET Daemon (xinetd) is an open source super daemon that replaced the original inetd daemon. 
          The xinetd daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests.</description>
        <rationale xml:lang="en">If there are no xinetd services required, it is recommended that the daemon be disabled.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01509</ident>
        <fixtext xml:lang="en" fixref="F-DisableXinetd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run one of the following command to disable xinetd:
          # chkconfig xinetd off</fixtext>
        <fix id="F-DisableXinetd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var62" export-name="oval:com.mcafee.oval:var:79726" />
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var66" export-name="oval:com.mcafee.oval:var:87715" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8145" />
        </check>
      </Rule>
      <Rule id="DisableXinetd-Runlevel3" xml:lang="en" selected="false">
        <title xml:lang="en">Disable xinetd</title>
        <description xml:lang="en">The eXtended InterNET Daemon (xinetd) is an open source super daemon that replaced the original inetd daemon. 
          The xinetd daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests.</description>
        <rationale xml:lang="en">If there are no xinetd services required, it is recommended that the daemon be disabled.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01509</ident>
        <fixtext xml:lang="en" fixref="F-DisableXinetd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run one of the following command to disable xinetd:
          # chkconfig xinetd off</fixtext>
        <fix id="F-DisableXinetd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var63" export-name="oval:com.mcafee.oval:var:79726" />
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var67" export-name="oval:com.mcafee.oval:var:87715" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8145" />
        </check>
      </Rule>
      <Rule id="DisableXinetd-Runlevel4" xml:lang="en" selected="false">
        <title xml:lang="en">Disable xinetd</title>
        <description xml:lang="en">The eXtended InterNET Daemon (xinetd) is an open source super daemon that replaced the original inetd daemon. 
          The xinetd daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests.</description>
        <rationale xml:lang="en">If there are no xinetd services required, it is recommended that the daemon be disabled.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01509</ident>
        <fixtext xml:lang="en" fixref="F-DisableXinetd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run one of the following command to disable xinetd:
          # chkconfig xinetd off</fixtext>
        <fix id="F-DisableXinetd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var64" export-name="oval:com.mcafee.oval:var:79726" />
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var68" export-name="oval:com.mcafee.oval:var:87715" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8145" />
        </check>
      </Rule>
      <Rule id="DisableXinetd-Runlevel5" xml:lang="en" selected="false">
        <title xml:lang="en">Disable xinetd</title>
        <description xml:lang="en">The eXtended InterNET Daemon (xinetd) is an open source super daemon that replaced the original inetd daemon. 
          The xinetd daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests.</description>
        <rationale xml:lang="en">If there are no xinetd services required, it is recommended that the daemon be disabled.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.1.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01509</ident>
        <fixtext xml:lang="en" fixref="F-DisableXinetd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run one of the following command to disable xinetd:
          # chkconfig xinetd off</fixtext>
        <fix id="F-DisableXinetd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var65" export-name="oval:com.mcafee.oval:var:79726" />
          <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var69" export-name="oval:com.mcafee.oval:var:87715" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8145" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_2.2SpecialPurposeServices" xml:lang="en">
      <title xml:lang="en">CIS 2.2 Special Purpose Services</title>
      <Value id="WhatShouldBeTheUmaskValue_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">027</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">2</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var15" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">3</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var16" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">4</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var19" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">5</value>
      </Value>
      <Value id="ShouldTheServiceBeEnabledOrDisabled_var20" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">false</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackagesToBeVerified_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">xorg-x11*</value>
      </Value>
      <Rule id="EnsureXWindowSystemIsNotInstalled" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure X Window System is not installed</title>
        <description xml:lang="en">cThe X Window System provides a Graphical User Interface (GUI) where users can have multiple windows in which to run programs and various add on. The X Windows system is
            typically used on workstations where users login, but not on servers where users typically do not login.</description>
        <rationale xml:lang="en">Unless your organization specifically requires graphical login access via X Windows, remove it to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02168</ident>
        <fixtext xml:lang="en" fixref="F-EnsureXWindowSystemIsNotInstalled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add or edit restrict lines in /etc/ntp.conf to match the following:
            Run the following command to remove the X Windows System packages:
            # yum remove xorg-x11*</fixtext>
        <fix id="F-EnsureXWindowSystemIsNotInstalled" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackagesToBeVerified_var" export-name="oval:com.mcafee.oval:var:1416220" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412335" />
        </check>
      </Rule>
      <Rule id="ConfigureMailTransferAgentForLocal-OnlyMode" xml:lang="en" selected="false">
        <title xml:lang="en">Configure Mail Transfer Agent for Local-Only Mode</title>
        <description xml:lang="en">If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail. 
        This rule ensures that the MTA is set to local only mode in /etc/postfix/main.cf file.</description>
        <rationale xml:lang="en">The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail
        messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.15</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09940</ident>
        <fixtext xml:lang="en" fixref="F-ConfigureMailTransferAgentForLocal-OnlyMode" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit /etc/postfix/main.cf and add the following line to the RECEIVING MAIL section. If the line already exists, 
        change it to look like the line below. inet_interfaces = localhost  # Execute the following command to restart postfix # service postfix restart</fixtext>
        <fix id="F-ConfigureMailTransferAgentForLocal-OnlyMode" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:243250" />
        </check>
      </Rule>
      <Group id="CIS_2.2.1TimeSynchronization" xml:lang="en">
        <title xml:lang="en">CIS 2.2.1 Time Synchronization</title>
        <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var33" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">ntp</value>
        </Value>
        <Value id="EnterTheNameOfTheRPMPackageToBeVerified._var43" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">chrony</value>
        </Value>
        <Rule id="EnsureTimeSynchronizationIsInUse-NtpRPMPackage" xml:lang="en" selected="false">
          <title xml:lang="en">Test for ntp RPM package</title>
          <description xml:lang="en">System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all
            systems synchronize their clocks to them.</description>
          <rationale xml:lang="en">Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise,
            which aids in forensic investigations.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.1</ident>
          <fixtext xml:lang="en" fixref="F-EnsureTimeSynchronizationIsInUse-NtpRPMPackage" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">On physical systems or virtual systems where host based time synchronization is not
            available run one of the following commands to install either ntp or chrony:
            # yum install ntp
            # yum install chrony
            On virtual systems where host based time synchronization is available consult your virtualization software documentation and setup host based synchronization.</fixtext>
          <fix id="F-EnsureTimeSynchronizationIsInUse-NtpRPMPackage" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var33" export-name="oval:com.mcafee.oval:var:242779" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
          </check>
        </Rule>
        <Rule id="EnsureTimeSynchronizationIsInUse-ChronyRPMPackage" xml:lang="en" selected="false">
          <title xml:lang="en">Test for chrony RPM package</title>
          <description xml:lang="en">System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all
            systems synchronize their clocks to them.</description>
          <rationale xml:lang="en">Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise,
            which aids in forensic investigations.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.1</ident>
          <fixtext xml:lang="en" fixref="F-EnsureTimeSynchronizationIsInUse-NtpRPMPackage" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">On physical systems or virtual systems where host based time synchronization is not
            available run one of the following commands to install either ntp or chrony:
            # yum install ntp
            # yum install chrony
            On virtual systems where host based time synchronization is available consult your virtualization software documentation and setup host based synchronization.</fixtext>
          <fix id="F-EnsureTimeSynchronizationIsInUse-NtpRPMPackage" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified._var43" export-name="oval:com.mcafee.oval:var:242779" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
          </check>
        </Rule>
        <Group id="CIS_2.2.1.2NTPConfiguration" xml:lang="en">
          <title xml:lang="en">CIS 2.2.1.2 NTP Configuration</title>
          <Rule id="EnsureNtpConfigured-RestrictLinesInEtc_ntp.conf" xml:lang="en" selected="false">
            <title xml:lang="en">Ensure ntp is configured - Restrict lines in /etc/ntp.conf</title>
            <description xml:lang="en">ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly
              accurate. More information on NTP can be found at http://www.ntp.org. ntp can be configured to be a client and/or a server.</description>
            <rationale xml:lang="en">If ntp is in use on the system proper configuration is vital to ensuring time synchronization is working properly.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.2</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06858</ident>
            <fixtext xml:lang="en" fixref="F-EnsureNtpConfigured-RestrictLinesInEtc_ntp.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add or edit restrict lines in /etc/ntp.conf to match the following:
              restrict -4 default kod nomodify notrap nopeer noquery
              restrict -6 default kod nomodify notrap nopeer noquery</fixtext>
            <fix id="F-EnsureNtpConfigured-RestrictLinesInEtc_ntp.conf" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:1412333" />
            </check>
          </Rule>
          <Rule id="EnsureNtpConfigured-AddServerLinesToEtc_ntp.conf" xml:lang="en" selected="false">
            <title xml:lang="en">Ensure ntp is configured - Add server lines to /etc/ntp.conf</title>
            <description xml:lang="en">ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly
              accurate. More information on NTP can be found at http://www.ntp.org. ntp can be configured to be a client and/or a server.</description>
            <rationale xml:lang="en">If ntp is in use on the system proper configuration is vital to ensuring time synchronization is working properly.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.2</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06858</ident>
            <fixtext xml:lang="en" fixref="F-EnsureNtpConfigured-AddServerLinesToEtc_ntp.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add or edit server lines to /etc/ntp.conf as appropriate:
              server &lt;remote-server&gt;</fixtext>
            <fix id="F-EnsureNtpConfigured-AddServerLinesToEtc_ntp.conf" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:1412371" />
            </check>
          </Rule>
          <Rule id="EnsureNtpConfigured-AddOPTIONSInEtc_sysconfig_ntpd" xml:lang="en" selected="false">
            <title xml:lang="en">Ensure ntp is configured - Add OPTIONS in /etc/sysconfig/ntpd</title>
            <description xml:lang="en">ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly
              accurate. More information on NTP can be found at http://www.ntp.org. ntp can be configured to be a client and/or a server.</description>
            <rationale xml:lang="en">If ntp is in use on the system proper configuration is vital to ensuring time synchronization is working properly.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.2</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06858</ident>
            <fixtext xml:lang="en" fixref="F-EnsureNtpConfigured-AddOPTIONSInEtc_sysconfig_ntpd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add or edit the OPTIONS in /etc/sysconfig/ntpd to include '-u ntp:ntp':
              OPTIONS="-u ntp:ntp"</fixtext>
            <fix id="F-EnsureNtpConfigured-AddOPTIONSInEtc_sysconfig_ntpd" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:1001481" />
            </check>
          </Rule>
        </Group>
        <Group id="CIS_2.2.1.3Ensure_Chrony_Is_Configured" xml:lang="en">
          <title xml:lang="en">CIS 2.2.1.3 Ensure chrony is configured</title>
          <Rule id="ConfigureNetworkTimeProtocol_NTP_In_Etc_Chrony.conf" xml:lang="en" selected="false">
            <title xml:lang="en">Configure Network Time Protocol (NTP) in /etc/chrony.conf</title>
            <description xml:lang="en">chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly
              accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. chrony can be configured to be a client and/or a server.</description>
            <rationale xml:lang="en">If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.
              This recommendation only applies if chrony is in use on the system.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.3</ident>
            <fixtext xml:lang="en" fixref="F-ConfigureNetworkTimeProtocol_NTP_In_Etc_Chrony.conf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add or edit restrict lines in /etc/ntp.conf to match the following:
              Add or edit server lines to /etc/chrony.conf as appropriate:
              server remote-server
              Add or edit the OPTIONS in /etc/sysconfig/chronyd to include '-u chrony':
              OPTIONS="-u chrony"</fixtext>
            <fix id="F-ConfigureNetworkTimeProtocol_NTP_In_Etc_Chrony.conf" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:2487566" />
            </check>
          </Rule>
          <Rule id="ConfigureNetworkTimeProtocol_NTP_In_Etc_sysconfig_chronyd" xml:lang="en" selected="false">
            <title xml:lang="en">Configure Network Time Protocol (NTP) in /etc/sysconfig/chronyd</title>
            <description xml:lang="en">chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly
              accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. chrony can be configured to be a client and/or a server.</description>
            <rationale xml:lang="en">If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.
              This recommendation only applies if chrony is in use on the system.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.1.3</ident>
            <fixtext xml:lang="en" fixref="F-ConfigureNetworkTimeProtocol_NTP_In_Etc_sysconfig_chronyd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add or edit restrict lines in /etc/ntp.conf to match the following:
              Add or edit server lines to /etc/chrony.conf as appropriate:
              server remote-server
              Add or edit the OPTIONS in /etc/sysconfig/chronyd to include '-u chrony':
              OPTIONS="-u chrony"</fixtext>
            <fix id="F-ConfigureNetworkTimeProtocol_NTP_In_Etc_sysconfig_chronyd" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:2487562" />
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="CIS_2.2.3DisableAvahiServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.3 Disable Avahi Server</title>
        <description xml:lang="en">Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover
          services and hosts running on a local network with no specific configuration.</description>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var22" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var26" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var23" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var27" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var24" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var28" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var25" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var29" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service-Avahi-daemon-RunningState-runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - avahi-daemon - running state - runlevel 2</title>
          <description xml:lang="en">This check verifies whether the avahi-daemon service is enabled or disabled at runlevel 2.</description>
          <rationale xml:lang="en">Automatic discovery of network services is not normally required for system functionality. It is recommended to disable the service to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04977</ident>
          <fixtext xml:lang="en" fixref="F-Service-Avahi-daemon-RunningState-runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable avahi-daemon:
            # chkconfig avahi-daemon off</fixtext>
          <fix id="F-Service-Avahi-daemon-RunningState-runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var22" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var26" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7768" />
          </check>
        </Rule>
        <Rule id="Service-Avahi-daemon-RunningState-RunLevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - avahi-daemon - running state - runlevel 3</title>
          <description xml:lang="en">This check verifies whether the avahi-daemon service is enabled or disabled at runlevel 3.</description>
          <rationale xml:lang="en">Automatic discovery of network services is not normally required for system functionality. It is recommended to disable the service to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04977</ident>
          <fixtext xml:lang="en" fixref="F-Service-Avahi-daemon-RunningState-runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable avahi-daemon:
            # chkconfig avahi-daemon off</fixtext>
          <fix id="F-Service-Avahi-daemon-RunningState-runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var23" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var27" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7768" />
          </check>
        </Rule>
        <Rule id="Service-Avahi-daemon-RunningState-Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - avahi-daemon - running state - runlevel 4</title>
          <description xml:lang="en">This check verifies whether the avahi-daemon service is enabled or disabled at runlevel 2.</description>
          <rationale xml:lang="en">Automatic discovery of network services is not normally required for system functionality. It is recommended to disable the service to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04977</ident>
          <fixtext xml:lang="en" fixref="F-Service-Avahi-daemon-RunningState-runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable avahi-daemon:
            # chkconfig avahi-daemon off</fixtext>
          <fix id="F-Service-Avahi-daemon-RunningState-runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var24" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var28" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7768" />
          </check>
        </Rule>
        <Rule id="Service-Avahi-daemon-RunningState-Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - avahi-daemon - running state - runlevel 5</title>
          <description xml:lang="en">This check verifies whether the avahi-daemon service is enabled or disabled at runlevel 5.</description>
          <rationale xml:lang="en">Automatic discovery of network services is not normally required for system functionality. It is recommended to disable the service to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04977</ident>
          <fixtext xml:lang="en" fixref="F-Service-Avahi-daemon-RunningState-runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable avahi-daemon:
            # chkconfig avahi-daemon off</fixtext>
          <fix id="F-Service-Avahi-daemon-RunningState-runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var25" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var29" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7768" />
          </check>
        </Rule>
        <Rule id="DisableAvahiServer-RemoveZeroconf" xml:lang="en" selected="false">
          <title xml:lang="en">Disable Avahi Server - Remove zeroconf</title>
          <description xml:lang="en">zeroconf route during system boot should be disabled in the /etc/sysconfig/network file.</description>
          <rationale xml:lang="en">Automatic discovery of network services is not normally required for system functionality. It is recommended to disable the service to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.3</ident>
          <fixtext xml:lang="en" fixref="F-DisableAvahiServer-RemoveZeroconf" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable avahi-daemon:
            # chkconfig avahi-daemon off</fixtext>
          <fix id="F-DisableAvahiServer-RemoveZeroconf" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:245566" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.4DisableCUPS" xml:lang="en">
        <title xml:lang="en">CIS 2.2.4 Disable CUPS</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledCups_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var3" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledCups_var6" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var4" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledCups_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var5" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledCups_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="DisablePrintServer-CUPSAtrunlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Disable Print Server - CUPS at runlevel 2</title>
          <description xml:lang="en">The Common Unix Print System (CUPS) provides the ability to print
          to both local and network printers. If the system does not need to print jobs or accept print
          jobs from other systems, it is recommended that CUPS be disabled to reduce the potential
          attack surface. This rule ensures that the cups service is disabled at runlevel
          2.</description>
          <rationale xml:lang="en">If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04978</ident>
          <fixtext xml:lang="en" fixref="F-DisablePrintServer-CUPSAtrunlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig cups off</fixtext>
          <fix id="F-DisablePrintServer-CUPSAtrunlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledCups_var" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7807" />
          </check>
        </Rule>
        <Rule id="DisablePrintServer-CUPSAtRunlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Disable Print Server - CUPS at runlevel 3</title>
          <description xml:lang="en">The Common Unix Print System (CUPS) provides the ability to print
          to both local and network printers. If the system does not need to print jobs or accept print
          jobs from other systems, it is recommended that CUPS be disabled to reduce the potential
          attack surface. This rule ensures that the cups service is disabled at runlevel
          3.</description>
          <rationale xml:lang="en">If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04978</ident>
          <fixtext xml:lang="en" fixref="F-DisablePrintServer-CUPSAtrunlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig cups off</fixtext>
          <fix id="F-DisablePrintServer-CUPSAtrunlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var3" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledCups_var6" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7807" />
          </check>
        </Rule>
        <Rule id="DisablePrintServer-CUPSAtRunlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Disable Print Server - CUPS at runlevel 4</title>
          <description xml:lang="en">The Common Unix Print System (CUPS) provides the ability to print
          to both local and network printers. If the system does not need to print jobs or accept print
          jobs from other systems, it is recommended that CUPS be disabled to reduce the potential
          attack surface. This rule ensures that the cups service is disabled at runlevel
          4.</description>
          <rationale xml:lang="en">If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04978</ident>
          <fixtext xml:lang="en" fixref="F-DisablePrintServer-CUPSAtrunlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig cups off</fixtext>
          <fix id="F-DisablePrintServer-CUPSAtrunlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var4" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledCups_var7" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7807" />
          </check>
        </Rule>
        <Rule id="DisablePrintServer-CUPSAtRunlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Disable Print Server - CUPS at runlevel 5</title>
          <description xml:lang="en">The Common Unix Print System (CUPS) provides the ability to print
          to both local and network printers. If the system does not need to print jobs or accept print
          jobs from other systems, it is recommended that CUPS be disabled to reduce the potential
          attack surface. This rule ensures that the cups service is disabled at runlevel
          5.</description>
          <rationale xml:lang="en">If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04978</ident>
          <fixtext xml:lang="en" fixref="F-DisablePrintServer-CUPSAtrunlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig cups off</fixtext>
          <fix id="F-DisablePrintServer-CUPSAtrunlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabledCups_var5" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledCups_var8" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7807" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.5DisableDHCPServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.5 Disable DHCP Server</title>
        <Rule id="Service_Dhcpd_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dhcpd - running state - runlevel 2</title>
          <description xml:lang="en">This check verifies whether the dhcpd service is enabled or disabled at runlevel 2.</description>
          <rationale xml:lang="en">Unless a server is specifically set up to act as a DHCP server, it is recommended that this service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07627</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dhcpd_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable dhcp server: 
          # chkconfig dhcpd off</fixtext>
          <fix id="F-Service_Dhcpd_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var14" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var17" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7820" />
          </check>
        </Rule>
        <Rule id="Service_Dhcpd_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dhcpd - running state - runlevel 3</title>
          <description xml:lang="en">This check verifies whether the dhcpd service is enabled or disabled at runlevel 3.</description>
          <rationale xml:lang="en">Unless a server is specifically set up to act as a DHCP server, it is recommended that this service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07627</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dhcpd_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable dhcp server: 
          # chkconfig dhcpd off</fixtext>
          <fix id="F-Service_Dhcpd_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var15" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var18" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7820" />
          </check>
        </Rule>
        <Rule id="Service_Dhcpd_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dhcpd - running state - runlevel 4</title>
          <description xml:lang="en">This check verifies whether the dhcpd service is enabled or disabled at runlevel 4.</description>
          <rationale xml:lang="en">Unless a server is specifically set up to act as a DHCP server, it is recommended that this service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07627</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dhcpd_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable dhcp server: 
          # chkconfig dhcpd off</fixtext>
          <fix id="F-Service_Dhcpd_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var16" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var19" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7820" />
          </check>
        </Rule>
        <Rule id="Service_Dhcpd_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dhcpd - running state - runlevel 5</title>
          <description xml:lang="en">This check verifies whether the dhcpd service is enabled or disabled at runlevel 5.</description>
          <rationale xml:lang="en">Unless a server is specifically set up to act as a DHCP server, it is recommended that this service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07627</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dhcpd_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable dhcp server: 
          # chkconfig dhcpd off</fixtext>
          <fix id="F-Service_Dhcpd_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var17" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var20" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7820" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.6DisableLDAPServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.6 Disable LDAP Server</title>
        <Rule id="Service_Slapd_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - slapd - running state - runlevel 2</title>
          <description xml:lang="en">This check verifies whether the slapd service is enabled or disabled at runlevel 2.</description>
          <rationale xml:lang="en">If the system will not need to act as an LDAP server, it is recommended that the software be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09937</ident>
          <fixtext xml:lang="en" fixref="F-Service_Slapd_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable slapd:
          # chkconfig slapd off</fixtext>
          <fix id="F-Service_Slapd_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var14" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var17" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412336" />
          </check>
        </Rule>
        <Rule id="Service_Slapd_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - slapd - running state - runlevel 3</title>
          <description xml:lang="en">This check verifies whether the slapd service is enabled or disabled at runlevel 3.</description>
          <rationale xml:lang="en">If the system will not need to act as an LDAP server, it is recommended that the software be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09937</ident>
          <fixtext xml:lang="en" fixref="F-Service_Slapd_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable slapd:
          # chkconfig slapd off</fixtext>
          <fix id="F-Service_Slapd_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var15" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var18" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412336" />
          </check>
        </Rule>
        <Rule id="Service_Slapd_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - slapd - running state - runlevel 4</title>
          <description xml:lang="en">This check verifies whether the slapd service is enabled or disabled at runlevel 4.</description>
          <rationale xml:lang="en">If the system will not need to act as an LDAP server, it is recommended that the software be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09937</ident>
          <fixtext xml:lang="en" fixref="F-Service_Slapd_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable slapd:
          # chkconfig slapd off</fixtext>
          <fix id="F-Service_Slapd_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var16" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var19" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412336" />
          </check>
        </Rule>
        <Rule id="Service_Slapd_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - slapd - running state - runlevel 5</title>
          <description xml:lang="en">This check verifies whether the slapd service is enabled or disabled at runlevel 5.</description>
          <rationale xml:lang="en">If the system will not need to act as an LDAP server, it is recommended that the software be disabled to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09937</ident>
          <fixtext xml:lang="en" fixref="F-Service_Slapd_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable slapd:
          # chkconfig slapd off</fixtext>
          <fix id="F-Service_Slapd_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var17" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var20" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412336" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.7DisableNFSAndRPC" xml:lang="en">
        <title xml:lang="en">CIS 2.2.7 Disable NFS and RPC</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var14" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var15" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var16" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var17" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisablednfsbind_var17" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisablednfsbind_var18" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisablednfsbind_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisablednfsbind_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Nfs_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - nfs - running state - runlevel 2</title>
          <description xml:lang="en">This check verifies if whether the nfs service is enabled or disabled at runlevel 2.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-Service_Nfs_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable NFS :
            # chkconfig nfs off</fixtext>
          <fix id="F-Service_Nfs_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var14" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var17" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50014" />
          </check>
        </Rule>
        <Rule id="Service_Nfs_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - nfs - running state - runlevel 3</title>
          <description xml:lang="en">This check verifies if whether the nfs service is enabled or disabled at runlevel 3.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-Service_Nfs_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable NFS :
            # chkconfig nfs off</fixtext>
          <fix id="F-Service_Nfs_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var15" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var18" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50014" />
          </check>
        </Rule>
        <Rule id="Service_Nfs_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - nfs - running state - runlevel 4</title>
          <description xml:lang="en">This check verifies if whether the nfs service is enabled or disabled at runlevel 4.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-Service_Nfs_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable NFS :
            # chkconfig nfs off</fixtext>
          <fix id="F-Service_Nfs_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var16" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var19" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50014" />
          </check>
        </Rule>
        <Rule id="Service_Nfs_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - nfs - running state - runlevel 5</title>
          <description xml:lang="en">This check verifies if whether the nfs service is enabled or disabled at runlevel 5.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-Service_Nfs_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Disable NFS :
            # chkconfig nfs off</fixtext>
          <fix id="F-Service_Nfs_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var17" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var20" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50014" />
          </check>
        </Rule>
        <Rule id="DisableNFSAndRPCrpcbindAtRunlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Disable rpcbind service at runlevel 2</title>
          <description xml:lang="en">NFS provides the ability for systems to mount file systems of
        other servers through the network. If the server does not export NFS shares or act as an
        NFS client, it is recommended that these services be disabled to reduce remote attack
        surface. This rule ensures that the rpcbind service is disabled at the runlevel
        2.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-DisableNFSAndRPCrpcbindAtRunlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig rpcbind off</fixtext>
          <fix id="F-DisableNFSAndRPCrpcbindAtRunlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var14" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisablednfsbind_var17" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:77441" />
          </check>
        </Rule>
        <Rule id="DisableNFSAndRPCrpcbindAtRunlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Disable rpcbind service at runlevel 3</title>
          <description xml:lang="en">NFS provides the ability for systems to mount file systems of
        other servers through the network. If the server does not export NFS shares or act as an
        NFS client, it is recommended that these services be disabled to reduce remote attack
        surface. This rule ensures that the rpcbind service is disabled at the runlevel
        3.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-DisableNFSAndRPCrpcbindAtRunlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig rpcbind off</fixtext>
          <fix id="F-DisableNFSAndRPCrpcbindAtRunlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var15" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisablednfsbind_var18" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:77441" />
          </check>
        </Rule>
        <Rule id="DisableNFSAndRPCnfsbindAtRunlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Disable rpcbind service at runlevel 4</title>
          <description xml:lang="en">NFS provides the ability for systems to mount file systems of
        other servers through the network. If the server does not export NFS shares or act as an
        NFS client, it is recommended that these services be disabled to reduce remote attack
        surface. This rule ensures that the rpcbind service is disabled at the runlevel
        4.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-DisableNFSAndRPCrpcbindAtRunlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig rpcbind off</fixtext>
          <fix id="F-DisableNFSAndRPCrpcbindAtRunlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var16" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisablednfsbind_var19" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:77441" />
          </check>
        </Rule>
        <Rule id="DisableNFSAndRPCnfsbindAtRunlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Disable rpcbind service at runlevel 5</title>
          <description xml:lang="en">NFS provides the ability for systems to mount file systems of
        other servers through the network. If the server does not export NFS shares or act as an
        NFS client, it is recommended that these services be disabled to reduce remote attack
        surface. This rule ensures that the rpcbind service is disabled at the runlevel
        5.</description>
          <rationale xml:lang="en">If the server does not export NFS shares or act as an NFS client, it is recommended that these services be disabled to reduce remote attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05981</ident>
          <fixtext xml:lang="en" fixref="F-DisableNFSAndRPCrpcbindAtRunlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig rpcbind off</fixtext>
          <fix id="F-DisableNFSAndRPCrpcbindAtRunlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisablednfsbind_var17" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisablednfsbind_var20" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:77441" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.8DisableDNSServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.8 Disable DNS Server</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var179" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var179" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var180" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var180" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var181" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var181" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var182" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var182" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Named_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - named - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the named service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.8</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07591</ident>
          <fixtext xml:lang="en" fixref="F-Service_Named_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable named:
          # chkconfig named off</fixtext>
          <fix id="F-Service_Named_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var179" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var179" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030128" />
          </check>
        </Rule>
        <Rule id="Service_Named_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - named - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the named service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.8</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07591</ident>
          <fixtext xml:lang="en" fixref="F-Service_Named_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable named:
          # chkconfig named off</fixtext>
          <fix id="F-Service_Named_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var180" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var180" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030128" />
          </check>
        </Rule>
        <Rule id="Service_Named_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - named - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the named service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.8</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07591</ident>
          <fixtext xml:lang="en" fixref="F-Service_Named_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable named:
          # chkconfig named off</fixtext>
          <fix id="F-Service_Named_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var181" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var181" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030128" />
          </check>
        </Rule>
        <Rule id="Service_Named_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - named - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the named service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.8</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07591</ident>
          <fixtext xml:lang="en" fixref="F-Service_Named_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable named:
          # chkconfig named off</fixtext>
          <fix id="F-Service_Named_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var182" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var182" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030128" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.9DisableFTPServer-Vsftpd" xml:lang="en">
        <title xml:lang="en">CIS 2.2.9 DisableFTPServer - vsftpd</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var183" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var183" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var184" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var184" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var185" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var185" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var186" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var186" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Vsftpd_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - vsftpd - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the vsftpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">FTP does not protect the confidentiality of data or authentication credentials. It is recommended sftp be used if file transfer is required. Unless there is a need to run the
            system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.9</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09938</ident>
          <fixtext xml:lang="en" fixref="F-Service_Vsftpd_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable vsftpd:
            # chkconfig vsftpd off
            Notes: Additional FTP servers also exist and should be audited.</fixtext>
          <fix id="F-Service_Vsftpd_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var183" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var183" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8119" />
          </check>
        </Rule>
        <Rule id="Service_Vsftpd_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - vsftpd - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the vsftpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">FTP does not protect the confidentiality of data or authentication credentials. It is recommended sftp be used if file transfer is required. Unless there is a need to run the
            system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.9</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09938</ident>
          <fixtext xml:lang="en" fixref="F-Service_Vsftpd_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable vsftpd:
            # chkconfig vsftpd off
            Notes: Additional FTP servers also exist and should be audited.</fixtext>
          <fix id="F-Service_Vsftpd_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var184" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var184" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8119" />
          </check>
        </Rule>
        <Rule id="Service_Vsftpd_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - vsftpd - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the vsftpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">FTP does not protect the confidentiality of data or authentication credentials. It is recommended sftp be used if file transfer is required. Unless there is a need to run the
            system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.9</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09938</ident>
          <fixtext xml:lang="en" fixref="F-Service_Vsftpd_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable vsftpd:
            # chkconfig vsftpd off
            Notes: Additional FTP servers also exist and should be audited.</fixtext>
          <fix id="F-Service_Vsftpd_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var185" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var185" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8119" />
          </check>
        </Rule>
        <Rule id="Service_Vsftpd_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - vsftpd - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the vsftpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">FTP does not protect the confidentiality of data or authentication credentials. It is recommended sftp be used if file transfer is required. Unless there is a need to run the
            system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.9</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09938</ident>
          <fixtext xml:lang="en" fixref="F-Service_Vsftpd_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable vsftpd:
            # chkconfig vsftpd off
            Notes: Additional FTP servers also exist and should be audited.</fixtext>
          <fix id="F-Service_Vsftpd_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var186" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var186" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8119" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.10DisableHTTPServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.10 Disable HTTP Server</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var187" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var187" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var188" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var188" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var189" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var189" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var190" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var190" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Httpd_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - httpd - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the httpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless there is a need to run the system as a web server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.10</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05111</ident>
          <fixtext xml:lang="en" fixref="F-Service_Httpd_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable httpd:
            # chkconfig httpd off
            Notes: Several httpd servers exist and can use other service names. apache, apache2, lighttpd, and nginx are example services that provide an HTTP server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Httpd_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var187" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var187" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030096" />
          </check>
        </Rule>
        <Rule id="Service_Httpd_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - httpd - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the httpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless there is a need to run the system as a web server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.10</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05111</ident>
          <fixtext xml:lang="en" fixref="F-Service_Httpd_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable httpd:
            # chkconfig httpd off
            Notes: Several httpd servers exist and can use other service names. apache, apache2, lighttpd, and nginx are example services that provide an HTTP server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Httpd_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var188" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var188" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030096" />
          </check>
        </Rule>
        <Rule id="Service_Httpd_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - httpd - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the httpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless there is a need to run the system as a web server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.10</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05111</ident>
          <fixtext xml:lang="en" fixref="F-Service_Httpd_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable httpd:
            # chkconfig httpd off
            Notes: Several httpd servers exist and can use other service names. apache, apache2, lighttpd, and nginx are example services that provide an HTTP server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Httpd_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var189" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var189" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030096" />
          </check>
        </Rule>
        <Rule id="Service_Httpd_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - httpd - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the httpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless there is a need to run the system as a web server, it is recommended that the package be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.10</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05111</ident>
          <fixtext xml:lang="en" fixref="F-Service_Httpd_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable httpd:
            # chkconfig httpd off
            Notes: Several httpd servers exist and can use other service names. apache, apache2, lighttpd, and nginx are example services that provide an HTTP server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Httpd_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var190" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var190" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030096" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.11DisableIMAPAndPOP3Server" xml:lang="en">
        <title xml:lang="en">CIS 2.2.11 Disable IMAP and POP3 Server</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var191" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var191" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var192" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var192" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var193" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var193" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var194" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var194" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Dovecot_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dovecot - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the dovecot service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.11</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04990</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dovecot_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable dovecot:
            # chkconfig dovecot off
            Notes: Several IMAP/POP3 servers exist and can use other service names. cyrus-imapd is an example services that provides an IMAP/POP3 server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Dovecot_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var191" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var191" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7833" />
          </check>
        </Rule>
        <Rule id="Service_Dovecot_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dovecot - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the dovecot service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.11</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04990</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dovecot_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable dovecot:
            # chkconfig dovecot off
            Notes: Several IMAP/POP3 servers exist and can use other service names. cyrus-imapd is an example services that provides an IMAP/POP3 server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Dovecot_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var192" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var192" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7833" />
          </check>
        </Rule>
        <Rule id="Service_Dovecot_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dovecot - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the dovecot service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.11</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04990</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dovecot_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable dovecot:
            # chkconfig dovecot off
            Notes: Several IMAP/POP3 servers exist and can use other service names. cyrus-imapd is an example services that provides an IMAP/POP3 server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Dovecot_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var193" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var193" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7833" />
          </check>
        </Rule>
        <Rule id="Service_Dovecot_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - dovecot - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the dovecot service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the service be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.11</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04990</ident>
          <fixtext xml:lang="en" fixref="F-Service_Dovecot_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable dovecot:
            # chkconfig dovecot off
            Notes: Several IMAP/POP3 servers exist and can use other service names. cyrus-imapd is an example services that provides an IMAP/POP3 server. 
            These and other services should also be audited.</fixtext>
          <fix id="F-Service_Dovecot_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var194" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var194" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7833" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.12DisableSamba" xml:lang="en">
        <title xml:lang="en">CIS 2.2.12 Disable Samba</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var195" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var195" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var196" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var196" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var197" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var197" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var198" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var198" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Smb_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - smb - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the smb service(Samba) is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need to mount directories and file systems to Windows systems, then this service can be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.12</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02175</ident>
          <fixtext xml:lang="en" fixref="F-Service_Smb_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable smb:
            # chkconfig smb off</fixtext>
          <fix id="F-Service_Smb_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var195" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var195" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8066" />
          </check>
        </Rule>
        <Rule id="Service_Smb_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - smb - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the smb service(Samba) is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need to mount directories and file systems to Windows systems, then this service can be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.12</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02175</ident>
          <fixtext xml:lang="en" fixref="F-Service_Smb_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable smb:
            # chkconfig smb off</fixtext>
          <fix id="F-Service_Smb_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var196" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var196" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8066" />
          </check>
        </Rule>
        <Rule id="Service_Smb_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - smb - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the smb service(Samba) is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need to mount directories and file systems to Windows systems, then this service can be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.12</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02175</ident>
          <fixtext xml:lang="en" fixref="F-Service_Smb_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable smb:
            # chkconfig smb off</fixtext>
          <fix id="F-Service_Smb_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var197" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var197" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8066" />
          </check>
        </Rule>
        <Rule id="Service_Smb_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - smb - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the smb service(Samba) is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need to mount directories and file systems to Windows systems, then this service can be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.12</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 02175</ident>
          <fixtext xml:lang="en" fixref="F-Service_Smb_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable smb:
            # chkconfig smb off</fixtext>
          <fix id="F-Service_Smb_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var198" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var198" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8066" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.13DisableHTTPProxyServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.13 Disable HTTP Proxy Server</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var199" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var199" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var200" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var200" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var201" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var201" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var202" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var202" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Squid_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - squid - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the squid service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need for a proxy server, it is recommended that the squid proxy be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.13</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09939</ident>
          <fixtext xml:lang="en" fixref="F-Service_Squid_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable squid:
            # chkconfig squid off</fixtext>
          <fix id="F-Service_Squid_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var199" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var199" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8079" />
          </check>
        </Rule>
        <Rule id="Service_Squid_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - squid - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the squid service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need for a proxy server, it is recommended that the squid proxy be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.13</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09939</ident>
          <fixtext xml:lang="en" fixref="F-Service_Squid_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable squid:
            # chkconfig squid off</fixtext>
          <fix id="F-Service_Squid_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var200" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var200" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8079" />
          </check>
        </Rule>
        <Rule id="Service_Squid_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - squid - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the squid service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need for a proxy server, it is recommended that the squid proxy be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.13</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09939</ident>
          <fixtext xml:lang="en" fixref="F-Service_Squid_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable squid:
            # chkconfig squid off</fixtext>
          <fix id="F-Service_Squid_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var201" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var201" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8079" />
          </check>
        </Rule>
        <Rule id="Service_Squid_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - squid - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the squid service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">If there is no need for a proxy server, it is recommended that the squid proxy be deleted to reduce the potential attack surface.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.13</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09939</ident>
          <fixtext xml:lang="en" fixref="F-Service_Squid_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable squid:
            # chkconfig squid off</fixtext>
          <fix id="F-Service_Squid_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var202" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var202" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:8079" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.14DisableSNMPServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.14 Disable SNMP Server</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var203" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var203" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var204" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var204" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var205" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var205" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var206" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var206" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Snmpd_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - snmpd - running state - runlevel 2</title>
          <description xml:lang="en">This check will test whether the snmpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">The SNMP server communicates using SNMP v1, which transmits data in the clear and does not require authentication to execute commands. 
            Unless absolutely necessary, it is recommended that the SNMP service not be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.14</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07477</ident>
          <fixtext xml:lang="en" fixref="F-Service_Snmpd_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable snmpd:
            # chkconfig snmpd off</fixtext>
          <fix id="F-Service_Snmpd_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var203" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var203" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030150" />
          </check>
        </Rule>
        <Rule id="Service_Snmpd_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - snmpd - running state - runlevel 3</title>
          <description xml:lang="en">This check will test whether the snmpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">The SNMP server communicates using SNMP v1, which transmits data in the clear and does not require authentication to execute commands. 
            Unless absolutely necessary, it is recommended that the SNMP service not be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.14</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07477</ident>
          <fixtext xml:lang="en" fixref="F-Service_Snmpd_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable snmpd:
            # chkconfig snmpd off</fixtext>
          <fix id="F-Service_Snmpd_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var204" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var204" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030150" />
          </check>
        </Rule>
        <Rule id="Service_Snmpd_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - snmpd - running state - runlevel 4</title>
          <description xml:lang="en">This check will test whether the snmpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">The SNMP server communicates using SNMP v1, which transmits data in the clear and does not require authentication to execute commands. 
            Unless absolutely necessary, it is recommended that the SNMP service not be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.14</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07477</ident>
          <fixtext xml:lang="en" fixref="F-Service_Snmpd_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable snmpd:
            # chkconfig snmpd off</fixtext>
          <fix id="F-Service_Snmpd_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var205" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var205" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030150" />
          </check>
        </Rule>
        <Rule id="Service_Snmpd_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - snmpd - running state - runlevel 5</title>
          <description xml:lang="en">This check will test whether the snmpd service is enabled or disabled at a specific runlevel.</description>
          <rationale xml:lang="en">The SNMP server communicates using SNMP v1, which transmits data in the clear and does not require authentication to execute commands. 
            Unless absolutely necessary, it is recommended that the SNMP service not be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.14</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07477</ident>
          <fixtext xml:lang="en" fixref="F-Service_Snmpd_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable snmpd:
            # chkconfig snmpd off</fixtext>
          <fix id="F-Service_Snmpd_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var206" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var206" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803030150" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_2.2.16DisableNISServer" xml:lang="en">
        <title xml:lang="en">CIS 2.2.16 Disable NIS Server</title>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var471" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var471" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var481" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var481" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var491" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var491" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var501" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var501" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">false</value>
        </Value>
        <Rule id="Service_Ypserv_RunningState_Runlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Service - ypserv - running state - runlevel 2</title>
          <description xml:lang="en">The ypserv service should be enabled or disabled as appropriate.</description>
          <rationale xml:lang="en">The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally been
            replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be disabled and other, more secure services be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.16</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01457</ident>
          <fixtext xml:lang="en" fixref="F-Service_Ypserv_RunningState_Runlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable ypserv:
            # chkconfig ypserv off</fixtext>
          <fix id="F-Service_Ypserv_RunningState_Runlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var471" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var471" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50016" />
          </check>
        </Rule>
        <Rule id="Service_Ypserv_RunningState_Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Service - ypserv - running state - runlevel 3</title>
          <description xml:lang="en">The ypserv service should be enabled or disabled as appropriate.</description>
          <rationale xml:lang="en">The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally been
            replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be disabled and other, more secure services be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.16</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01457</ident>
          <fixtext xml:lang="en" fixref="F-Service_Ypserv_RunningState_Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable ypserv:
            # chkconfig ypserv off</fixtext>
          <fix id="F-Service_Ypserv_RunningState_Runlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var481" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var481" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50016" />
          </check>
        </Rule>
        <Rule id="Service_Ypserv_RunningState_Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Service - ypserv - running state - runlevel 4</title>
          <description xml:lang="en">The ypserv service should be enabled or disabled as appropriate.</description>
          <rationale xml:lang="en">The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally been
            replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be disabled and other, more secure services be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.16</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01457</ident>
          <fixtext xml:lang="en" fixref="F-Service_Ypserv_RunningState_Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable ypserv:
            # chkconfig ypserv off</fixtext>
          <fix id="F-Service_Ypserv_RunningState_Runlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var491" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var491" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50016" />
          </check>
        </Rule>
        <Rule id="Service_Ypserv_RunningState_Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Service - ypserv - running state - runlevel 5</title>
          <description xml:lang="en">The ypserv service should be enabled or disabled as appropriate.</description>
          <rationale xml:lang="en">The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally been
            replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be disabled and other, more secure services be used.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.2.16</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01457</ident>
          <fixtext xml:lang="en" fixref="F-Service_Ypserv_RunningState_Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable ypserv:
            # chkconfig ypserv off</fixtext>
          <fix id="F-Service_Ypserv_RunningState_Runlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var501" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var501" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:50016" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_2.3ServiceClients" xml:lang="en">
      <title xml:lang="en">CIS 2.3 Service Clients</title>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">ypbind</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var1" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">rsh</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var2" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">talk</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">telnet</value>
      </Value>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">openldap-clients</value>
      </Value>
      <Rule id="RemoveNISClient" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure NIS Client is not installed</title>
        <description xml:lang="en">The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. 
          This rule ensures that, ypbind package is not installed on the system.</description>
        <rationale xml:lang="en">The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. 
          NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.3.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01458</ident>
        <fixtext xml:lang="en" fixref="F-_RemoveNISClient" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to uninstall ypbind:
          # yum remove ypbind</fixtext>
        <fix id="F-_RemoveNISClient" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
        </check>
      </Rule>
      <Rule id="RemoveRshClient" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure rsh client is not installed</title>
        <description xml:lang="en">The rsh package contains the client commands for the rsh services. This rule ensures that rsh package is not installed on the system.</description>
        <rationale xml:lang="en">These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to 
          prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the rsh package removes the clients for rsh, rcp and rlogin.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.3.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01480</ident>
        <fixtext xml:lang="en" fixref="F-RemoveRshClient" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to uninstall rsh:
          # yum remove rsh</fixtext>
        <fix id="F-RemoveRshClient" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var1" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
        </check>
      </Rule>
      <Rule id="RemoveTalkClient" xml:lang="en" selected="false">
        <title xml:lang="en">Remove talk client</title>
        <description xml:lang="en">The talk software makes it possible for users to send and receive messages across systems through a terminal session. 
          This rule ensures that talk package is not installed on a system.</description>
        <rationale xml:lang="en">The software presents a security risk as it uses unencrypted protocols for communication.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.3.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08746</ident>
        <fixtext xml:lang="en" fixref="F-RemoveTalkClient" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to uninstall talk:
          # yum remove talk</fixtext>
        <fix id="F-RemoveTalkClient" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var2" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
        </check>
      </Rule>
      <Rule id="RemoveTelnetClient" xml:lang="en" selected="false">
        <title xml:lang="en">Remove telnet client</title>
        <description xml:lang="en">The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an authorized user to steal credentials. 
          This rule ensures that telnet(client) package is not installed on the system.</description>
        <rationale xml:lang="en">The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. 
          The ssh package provides an encrypted session and stronger security and is included in most Linux distributions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.3.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01478</ident>
        <fixtext xml:lang="en" fixref="F-RemoveTelnetClient" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to uninstall telnet:
          # yum remove telnet</fixtext>
        <fix id="F-RemoveTelnetClient" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var3" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
        </check>
      </Rule>
      <Rule id="RemoveLDAPClient" xml:lang="en" selected="false">
        <title xml:lang="en">Remove LDAP client</title>
        <description xml:lang="en">OpenLDAP is a service that provides a method for looking up information from a central database. If the server will not need to act as an LDAP client, it
          is recommended that the software be disabled to reduce the potential attack surface. This rule ensures that the openldap-clients package is not installed on a system.</description>
        <rationale xml:lang="en">If the system will not need to act as an LDAP client, it is recommended that the software be removed to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">2.3.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09937</ident>
        <fixtext xml:lang="en" fixref="F-RemoveLDAPClient" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to uninstall openldap-clients:
          # yum remove openldap-clients</fixtext>
        <fix id="F-RemoveLDAPClient" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var4" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242776" />
        </check>
      </Rule>
    </Group>
  </Group>
  <Group id="CIS_3NetworkConfiguration" xml:lang="en">
    <title xml:lang="en">CIS 3 Network Configuration</title>
    <description xml:lang="en">This section provides guidance on for securing the network configuration of the system through kernel parameters, access list control, and firewall settings.</description>
    <Group id="CIS_3.1NetworkParameters_HostOnly" xml:lang="en">
      <title xml:lang="en">CIS 3.1 Network Parameters (Host Only)</title>
      <description xml:lang="en">The following network parameters are intended for use if the system is to act as a host only. A system is considered host only if the system has a single interface, or has multiple interfaces but will not be configured as a router.</description>
      <Value id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="Net.ipv4.ip_forwardShouldBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Rule id="DisableIPForwarding-Net.ipv4.ip_forward" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure IP forwarding is disabled</title>
        <description xml:lang="en">The net.ipv4.ip_forward flag is used to tell the system whether it can forward packets or not.</description>
        <rationale xml:lang="en">Setting the flag to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router.</rationale>
        <ident system="CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v2.0.1">3.1.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05148</ident>
        <fixtext xml:lang="en" fixref="F-DisableIPForwarding-Net.ipv4.ip_forward" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameter in the /etc/sysctl.conf file:
          net.ipv4.ip_forward = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.ip_forward=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableIPForwarding-Net.ipv4.ip_forward" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Net.ipv4.ip_forwardShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487813" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487561" />
        </check>
      </Rule>
      <Rule id="DisablePacketRedirectSending-Net.ipv4.conf.all.send_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure packet redirect sending is disabled - net.ipv4.conf.all.send_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.all.send_redirects</description>
        <rationale xml:lang="en">An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the
          attacker as opposed to a valid system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05148</ident>
        <fixtext xml:lang="en" fixref="F-DisablePacketRedirectSending-Net.ipv4.conf.all.send_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.send_redirects = 0
          net.ipv4.conf.default.send_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.send_redirects=0
          # sysctl -w net.ipv4.conf.default.send_redirects=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisablePacketRedirectSending-Net.ipv4.conf.all.send_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487659" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487556" />
        </check>
      </Rule>
      <Rule id="DisablePacketRedirectSending-Net.ipv4.conf.default.send_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure packet redirect sending is disabled - net.ipv4.conf.default.send_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.default.send_redirects</description>
        <rationale xml:lang="en">An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the
          attacker as opposed to a valid system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05148</ident>
        <fixtext xml:lang="en" fixref="F-DisablePacketRedirectSending-Net.ipv4.conf.default.send_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.send_redirects = 0
          net.ipv4.conf.default.send_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.send_redirects=0
          # sysctl -w net.ipv4.conf.default.send_redirects=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisablePacketRedirectSending-Net.ipv4.conf.default.send_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487664" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487660" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_3.2NetworkParameters_HostAndRouter" xml:lang="en">
      <title xml:lang="en">CIS 3.2 Network Parameters (Host and Router)</title>
      <description xml:lang="en">The following network parameters are intended for use on both host only and router systems. A system acts as a router if it has at least two interfaces and is configured to perform routing functions.</description>
      <Rule id="DisableSourceRoutedPacketsAccept-Net.ipv4.conf.all.accept_source_route" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure source routed packets are not accepted - net.ipv4.conf.all.accept_source_route</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.all.accept_source_route</description>
        <rationale xml:lang="en">Setting net.ipv4.conf.all.accept_source_route and net.ipv4.conf.default.accept_source_route to 0 disables the system from accepting source routed packets. 
          Assume this system was capable of routing packets to Internet routable addresses on one interface and private addresses on another interface. Assume that the private addresses 
          were not routable to the Internet routable addresses and vice versa. Under normal routing circumstances, an attacker from the Internet routable addresses could not use the system 
          as a way to reach the private address systems. If, however, source routed packets were allowed, they could be used to gain access to the private address systems as the route could 
          be specified, rather than rely on routing protocols that did not allow this routing.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05739</ident>
        <fixtext xml:lang="en" fixref="F-DisableSourceRoutedPacketsAccept-Net.ipv4.conf.all.accept_source_route" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.accept_source_route = 0
          net.ipv4.conf.default.accept_source_route = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.accept_source_route=0
          # sysctl -w net.ipv4.conf.default.accept_source_route=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableSourceRoutedPacketsAccept-Net.ipv4.conf.all.accept_source_route" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487669" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487665" />
        </check>
      </Rule>
      <Rule id="DisableSourceRoutedPacketsAccept-Net.ipv4.conf.default.accept_source_route" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure source routed packets are not accepted - net.ipv4.conf.default.accept_source_route</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.default.accept_source_route</description>
        <rationale xml:lang="en">Setting net.ipv4.conf.all.accept_source_route and net.ipv4.conf.default.accept_source_route to 0 disables the system from accepting source routed packets. 
          Assume this system was capable of routing packets to Internet routable addresses on one interface and private addresses on another interface. Assume that the private addresses 
          were not routable to the Internet routable addresses and vice versa. Under normal routing circumstances, an attacker from the Internet routable addresses could not use the system 
          as a way to reach the private address systems. If, however, source routed packets were allowed, they could be used to gain access to the private address systems as the route could 
          be specified, rather than rely on routing protocols that did not allow this routing.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05739</ident>
        <fixtext xml:lang="en" fixref="F-DisableSourceRoutedPacketsAccept-Net.ipv4.conf.default.accept_source_route" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.accept_source_route = 0
          net.ipv4.conf.default.accept_source_route = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.accept_source_route=0
          # sysctl -w net.ipv4.conf.default.accept_source_route=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableSourceRoutedPacketsAccept-Net.ipv4.conf.default.accept_source_route" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487674" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487670" />
        </check>
      </Rule>
      <Rule id="DisableICMPRedirectsAccept-Net.ipv4.conf.all.accept_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure ICMP redirects are not accepted - net.ipv4.conf.all.accept_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.all.accept_redirects</description>
        <rationale xml:lang="en">Attackers could use bogus ICMP redirect messages to maliciously alter the system routing tables and get them to send packets to incorrect networks and allow your system packets to be captured.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05148</ident>
        <fixtext xml:lang="en" fixref="F-DisableICMPRedirectsAccept-Net.ipv4.conf.all.accept_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.accept_redirects = 0
          net.ipv4.conf.default.accept_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.accept_redirects=0
          # sysctl -w net.ipv4.conf.default.accept_redirects=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableICMPRedirectsAccept-Net.ipv4.conf.all.accept_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487679" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487675" />
        </check>
      </Rule>
      <Rule id="DisableICMPRedirectsAccept-Net.ipv4.conf.default.accept_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure ICMP redirects are not accepted - net.ipv4.conf.default.accept_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.default.accept_redirects</description>
        <rationale xml:lang="en">Attackers could use bogus ICMP redirect messages to maliciously alter the system routing tables and get them to send packets to incorrect networks and allow your system packets to be captured.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05148</ident>
        <fixtext xml:lang="en" fixref="F-DisableICMPRedirectsAccept-Net.ipv4.conf.default.accept_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.accept_redirects = 0
          net.ipv4.conf.default.accept_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.accept_redirects=0
          # sysctl -w net.ipv4.conf.default.accept_redirects=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableICMPRedirectsAccept-Net.ipv4.conf.default.accept_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487684" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487680" />
        </check>
      </Rule>
      <Rule id="DisableSecureICMPRedirectsAccept-Net.ipv4.conf.all.secure_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure secure ICMP redirects are not accepted - net.ipv4.conf.all.secure_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.all.secure_redirects</description>
        <rationale xml:lang="en">It is still possible for even known gateways to be compromised. Setting net.ipv4.conf.all.secure_redirects to 0 protects the system from routing table updates by possibly compromised known gateways.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09941</ident>
        <fixtext xml:lang="en" fixref="F-DisableSecureICMPRedirectsAccept-Net.ipv4.conf.all.secure_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.secure_redirects = 0
          net.ipv4.conf.default.secure_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.secure_redirects=0
          # sysctl -w net.ipv4.conf.default.secure_redirects=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableSecureICMPRedirectsAccept-Net.ipv4.conf.all.secure_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487689" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487685" />
        </check>
      </Rule>
      <Rule id="DisableSecureICMPRedirectsAccept-Net.ipv4.conf.default.secure_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure secure ICMP redirects are not accepted - net.ipv4.conf.default.secure_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.default.secure_redirects</description>
        <rationale xml:lang="en">It is still possible for even known gateways to be compromised. Setting net.ipv4.conf.all.secure_redirects to 0 protects the system from routing table updates by possibly compromised known gateways.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09941</ident>
        <fixtext xml:lang="en" fixref="F-DisableSecureICMPRedirectsAccept-Net.ipv4.conf.default.secure_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.secure_redirects = 0
          net.ipv4.conf.default.secure_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.secure_redirects=0
          # sysctl -w net.ipv4.conf.default.secure_redirects=0
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-DisableSecureICMPRedirectsAccept-Net.ipv4.conf.default.secure_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487694" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487690" />
        </check>
      </Rule>
      <Rule id="EnableSuspiciousPacketsLog-Net.ipv4.conf.all.log_martians" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure suspicious packets are logged - net.ipv4.conf.all.log_martians</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.all.log_martians</description>
        <rationale xml:lang="en">Enabling this feature and logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05601</ident>
        <fixtext xml:lang="en" fixref="F-EnableSuspiciousPacketsLog-Net.ipv4.conf.all.log_martians" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.log_martians = 1
          net.ipv4.conf.default.log_martians = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.log_martians=1
          # sysctl -w net.ipv4.conf.default.log_martians=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-EnableSuspiciousPacketsLog-Net.ipv4.conf.all.log_martians" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487699" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487695" />
        </check>
      </Rule>
      <Rule id="EnableSuspiciousPacketsLog-Net.ipv4.conf.default.log_martians" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure suspicious packets are logged - net.ipv4.conf.default.log_martians</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.default.log_martians</description>
        <rationale xml:lang="en">Enabling this feature and logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05601</ident>
        <fixtext xml:lang="en" fixref="F-EnableSuspiciousPacketsLog-Net.ipv4.conf.all.log_martians" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.log_martians = 1
          net.ipv4.conf.default.log_martians = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.log_martians=1
          # sysctl -w net.ipv4.conf.default.log_martians=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-EnableSuspiciousPacketsLog-Net.ipv4.conf.all.log_martians" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487704" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487700" />
        </check>
      </Rule>
      <Rule id="IgnoreBroadcastICMPRequests-Net.ipv4.icmp_echo_ignore_broadcasts" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure broadcast ICMP requests are ignored - net.ipv4.icmp_echo_ignore_broadcasts</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.icmp_echo_ignore_broadcasts</description>
        <rationale xml:lang="en">Accepting ICMP echo and timestamp requests with broadcast or multicast destinations for your network could be used to trick your host into starting (or participating) in a Smurf
          attack. A Smurf attack relies on an attacker sending large amounts of ICMP broadcast messages with a spoofed source address. All hosts receiving this message and responding
          would send echo-reply messages back to the spoofed address, which is probably not routable. If many hosts respond to the packets, the amount of traffic on the network could be significantly multiplied.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01795</ident>
        <fixtext xml:lang="en" fixref="F-IgnoreBroadcastICMPRequests-Net.ipv4.icmp_echo_ignore_broadcasts" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameter in the /etc/sysctl.conf file:
          net.ipv4.icmp_echo_ignore_broadcasts = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-IgnoreBroadcastICMPRequests-Net.ipv4.icmp_echo_ignore_broadcasts" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487709" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487705" />
        </check>
      </Rule>
      <Rule id="IgnoreBogusICMPResponses-Net.ipv4.icmp_ignore_bogus_error_responses" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure bogus ICMP responses are ignored - net.ipv4.icmp_ignore_bogus_error_responses</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.icmp_ignore_bogus_error_responses</description>
        <rationale xml:lang="en">Some routers (and some attackers) will send responses that violate RFC-1122 and attempt to fill up a log file system with many useless error messages.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09942</ident>
        <fixtext xml:lang="en" fixref="F-IgnoreBogusICMPResponses-Net.ipv4.icmp_ignore_bogus_error_responses" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameter in the /etc/sysctl.conf file:
          net.ipv4.icmp_ignore_bogus_error_responses = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-IgnoreBogusICMPResponses-Net.ipv4.icmp_ignore_bogus_error_responses" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487715" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487711" />
        </check>
      </Rule>
      <Rule id="EnableReversePathFiltering-Net.ipv4.conf.all.rp_filter" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure Reverse Path Filtering is enabled - net.ipv4.conf.all.rp_filter</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.all.rp_filter</description>
        <rationale xml:lang="en">Setting these flags is a good way to deter attackers from sending your system bogus packets that cannot be responded to. 
          One instance where this feature breaks down is if asymmetrical routing is employed. This would occur when using dynamic routing protocols (bgp, ospf, etc) 
          on your system. If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09943</ident>
        <fixtext xml:lang="en" fixref="F-EnableReversePathFiltering-Net.ipv4.conf.all.rp_filter" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.rp_filter = 1
          net.ipv4.conf.default.rp_filter = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.rp_filter=1
          # sysctl -w net.ipv4.conf.default.rp_filter=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-EnableReversePathFiltering-Net.ipv4.conf.all.rp_filter" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487720" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487716" />
        </check>
      </Rule>
      <Rule id="EnableReversePathFiltering-Net.ipv4.conf.default.rp_filter" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure Reverse Path Filtering is enabled - net.ipv4.conf.default.rp_filter</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.conf.default.rp_filter</description>
        <rationale xml:lang="en">Setting these flags is a good way to deter attackers from sending your system bogus packets that cannot be responded to. 
          One instance where this feature breaks down is if asymmetrical routing is employed. This would occur when using dynamic routing protocols (bgp, ospf, etc) 
          on your system. If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09943</ident>
        <fixtext xml:lang="en" fixref="F-EnableReversePathFiltering-Net.ipv4.conf.default.rp_filter" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv4.conf.all.rp_filter = 1
          net.ipv4.conf.default.rp_filter = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.conf.all.rp_filter=1
          # sysctl -w net.ipv4.conf.default.rp_filter=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-EnableReversePathFiltering-Net.ipv4.conf.default.rp_filter" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487725" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487721" />
        </check>
      </Rule>
      <Rule id="EnableTCPSYNCookies-Net.ipv4.tcp_syncookies" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure TCP SYN Cookies is enabled - net.ipv4.tcp_syncookies</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv4.tcp_syncookies</description>
        <rationale xml:lang="en">Attackers use SYN flood attacks to perform a denial of service attacked on a system by sending many SYN packets without completing the three way handshake. This will quickly
          use up slots in the kernel's half-open connection queue and prevent legitimate connections from succeeding. SYN cookies allow the system to keep accepting valid connections, even if under a denial of service attack.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.2.8</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01800</ident>
        <fixtext xml:lang="en" fixref="F-EnableTCPSYNCookies-Net.ipv4.tcp_syncookies" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameter in the /etc/sysctl.conf file:
          net.ipv4.tcp_syncookies = 1
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv4.tcp_syncookies=1
          # sysctl -w net.ipv4.route.flush=1</fixtext>
        <fix id="F-EnableTCPSYNCookies-Net.ipv4.tcp_syncookies" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv4_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:2487730" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487726" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_3.3IPv6" xml:lang="en">
      <title xml:lang="en">CIS 3.3 IPv6</title>
      <description xml:lang="en">IPv6 is a networking protocol that supersedes IPv4. It has more routable addresses and has built in security. If IPv6 is to be used, follow this section of the benchmark to configure IPv6, otherwise disable IPv6.</description>
      <Value id="Ipv6_ServicesShouldBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="Ipv6_ServicesShouldBeEnabledOrDisabled_var1" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Rule id="DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.all.accept_ra" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure IPv6 router advertisements are not accepted - net.ipv6.conf.all.accept_ra</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv6.conf.all.accept_ra</description>
        <rationale xml:lang="en">It is recommended that systems not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system
          (usually a single default route to a trusted router) protects the system from bad routes.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.3.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05732</ident>
        <fixtext xml:lang="en" fixref="F-DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.all.accept_ra" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv6.conf.all.accept_ra = 0
          net.ipv6.conf.default.accept_ra = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv6.conf.all.accept_ra=0
          # sysctl -w net.ipv6.conf.default.accept_ra=0
          # sysctl -w net.ipv6.route.flush=1</fixtext>
        <fix id="F-DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.all.accept_ra" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv6_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487735" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487731" />
        </check>
      </Rule>
      <Rule id="DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.default.accept_ra" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure IPv6 router advertisements are not accepted - net.ipv6.conf.default.accept_ra</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv6.conf.default.accept_ra</description>
        <rationale xml:lang="en">It is recommended that systems not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system
          (usually a single default route to a trusted router) protects the system from bad routes.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.3.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05732</ident>
        <fixtext xml:lang="en" fixref="F-DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.default.accept_ra" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv6.conf.all.accept_ra = 0
          net.ipv6.conf.default.accept_ra = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv6.conf.all.accept_ra=0
          # sysctl -w net.ipv6.conf.default.accept_ra=0
          # sysctl -w net.ipv6.route.flush=1</fixtext>
        <fix id="F-DisableIPv6RouterAdvertisementsAccept-Net.ipv6.conf.default.accept_ra" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv6_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487740" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487736" />
        </check>
      </Rule>
      <Rule id="DisableIPv6RedirectsAccept-Net.ipv6.conf.all.accept_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure IPv6 redirects are not accepted - net.ipv6.conf.all.accept_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv6.conf.all.accept_redirects</description>
        <rationale xml:lang="en">It is recommended that systems not accept ICMP redirects as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a
          single default route to a trusted router) protects the system from bad routes.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.3.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05149</ident>
        <fixtext xml:lang="en" fixref="F-DisableIPv6RedirectsAccept-Net.ipv6.conf.all.accept_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv6.conf.all.accept_redirects = 0
          net.ipv6.conf.default.accept_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv6.conf.all.accept_redirects=0
          # sysctl -w net.ipv6.conf.default.accept_redirects=0
          # sysctl -w net.ipv6.route.flush=1</fixtext>
        <fix id="F-DisableIPv6RedirectsAccept-Net.ipv6.conf.all.accept_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv6_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487745" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487741" />
        </check>
      </Rule>
      <Rule id="DisableIPv6RedirectsAccept-Net.ipv6.conf.default.accept_redirects" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure IPv6 redirects are not accepted - net.ipv6.conf.default.accept_redirects</title>
        <description xml:lang="en">This check will verify the enable / disable status for - net.ipv6.conf.default.accept_redirects</description>
        <rationale xml:lang="en">It is recommended that systems not accept ICMP redirects as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a
          single default route to a trusted router) protects the system from bad routes.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.3.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05149</ident>
        <fixtext xml:lang="en" fixref="F-DisableIPv6RedirectsAccept-Net.ipv6.conf.default.accept_redirects" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the following parameters in the /etc/sysctl.conf file:
          net.ipv6.conf.all.accept_redirects = 0
          net.ipv6.conf.default.accept_redirects = 0
          Run the following commands to set the active kernel parameters:
          # sysctl -w net.ipv6.conf.all.accept_redirects=0
          # sysctl -w net.ipv6.conf.default.accept_redirects=0
          # sysctl -w net.ipv6.route.flush=1</fixtext>
        <fix id="F-DisableIPv6RedirectsAccept-Net.ipv6.conf.default.accept_redirects" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv6_ServicesShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:2487750" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487746" />
        </check>
      </Rule>
      <Rule id="DisableIPv6" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure IPv6 is disabled</title>
        <description xml:lang="en">This check will verify the enable / disable status for - ipv6</description>
        <rationale xml:lang="en">If IPv6 is not to be used, it is recommended that it be disabled to reduce the attack surface of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.3.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01493</ident>
        <fixtext xml:lang="en" fixref="F-DisableIPv6-Net.ipv6.conf.all.disable_ipv6" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Create the file /etc/modprobe.d/CIS.conf and add the following line:
          options ipv6 disable=1</fixtext>
        <fix id="F-DisableIPv6-Net.ipv6.conf.all.disable_ipv6" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="Ipv6_ServicesShouldBeEnabledOrDisabled_var1" export-name="oval:com.mcafee.oval:var:435126" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412355" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_3.4TCPWrappers" xml:lang="en">
      <title xml:lang="en">CIS 3.4 TCP Wrappers</title>
      <description xml:lang="en">TCP Wrappers provides a simple access list and standardized logging method for services capable of supporting it. In the past, services that were called from inetd and xinetd supported the use of tcp wrappers</description>
      <Rule id="EnsureEtc_hosts.allowIsConfigured" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure /etc/hosts.allow is configured</title>
        <description xml:lang="en">This check verifies if the /etc/hosts.allow file exists on the system.</description>
        <rationale xml:lang="en">The /etc/hosts.allow file supports access control by IP and helps ensure that only authorized systems can connect to the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09944</ident>
        <fixtext xml:lang="en" fixref="F-EnsureEtc_hosts.allowIsConfigured" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Create /etc/hosts.allow: # echo "ALL:'net'/'mask', 'net'/'mask', …" &gt;/etc/hosts.allow
              where each 'net'/'mask' combination (for example, "192.168.1.0/255.255.255.0") represents one network block in use by your organization that requires access to this system. 
              Notes: Contents of the /etc/hosts.allow file will vary depending on your network configuration.</fixtext>
        <fix id="F-EnsureEtc_hosts.allowIsConfigured" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:231137" />
        </check>
      </Rule>
      <Rule id="EnsureEetc_hosts.denyIsConfigured" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure /etc/hosts.deny is configured</title>
        <description xml:lang="en">This check verifies if the /etc/hosts.deny file exists on a system.</description>
        <rationale xml:lang="en">The /etc/hosts.deny file serves as a failsafe so that any host not specified in /etc/hosts.allow is denied access to the server.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09924</ident>
        <fixtext xml:lang="en" fixref="F-EnsureEetc_hosts.denyIsConfigured" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Create /etc/hosts.deny: # echo "ALL: ALL" &gt;&gt; /etc/hosts.deny 
          Notes: Contents of the /etc/hosts.deny file may include additional options depending on your network configuration.</fixtext>
        <fix id="F-EnsureEetc_hosts.denyIsConfigured" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:231138" />
        </check>
      </Rule>
      <Group id="CIS_3.4.1InstallTCPWrappers" xml:lang="en">
        <title xml:lang="en">CIS 3.4.1 Install TCP Wrappers</title>
        <description xml:lang="en">TCP Wrappers provide a good simple access list mechanism to services that may not have that support built in. It is recommended that all services that can support TCP Wrappers, use it.</description>
        <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var21" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">tcp_wrappers</value>
        </Value>
        <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var22" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">tcp_wrappers-libs</value>
        </Value>
        <Rule id="TheSpecifiedRPMPackageShouldBeInstalled_tcpwrappers" xml:lang="en" selected="false">
          <title xml:lang="en">Test for the tcp_wrappers RPM package</title>
          <description xml:lang="en">This check is to ensure that the tcp_wrappers RPM package exist on the system.</description>
          <rationale xml:lang="en">TCP Wrappers provide a good simple access list mechanism to services that may not have that support built in. It is recommended that all services that can support TCP Wrappers, use it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01566</ident>
          <fixtext xml:lang="en" fixref="F-TheSpecifiedRPMPackageShouldBeInstalled_tcpwrappers" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># yum install tcp_wrappers
              To verify if a service supports TCP Wrappers, run the following command: # ldd 'path-to-daemon' | grep libwrap.so
              If there is any output, then the service supports TCP Wrappers.</fixtext>
          <fix id="F-TheSpecifiedRPMPackageShouldBeInstalled_tcpwrappers" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var21" export-name="oval:com.mcafee.oval:var:242779" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
          </check>
        </Rule>
        <Rule id="TheSpecifiedRPMPackageShouldBeInstalled_tcp_wrappers-libs" xml:lang="en" selected="false">
          <title xml:lang="en">Test for the tcp_wrappers-libs RPM package</title>
          <description xml:lang="en">This check is to ensure that the tcp_wrappers RPM package exist on the system.</description>
          <rationale xml:lang="en">TCP Wrappers provide a good simple access list mechanism to services that may not have that support built in. It is recommended that all services that can support TCP Wrappers, use it.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01566</ident>
          <fixtext xml:lang="en" fixref="F-TheSpecifiedRPMPackageShouldBeInstalled_tcp_wrappers-libs" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># yum install tcp_wrappers-libs</fixtext>
          <fix id="F-TheSpecifiedRPMPackageShouldBeInstalled_tcp_wrappers-libs" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var22" export-name="oval:com.mcafee.oval:var:242779" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_3.4.4VerifyPermissionsOn_Etc_hosts.allow" xml:lang="en">
        <title xml:lang="en">CIS 3.4.4 Verify Permissions on /etc/hosts.allow</title>
        <description xml:lang="en">The /etc/hosts.allow file contains networking information that is used by many applications and therefore must be readable for these applications to operate.</description>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var19" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var17" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var17" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestThePermissionsOfTheFile-etchosts.allow" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the file - /etc/hosts.allow</title>
          <description xml:lang="en">This check verifies if the permissions of the file - /etc/hosts.allow are set as per the user input.</description>
          <rationale xml:lang="en">It is critical to ensure that the /etc/hosts.allow file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05489</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-etchosts.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/hosts.allow:
              # chown root:root /etc/hosts.allow
              # chmod 644 /etc/hosts.allow</fixtext>
          <fix id="F-TestThePermissionsOfTheFile-etchosts.allow" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var19" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var19" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var19" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var19" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var19" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var19" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var19" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var19" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var19" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78708" />
          </check>
        </Rule>
        <Rule id="TestTheOwnerOfTheFile-etchosts.allow" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the file - /etc/hosts.allow</title>
          <description xml:lang="en">This check verifies if the owner of the file - /etc/hosts.allow is set as per the user input.</description>
          <rationale xml:lang="en">It is critical to ensure that the /etc/hosts.allow file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05489</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-etchosts.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/hosts.allow:
              # chown root:root /etc/hosts.allow
              # chmod 644 /etc/hosts.allow</fixtext>
          <fix id="F-TestTheOwnerOfTheFile-etchosts.allow" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var17" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78869" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheFile-_Etc_hosts.allow" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the file - /etc/hosts.allow</title>
          <description xml:lang="en">This check verifies if the group owner of the file -
              /etc/hosts.allow is set as per the user input.</description>
          <rationale xml:lang="en">It is critical to ensure that the /etc/hosts.allow file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05489</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_hosts.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/hosts.allow:
              # chown root:root /etc/hosts.allow
              # chmod 644 /etc/hosts.allow</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_hosts.allow" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var17" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78786" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_3.4.5VerifyPermissionsOn_Etc_hosts.deny" xml:lang="en">
        <title xml:lang="en">CIS 3.4.5 Verify Permissions on /etc/hosts.deny</title>
        <description xml:lang="en">The /etc/hosts.deny file contains network information that is used by many system applications and therefore must be readable for these applications to operate.</description>
        <Value id="ShouldOthersHaveWRITEAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var20" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var18" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var18" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestThePermissionsOfTheFile-_Etc_hosts.deny" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the file - /etc/hosts.deny</title>
          <description xml:lang="en">This check verifies if the permissions of the file -
              /etc/hosts.deny are set as per the user input.</description>
          <rationale xml:lang="en">It is critical to ensure that the /etc/hosts.deny file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09925</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_hosts.deny" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/hosts.deny:
              # chown root:root /etc/hosts.deny
              # chmod 644 /etc/hosts.deny</fixtext>
          <fix id="F-TestThePermissionsOfTheFile-_Etc_hosts.deny" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var20" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var20" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var20" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var20" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var20" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var20" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var20" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var20" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var20" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78707" />
          </check>
        </Rule>
        <Rule id="TestTheOwnerOfTheFile-_Etc_hosts.deny" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the file - /etc/hosts.deny</title>
          <description xml:lang="en">This check verifies if the owner of the file - /etc/hosts.deny is set as per the user input.</description>
          <rationale xml:lang="en">It is critical to ensure that the /etc/hosts.deny file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09925</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_hosts.deny" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/hosts.deny:
              # chown root:root /etc/hosts.deny
              # chmod 644 /etc/hosts.deny</fixtext>
          <fix id="F-TestTheOwnerOfTheFile-_Etc_hosts.deny" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var18" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78870" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheFile-_Etc_hosts.deny" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the file - /etc/hosts.deny</title>
          <description xml:lang="en">This check verifies if the group owner of the file -
              /etc/hosts.deny is set as per the user inputs.</description>
          <rationale xml:lang="en">It is critical to ensure that the /etc/hosts.deny file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.4.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09925</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_hosts.deny" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/hosts.deny:
              # chown root:root /etc/hosts.deny
              # chmod 644 /etc/hosts.deny</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_hosts.deny" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var18" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78787" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_3.5UncommonNetworkProtocols" xml:lang="en">
      <title xml:lang="en">CIS 3.5 Uncommon Network Protocols</title>
      <description xml:lang="en">The Linux kernel modules support several network protocols that are not commonly used. If these protocols are not needed, it is recommended that they be disabled in the kernel.</description>
      <Rule id="UncommonNetworkProtocols-DisableDCCP" xml:lang="en" selected="false">
        <title xml:lang="en">Uncommon Network Protocols - Disable DCCP</title>
        <description xml:lang="en">This check will verify that DCCP is disabled.</description>
        <rationale xml:lang="en">If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.5.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08781</ident>
        <fixtext xml:lang="en" fixref="F-UncommonNetworkProtocols-DisableDCCP" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># echo "install dccp /bin/true" &gt;&gt; /etc/modprobe.d/CIS.conf</fixtext>
        <fix id="F-UncommonNetworkProtocols-DisableDCCP" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402664" />
        </check>
      </Rule>
      <Rule id="UncommonNetworkProtocols-DisableSCTP" xml:lang="en" selected="false">
        <title xml:lang="en">Uncommon Network Protocols - Disable SCTP</title>
        <description xml:lang="en">This check will verify that SCTP is disabled.</description>
        <rationale xml:lang="en">If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.5.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08782</ident>
        <fixtext xml:lang="en" fixref="F-UncommonNetworkProtocols-DisableSCTP" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># echo "install sctp /bin/true" &gt;&gt; /etc/modprobe.d/CIS.conf</fixtext>
        <fix id="F-UncommonNetworkProtocols-DisableSCTP" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402665" />
        </check>
      </Rule>
      <Rule id="UncommonNetworkProtocols-DisableRDS" xml:lang="en" selected="false">
        <title xml:lang="en">Uncommon Network Protocols - Disable RDS</title>
        <description xml:lang="en">This check will verify that RDS is disabled.</description>
        <rationale xml:lang="en">If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.5.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08783</ident>
        <fixtext xml:lang="en" fixref="F-UncommonNetworkProtocols-DisableRDS" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># echo "install rds /bin/true" &gt;&gt; /etc/modprobe.d/CIS.conf</fixtext>
        <fix id="F-UncommonNetworkProtocols-DisableRDS" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402666" />
        </check>
      </Rule>
      <Rule id="UncommonNetworkProtocols-DisableTIPC" xml:lang="en" selected="false">
        <title xml:lang="en">Uncommon Network Protocols - Disable TIPC</title>
        <description xml:lang="en">This check will verify that TIPC is disabled.</description>
        <rationale xml:lang="en">If the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.5.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08784</ident>
        <fixtext xml:lang="en" fixref="F-UncommonNetworkProtocols-DisableTIPC" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># echo "install tipc /bin/true" &gt;&gt; /etc/modprobe.d/CIS.conf</fixtext>
        <fix id="F-UncommonNetworkProtocols-DisableTIPC" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402667" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_3.6FirewallConfiguration" xml:lang="en">
      <title xml:lang="en">CIS 3.6 Firewall Configuration</title>
      <description xml:lang="en">IPtables is an application that allows a system administrator to configure the IPv4 tables, chains and rules provided by the Linux kernel firewall. While several methods of
        configuration exist this section is intended only to ensure the resulting IPtables rules are in place, not how they are configured. If IPv6 is in use in your environment, similar settings should be applied to the IP6tables as well.</description>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerifiedIptables_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">iptables</value>
      </Value>
      <Value id="NameTheWirelessNetworkInterface_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">ifcfg-wlan0</value>
      </Value>
      <Rule id="InstallIPtables" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure iptables is installed</title>
        <description xml:lang="en">This check will verify that Iptables package is istalled.</description>
        <rationale xml:lang="en">iptables is required for firewall management and configuration.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.6.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04948</ident>
        <fixtext xml:lang="en" fixref="F-InstallIPtables" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to install iptables:
          # yum install iptables</fixtext>
        <fix id="F-InstallIPtables" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerifiedIptables_var" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
        </check>
      </Rule>
      <Group id="CIS_3.6.3ConfigureLoopbackInterfaceTraffic" xml:lang="en">
        <title xml:lang="en">CIS 3.6.3 Configure Loopback Interface Traffic</title>
        <Rule id="ConfigureLoopbackInterfaceTraffic-INPUT" xml:lang="en" selected="false">
          <title xml:lang="en">Configure the loopback interface traffic - INPUT</title>
          <description xml:lang="en">This check will verify that Iptables loopback interface is set to accept traffic and all other interfaces to deny traffic to the loopback network (127.0.0.0/8).</description>
          <rationale xml:lang="en">Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network
            (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
          </rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.6.3</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureLoopbackInterfaceTraffic-INPUT" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to implement the loopback rules:
            # iptables -A INPUT -i lo -j ACCEPT
            # iptables -A OUTPUT -o lo -j ACCEPT
            # iptables -A INPUT -s 127.0.0.0/8 -j DROP</fixtext>
          <fix id="F-ConfigureLoopbackInterfaceTraffic-INPUT" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412380" />
          </check>
        </Rule>
        <Rule id="ConfigureLoopbackInterfaceTraffic-DROP" xml:lang="en" selected="false">
          <title xml:lang="en">Configure the loopback interface traffic - DROP</title>
          <description xml:lang="en">This check will verify that Iptables loopback interface is set to accept traffic and all other interfaces to deny traffic to the loopback network (127.0.0.0/8).</description>
          <rationale xml:lang="en">Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network
            (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
          </rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.6.3</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureLoopbackInterfaceTraffic-DROP" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to implement the loopback rules:
            # iptables -A INPUT -i lo -j ACCEPT
            # iptables -A OUTPUT -o lo -j ACCEPT
            # iptables -A INPUT -s 127.0.0.0/8 -j DROP</fixtext>
          <fix id="F-ConfigureLoopbackInterfaceTraffic-DROP" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412381" />
          </check>
        </Rule>
        <Rule id="ConfigureLoopbackInterfaceTraffic-OUTPUT" xml:lang="en" selected="false">
          <title xml:lang="en">Configure the loopback interface traffic - OUTPUT</title>
          <description xml:lang="en">This check will verify that Iptables loopback interface is set to accept traffic and all other interfaces to deny traffic to the loopback network (127.0.0.0/8).</description>
          <rationale xml:lang="en">Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network
            (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
          </rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.6.3</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureLoopbackInterfaceTraffic-OUTPUT" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to implement the loopback rules:
            # iptables -A INPUT -i lo -j ACCEPT
            # iptables -A OUTPUT -o lo -j ACCEPT
            # iptables -A INPUT -s 127.0.0.0/8 -j DROP</fixtext>
          <fix id="F-ConfigureLoopbackInterfaceTraffic-OUTPUT" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412382" />
          </check>
        </Rule>
      </Group>
      <Rule id="WirelessNetworkInterfacesShouldBeDisabled" xml:lang="en" selected="false">
        <title xml:lang="en">Wireless Network Interfaces should be disabled</title>
        <description xml:lang="en">This check will verify that Wireless Network Interfaces is disabled.</description>
        <rationale xml:lang="en">If wireless is not to be used, wireless devices can be disabled to reduce the potential attack surface.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">3.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05755</ident>
        <fixtext xml:lang="en" fixref="F-WirelessNetworkInterfacesShouldBeDisabled" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to disable any wireless interfaces:
          # ip link set &lt;interface&gt; down
            Disable any wireless interfaces in your network configuration.</fixtext>
        <fix id="F-WirelessNetworkInterfacesShouldBeDisabled" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="NameTheWirelessNetworkInterface_var" export-name="oval:com.mcafee.oval:var:843851" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:634949" />
        </check>
      </Rule>
    </Group>
  </Group>
  <Group id="CIS_4LoggingAndAuditing" xml:lang="en">
    <title xml:lang="en">CIS 4 Logging and Auditing</title>
    <description xml:lang="en">The items in this section describe how to configure logging, log monitoring, and auditing, using tools included in most distributions.</description>
    <Group id="CIS_4.1ConfigureSystemAccounting_Auditd" xml:lang="en">
      <title xml:lang="en">CIS 4.1 Configure System Accounting (auditd)</title>
      <description xml:lang="en">System auditing, through auditd, allows system administrators to monitor their systems such that they can detect unauthorized access or modification of data.</description>
      <Rule id="EnableAuditingForProcessesThatStartPriorToAuditd" xml:lang="en" selected="false">
        <title xml:lang="en">Enable Auditing for Processes That Start Prior to auditd</title>
        <description xml:lang="en">This check verifies if the argument audit=1 appears on each kernel line in /boot/grub/grub.conf file to ensure that the audit events need to be captured on processes that start up prior to auditd.</description>
        <rationale xml:lang="en">Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go undetected.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09947</ident>
        <fixtext xml:lang="en" fixref="F-EnableAuditingForProcessesThatStartPriorToAuditd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit /boot/grub/grub.conf to include audit=1 on all kernel lines.
        Notes: This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.</fixtext>
        <fix id="F-EnableAuditingForProcessesThatStartPriorToAuditd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249879" />
        </check>
      </Rule>
      <Rule id="RecordEventsThatModifyDateAndTimeInformation" xml:lang="en" selected="false">
        <title xml:lang="en">Record Events That Modify Date and Time Information</title>
        <description xml:lang="en">This check verifies for the time-change parameter in /etc/audit/audit.rules file to determine if events where the system date and/or time has been modified are captured.</description>
        <rationale xml:lang="en">Unexpected changes in system date and/or time could be a sign of malicious activity on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08750</ident>
        <fixtext xml:lang="en" fixref="F-RecordEventsThatModifyDateAndTimeInformation" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For 64 bit systems, add the following lines to the /etc/audit/audit.rules file. -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change -a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change -a always,exit -F arch=b64 -S clock_settime -k time-change -a always,exit -F arch=b32 -S clock_settime -k time-change -w /etc/localtime -p wa -k time-change # Execute the following command to restart auditd # pkill -P 1-HUP auditd
        For 32 bit systems, add the following lines to the /etc/audit/audit.rules file. -a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change -a always,exit -F arch=b32 -S clock_settime -k time-change -w /etc/localtime -p wa -k time-change # Execute the following command to restart auditd # pkill -P 1-HUP auditd</fixtext>
        <fix id="F-RecordEventsThatModifyDateAndTimeInformation" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402478" />
        </check>
      </Rule>
      <Rule id="RecordEventsThatModifyUser_GroupInformation" xml:lang="en" selected="false">
        <title xml:lang="en">Record Events That Modify User/Group Information</title>
        <description xml:lang="en">This check verifies if the /etc/audit/audit.rules file is set with appropriate identity identifier to determine if events that modify user/group information are recorded.</description>
        <rationale xml:lang="en">Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08751</ident>
        <fixtext xml:lang="en" fixref="F-RecordEventsThatModifyUser_GroupInformation" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following lines to the /etc/audit/audit.rules file. -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity # Execute the following command to restart auditd # pkill -P 1-HUP auditd</fixtext>
        <fix id="F-RecordEventsThatModifyUser_GroupInformation" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249962" />
        </check>
      </Rule>
      <Rule id="RecordEventsThatModifyTheSystem_sNetworkEnvironment" xml:lang="en" selected="false">
        <title xml:lang="en">Record Events That Modify the System's Network Environment</title>
        <description xml:lang="en">This check verifies for the system-locale parameter in /etc/audit/audit.rules file to determine if events that modify the system's environment are recorded.</description>
        <rationale xml:lang="en">Monitoring sethostname and setdomainname will identify potential unauthorized changes to host and domainname of a system. The changing of these names could 
        potentially break security parameters that are set based on those names. The /etc/hosts file is monitored for changes in the file that can indicate an unauthorized intruder is trying to change machine 
        associations with IP addresses and trick users and processes into connecting to unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as intruders could put disinformation into 
        those files and trick users into providing information to the intruder. Monitoring /etc/sysconfig/network is important as it can show if network interfaces or scripts are being modified in a way that can lead 
        to the machine becoming unavailable or compromised. All audit records will be tagged with the identifier "system-locale."</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08752</ident>
        <fixtext xml:lang="en" fixref="F-RecordEventsThatModifyTheSystem_sNetworkEnvironment" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For 64 bit systems, add the following lines to the /etc/audit/audit.rules file. -a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale -a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale -w /etc/issue -p wa -k system-locale -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale -w /etc/sysconfig/network -p wa -k system-locale # Execute the following command to restart auditd # pkill -P 1-HUP auditd
        For 32 bit systems, add the following lines to the /etc/audit/audit.rules file. -a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale -w /etc/issue -p wa -k system-locale -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale -w /etc/sysconfig/network -p wa -k system-locale # Execute the following command to restart auditd # pkill -P 1-HUP auditd</fixtext>
        <fix id="F-RecordEventsThatModifyTheSystem_sNetworkEnvironment" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402512" />
        </check>
      </Rule>
      <Rule id="RecordEventsThatModifyTheSystem_sMandatoryAccessControls" xml:lang="en" selected="false">
        <title xml:lang="en">Record Events That Modify the System's Mandatory Access Controls</title>
        <description xml:lang="en">This check verifies if the MAC-policy is set appropriately in /etc/audit/audit.rules file to record the events that modify the system's mandatory access controls (i.e. any write access or attribute changes to the /etc/selinux directory).</description>
        <rationale xml:lang="en">Changes to files in this directory could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08753</ident>
        <fixtext xml:lang="en" fixref="F-RecordEventsThatModifyTheSystem_sMandatoryAccessControls" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/audit/audit.rules file:
        -w /etc/selinux/ -p wa -k MAC-policy</fixtext>
        <fix id="F-RecordEventsThatModifyTheSystem_sMandatoryAccessControls" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249973" />
        </check>
      </Rule>
      <Rule id="CollectLoginAndLogoutEvents" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Login and Logout Events</title>
        <description xml:lang="en">This check verifies if the /etc/audit/audit.rules file is set with appropriate logins identifier to determine if login and logout events are recorded.</description>
        <rationale xml:lang="en">Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.8</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01915</ident>
        <fixtext xml:lang="en" fixref="F-CollectLoginAndLogoutEvents" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following lines to the /etc/audit/audit.rules file:
        -w /var/log/lastlog -p wa -k logins
        -w /var/run/faillock/ -p wa -k logins</fixtext>
        <fix id="F-CollectLoginAndLogoutEvents" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487929" />
        </check>
      </Rule>
      <Rule id="CollectSessionInitiationInformation" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Session Initiation Information</title>
        <description xml:lang="en">Monitor session initiation events. The parameters in this section track changes to the files associated with session events. The file /var/run/utmp file tracks all currently logged in users. 
        The /var/log/wtmp file tracks logins, logouts, shutdown and reboot events. All audit records will be tagged with the identifier "session."</description>
        <rationale xml:lang="en">Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.9</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09948</ident>
        <fixtext xml:lang="en" fixref="F-CollectSessionInitiationInformation" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following lines to the /etc/audit/audit.rules file. -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k session -w /var/log/btmp -p wa -k session # Execute the following command to restart auditd # pkill -HUP -P 1 auditd
        Note: Use the last command to read /var/log/wtmp (last with no parameters) and /var/run/utmp (last -f /var/run/utmp)</fixtext>
        <fix id="F-CollectSessionInitiationInformation" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249983" />
        </check>
      </Rule>
      <Rule id="CollectDiscretionaryAccessControlPermissionModificationEvents" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Discretionary Access Control Permission Modification Events</title>
        <description xml:lang="en">This check is to determine if permission modifications are being recorded files in /etc/audit/audit.rules file.</description>
        <rationale xml:lang="en">Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.10</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09949</ident>
        <fixtext xml:lang="en" fixref="F-CollectDiscretionaryAccessControlPermissionModificationEvents" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For 64 bit systems, add the following lines to the /etc/audit/audit.rules file. 
        -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid&gt;=500 \ -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid&gt;=500 \ -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=500 \ -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=500 \ -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S \ lremovexattr -S fremovexattr -F auid&gt;=500 -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S \ lremovexattr -S fremovexattr -F auid&gt;=500 -F auid!=4294967295 -k perm_mod 
        # Execute the following command to restart auditd # pkill -HUP -P 1 auditd
        For 32 bit systems, add the following lines to the /etc/audit/audit.rules file. 
        -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid&gt;=500 \ -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=500 \ -F auid!=4294967295 -k perm_mod 
        -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S \ lremovexattr -S fremovexattr -F auid&gt;=500 -F auid!=4294967295 -k perm_mod
        # Execute the following command to restart auditd # pkill -HUP -P 1 auditd</fixtext>
        <fix id="F-CollectDiscretionaryAccessControlPermissionModificationEvents" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:403369" />
        </check>
      </Rule>
      <Rule id="CollectUnsuccessfulUnauthorizedAccessAttemptsToFiles" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Unsuccessful Unauthorized Access Attempts to Files</title>
        <description xml:lang="en">This check is to determine if there are unsuccessful attempts to access files in /etc/audit/audit.rules file.</description>
        <rationale xml:lang="en">Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08757</ident>
        <fixtext xml:lang="en" fixref="F-CollectUnsuccessfulUnauthorizedAccessAttemptsToFiles" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For 64 bit systems, add the following lines to the /etc/audit/audit.rules file. 
        -a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate \ -F exit=-EACCES -F auid&gt;=500 -F auid!=4294967295 -k access 
        -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate \ -F exit=-EACCES -F auid&gt;=500 -F auid!=4294967295 -k access 
        -a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate \ -F exit=-EPERM -F auid&gt;=500 -F auid!=4294967295 -k access 
        -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate \ -F exit=-EPERM -F auid&gt;=500 -F auid!=4294967295 -k access 
        # Execute the following command to restart auditd # pkill -HUP -P 1 auditd
        For 32 bit systems, add the following lines to the /etc/audit/audit.rules file. 
        -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate \ -F exit=-EACCES -F auid&gt;=500 -F auid!=4294967295 -k access 
        -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate \ -F exit=-EPERM -F auid&gt;=500 -F auid!=4294967295 -k access</fixtext>
        <fix id="F-CollectUnsuccessfulUnauthorizedAccessAttemptsToFiles" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:403368" />
        </check>
      </Rule>
      <Rule id="CollectSuccessfulFileSystemMounts" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Successful File System Mounts</title>
        <description xml:lang="en">This check verifies for the mounts parameter in /etc/audit/audit.rules file to determine if filesystem mounts are recorded when the mount system call is used by a non-privileged user.</description>
        <rationale xml:lang="en">It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted 
        (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, 
        would also have to track successful open, creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way 
        to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to 
        media is beyond the scope of this document.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.13</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09923</ident>
        <fixtext xml:lang="en" fixref="F-CollectSuccessfulFileSystemMounts" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For 32 bit systems add the following lines to the /etc/audit/audit.rules file:
        -a always,exit -F arch=b32 -S mount -F auid&gt;=500 -F auid!=4294967295 -k mounts
        For 64 bit systems add the following lines to the /etc/audit/audit.rules file:
        -a always,exit -F arch=b64 -S mount -F auid&gt;=500 -F auid!=4294967295 -k mounts
        -a always,exit -F arch=b32 -S mount -F auid&gt;=500 -F auid!=4294967295 -k mounts</fixtext>
        <fix id="F-CollectSuccessfulFileSystemMounts" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:402530" />
        </check>
      </Rule>
      <Rule id="CollectFileDeletionEventsByUser" xml:lang="en" selected="false">
        <title xml:lang="en">Collect File Deletion Events by User</title>
        <description xml:lang="en">This check is to determine if file deletion events by user are recorded in /etc/audit/audit.rules file.</description>
        <rationale xml:lang="en">Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.14</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08760</ident>
        <fixtext xml:lang="en" fixref="F-CollectFileDeletionEventsByUser" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">At a minimum, configure the audit system to collect file deletion events for all users and root.
        For 64 bit systems, add the following to the /etc/audit/audit.rules file. -a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid&gt;=500 \ -F auid!=4294967295 -k delete 
        -a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid&gt;=500 \ -F auid!=4294967295 -k delete 
        For 32 bit systems, add the following to the /etc/audit/audit.rules file. 
        -a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid&gt;=500 \ -F auid!=4294967295 -k delete Notes:
        At a minimum, configure the audit system to collect file deletion events for all users and root.</fixtext>
        <fix id="F-CollectFileDeletionEventsByUser" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:403363" />
        </check>
      </Rule>
      <Rule id="CollectChangesToSystemAdministrationScope" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Changes to System Administration Scope (sudoers)</title>
        <description xml:lang="en">Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, 
        it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier "scope."</description>
        <rationale xml:lang="en">Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.15</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09950</ident>
        <fixtext xml:lang="en" fixref="F-CollectChangesToSystemAdministrationScope" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/audit/audit.rules file:
        -w /etc/sudoers -p wa -k scope
        -w /etc/sudoers.d -p wa -k scope</fixtext>
        <fix id="F-CollectChangesToSystemAdministrationScope" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249902" />
        </check>
      </Rule>
      <Rule id="CollectChangesToSystemAdministrationScope-Sudoers.d" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Changes to System Administration Scope (sudoers.d)</title>
        <description xml:lang="en">Monitor scope changes for system administrations. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, 
        it is possible to monitor changes in scope. The file /etc/sudoers will be written to when the file or its attributes have changed. The audit records will be tagged with the identifier "scope."</description>
        <rationale xml:lang="en">Changes in the /etc/sudoers file can indicate that an unauthorized change has been made to scope of system administrator activity.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.15</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09950</ident>
        <fixtext xml:lang="en" fixref="F-CollectChangesToSystemAdministrationScope-Sudoers.d" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/audit/audit.rules file:
        -w /etc/sudoers -p wa -k scope
        -w /etc/sudoers.d -p wa -k scope</fixtext>
        <fix id="F-CollectChangesToSystemAdministrationScope-Sudoers.d" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412356" />
        </check>
      </Rule>
      <Rule id="CollectSystemAdministratorActions_Sudolog" xml:lang="en" selected="false">
        <title xml:lang="en">Collect System Administrator Actions (sudolog)</title>
        <description xml:lang="en">This check verifies if the /etc/audit/audit.rules file is set with appropriate actions parameter to ensure that any unauthorized commands that have been executed gets recorded under sudo log file.</description>
        <rationale xml:lang="en">Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to /var/log/sudo.log to verify if unauthorized commands have been executed.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.16</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 00645</ident>
        <fixtext xml:lang="en" fixref="F-CollectSystemAdministratorActions_Sudolog" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following lines to the /etc/audit/audit.rules file. -w /var/log/sudo.log -p wa -k actions 
        Note: The system must be configured with su disabled (See Item 5.6 Ensure access to the su command is restricted) to force all command execution through sudo. This will not be effective on the console, as administrators can log in as root.</fixtext>
        <fix id="F-CollectSystemAdministratorActions_Sudolog" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249889" />
        </check>
      </Rule>
      <Rule id="CollectKernelModuleLoadingAndUnloading" xml:lang="en" selected="false">
        <title xml:lang="en">Collect Kernel Module Loading and Unloading</title>
        <description xml:lang="en">This check is to determine if kernel module loading and unloading is recorded.</description>
        <rationale xml:lang="en">Monitoring the use of insmod, rmmod and modprobe could provide system administrators with evidence that an unauthorized user loaded or unloaded a kernel module, possibly compromising the security of the system. 
        Monitoring of the init_module and delete_module system calls would reflect an unauthorized user attempting to use a different program to load and unload modules.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.17</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08762</ident>
        <fixtext xml:lang="en" fixref="F-CollectKernelModuleLoadingAndUnloading" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">For 32 bit systems add the following lines to the /etc/audit/audit.rules file:
        -w /sbin/insmod -p x -k modules
        -w /sbin/rmmod -p x -k modules
        -w /sbin/modprobe -p x -k modules
        -a always,exit -F arch=b32 -S init_module -S delete_module -k modules
        For 64 bit systems add the following lines to the /etc/audit/audit.rules file:
        -w /sbin/insmod -p x -k modules
        -w /sbin/rmmod -p x -k modules
        -w /sbin/modprobe -p x -k modules
        -a always,exit -F arch=b64 -S init_module -S delete_module -k modules</fixtext>
        <fix id="F-CollectKernelModuleLoadingAndUnloading" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:403352" />
        </check>
      </Rule>
      <Rule id="MakeTheAuditConfigurationImmutable" xml:lang="en" selected="false">
        <title xml:lang="en">Make the Audit Configuration Immutable</title>
        <description xml:lang="en">This check verifies if the -e flag is set with value 2 in /etc/audit/audit.rules file to ensure the audit is put in immutable mode.</description>
        <rationale xml:lang="en">In immutable mode, unauthorized users cannot execute changes to the audit system to potential hide malicious activity and then put the audit rules back. Users would most likely notice a system reboot and that could alert administrators of an attempt to make unauthorized audit changes.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.18</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08763</ident>
        <fixtext xml:lang="en" fixref="F-MakeTheAuditConfigurationImmutable" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the end of the/etc/audit/audit.rules file. 
        -e 2</fixtext>
        <fix id="F-MakeTheAuditConfigurationImmutable" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:249886" />
        </check>
      </Rule>
      <Group id="CIS_4.1.1ConfigureDataRetention" xml:lang="en">
        <title xml:lang="en">CIS 4.1.1 Configure Data Retention</title>
        <description xml:lang="en">When auditing, it is important to carefully configure the storage requirements for audit logs.  While the recommendations here provide guidance, 
        check your site policy for audit storage requirements.</description>
        <Value id="EnterTheValueForMaximumSizeOfTheAuditLogFile-Max_log_file_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">20</value>
        </Value>
        <Value id="EnterTheValueToCheckWhetherAuditLogsAreRetained-Space_left_actionParameter_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">email</value>
        </Value>
        <Value id="EnterTheValidEmailAddressOrAliasForAction_mail_acct_defaultAddressIsRoot__var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">root</value>
        </Value>
        <Value id="EnterTheValueThatTellsTheSystemWhatActionToTakeWhenItIsLowOnDiskSpace-Admin_space_left_action_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">halt</value>
        </Value>
        <Value id="EnterTheValueToCheckWhetherAuditLogsAreRetained-Max_log_file_action_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">KEEP_LOGS</value>
        </Value>
        <Rule id="ConfigureAuditLogStorageSize" xml:lang="en" selected="false">
          <title xml:lang="en">Configure Audit Log Storage Size</title>
          <description xml:lang="en">This check verifies if the maximum size of the audit log file is set as per the user input value in /etc/audit/auditd.conf file for the max_log_file parameter.</description>
          <rationale xml:lang="en">It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01963</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureAuditLogStorageSize" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the max_log_file parameter in /etc/audit/auditd.conf max_log_file = 'MB'
          Note: MB is the number of MegaBytes the file can be.</fixtext>
          <fix id="F-ConfigureAuditLogStorageSize" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheValueForMaximumSizeOfTheAuditLogFile-Max_log_file_var" export-name="oval:com.mcafee.oval:var:249634" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:249628" />
          </check>
        </Rule>
        <Rule id="DisableSystemOnAuditLogFull" xml:lang="en" selected="false">
          <title xml:lang="en">Disable System on Audit Log Full</title>
          <description xml:lang="en">This check is to determine if auditd is configured to notify the administrator and halt the system when audit logs are full by verifying the space_left_action, action_mail_acct and admin_space_left_action in the /etc/audit/auditd.conf file.</description>
          <rationale xml:lang="en">In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09945</ident>
          <fixtext xml:lang="en" fixref="F-DisableSystemOnAuditLogFull" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following lines to the /etc/audit/auditd.conf file. space_left_action = email action_mail_acct = root admin_space_left_action = halt</fixtext>
          <fix id="F-DisableSystemOnAuditLogFull" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheValueToCheckWhetherAuditLogsAreRetained-Space_left_actionParameter_var" export-name="oval:com.mcafee.oval:var:403345" />
            <check-export value-id="EnterTheValidEmailAddressOrAliasForAction_mail_acct_defaultAddressIsRoot__var" export-name="oval:com.mcafee.oval:var:403346" />
            <check-export value-id="EnterTheValueThatTellsTheSystemWhatActionToTakeWhenItIsLowOnDiskSpace-Admin_space_left_action_var" export-name="oval:com.mcafee.oval:var:403347" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:403335" />
          </check>
        </Rule>
        <Rule id="KeepAllAuditingInformation" xml:lang="en" selected="false">
          <title xml:lang="en">Keep All Auditing Information</title>
          <description xml:lang="en">This check verifies if audit logs are retained as per the user input value in /etc/audit/auditd.conf file for the max_log_file_action parameter.</description>
          <rationale xml:lang="en">In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09946</ident>
          <fixtext xml:lang="en" fixref="F-KeepAllAuditingInformation" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/audit/auditd.conf file. max_log_file_action = keep_logs</fixtext>
          <fix id="F-KeepAllAuditingInformation" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="EnterTheValueToCheckWhetherAuditLogsAreRetained-Max_log_file_action_var" export-name="oval:com.mcafee.oval:var:249654" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:249650" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_4.1.2EnableAuditdService" xml:lang="en">
        <title xml:lang="en">CIS 4.1.2 Enable auditd Service</title>
        <description xml:lang="en">Turn on the auditd daemon to record system events.</description>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var37" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var41" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var38" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var42" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var39" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var43" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var40" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var44" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Rule id="TestAuditdServiceRunningStatusrun_level2" xml:lang="en" selected="false">
          <title xml:lang="en">Test the auditd service running status - run level 2</title>
          <description xml:lang="en">This check verifies whether the auditd service is enabled or disabled at a runlevel 2 as per the user input.</description>
          <rationale xml:lang="en">The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04950</ident>
          <fixtext xml:lang="en" fixref="F-TestAuditdServiceRunningStatusrun_level2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig auditd on</fixtext>
          <fix id="F-TestAuditdServiceRunningStatusrun_level2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var37" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var41" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7742" />
          </check>
        </Rule>
        <Rule id="TestAuditdServiceRunningStatus-RunLevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Test the auditd service running status - run level 3</title>
          <description xml:lang="en">This check verifies whether the auditd service is enabled or disable at run level 3 as per the user input.</description>
          <rationale xml:lang="en">The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04950</ident>
          <fixtext xml:lang="en" fixref="F-TestAuditdServiceRunningStatusrun_level3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig auditd on</fixtext>
          <fix id="F-TestAuditdServiceRunningStatusrun_level3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var38" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var42" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7742" />
          </check>
        </Rule>
        <Rule id="TestTheAuditdServiceRunningStatus-RunLevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Test the auditd service running status - run level 4</title>
          <description xml:lang="en">This check verifies whether the auditd service is enabled or disable at run level 4 as per the user input.</description>
          <rationale xml:lang="en">The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04950</ident>
          <fixtext xml:lang="en" fixref="F-TestAuditdServiceRunningStatusrun_level4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig auditd on</fixtext>
          <fix id="F-TestAuditdServiceRunningStatusrun_level4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var39" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var43" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7742" />
          </check>
        </Rule>
        <Rule id="TestTheAuditdServiceRunningStatus-RunLevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Test the auditd service running status - run level 5</title>
          <description xml:lang="en">This check verifies whether the auditd service is enabled or disable at run level 5 as per the user input.</description>
          <rationale xml:lang="en">The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04950</ident>
          <fixtext xml:lang="en" fixref="F-TestAuditdServiceRunningStatusrun_level5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig auditd on</fixtext>
          <fix id="F-TestAuditdServiceRunningStatusrun_level5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var40" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var44" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7742" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_4.2ConfigureLogging" xml:lang="en">
      <title xml:lang="en">CIS 4.2 Configure Logging</title>
      <description xml:lang="en">Logging services should be configured to prevent information leaks and to aggregate logs on a remote server so that they can be reviewed in the event of a system compromise and ease log analysis.</description>
      <Value id="EnterTheNameOfTheRPMPackageToBeVerified_var23" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">rsyslog</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var00" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Rule id="TestForTheRsyslogRPMPackage" xml:lang="en" selected="false">
        <title xml:lang="en">Test for the rsyslog RPM package</title>
        <description xml:lang="en">This check verifies if the rsyslog rpm package is installed on the system.</description>
        <rationale xml:lang="en">The security enhancements of rsyslog such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log
        data en route to a central logging server) justify installing and configuring the package.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.3</ident>
        <fixtext xml:lang="en" fixref="F-TestForTheRsyslogRPMPackage" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># yum install rsyslog</fixtext>
        <fix id="F-TestForTheRsyslogRPMPackage" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="EnterTheNameOfTheRPMPackageToBeVerified_var23" export-name="oval:com.mcafee.oval:var:242779" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244340" />
        </check>
      </Rule>
      <Rule id="EnsurePermissionsOnAllLogfilesAreConfigured" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure permissions on all logfiles are configured</title>
        <description xml:lang="en">This check verifies  verify that other has no permissions on any files and group does not have write or execute permissions on any files.</description>
        <rationale xml:lang="en">It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.4</ident>
        <fixtext xml:lang="en" fixref="F-EnsurePermissionsOnAllLogfilesAreConfigured" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on all existing log files:
        # find /var/log -type f -exec chmod g-wx,o-rwx {} +
        Notes: You may also need to change the configuration for your logging software or services for any logs that had incorrect permissions.</fixtext>
        <fix id="F-EnsurePermissionsOnAllLogfilesAreConfigured" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var00" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var00" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var00" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var00" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var00" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var00" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var00" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var00" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var00" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:234516" />
        </check>
      </Rule>
      <Group id="CIS_4.2.1ConfigureRsyslog" xml:lang="en">
        <title xml:lang="en">CIS 4.2.1 Configure rsyslog</title>
        <description xml:lang="en">The rsyslog software is recommended as a replacement for the syslogd daemon and provides improvements over syslogd, such as connection-oriented (i.e. TCP) transmission
        of logs, the option to log to database formats, and the encryption of log data en route to a central logging server. Note: This section only applies if rsyslog is installed on the system.</description>
        <Rule id="EnsureRsyslogDefaultFilePermissionsConfigured" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure rsyslog default file permissions configured</title>
          <description xml:lang="en">rsyslog will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files.</description>
          <rationale xml:lang="en">It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.3</ident>
          <fixtext xml:lang="en" fixref="F-EnsureRsyslogDefaultFilePermissionsConfigured" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/rsyslog.conf and set $FileCreateMode to 0640 or more restrictive:
          $FileCreateMode 0640</fixtext>
          <fix id="F-EnsureRsyslogDefaultFilePermissionsConfigured" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:2487800" />
          </check>
        </Rule>
        <Rule id="ConfigureRsyslogToSendLogsToARemoteLogHost" xml:lang="en" selected="false">
          <title xml:lang="en">Configure rsyslog to Send Logs to a Remote Log Host</title>
          <description xml:lang="en">This check verifies whether system is configured to send syslogs to remote LogHost.</description>
          <rationale xml:lang="en">Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08800</ident>
          <fixtext xml:lang="en" fixref="F-ConfigureRsyslogToSendLogsToARemoteLogHost" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/rsyslog.conf file and add the following line (where logfile.example.com is the name of your central log host). 
          *.* @@loghost.example.com # Execute the following command to restart rsyslogd # pkill -HUP rsyslogd
          Note: The double "at" sign (@@) directs rsyslog to use TCP to send log messages to the server, which is a more reliable transport mechanism than the default UDP protocol.</fixtext>
          <fix id="F-ConfigureRsyslogToSendLogsToARemoteLogHost" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:249406" />
          </check>
        </Rule>
        <Rule id="AcceptRemoteRsyslogMessagesOnlyOnDesignatedLogHosts" xml:lang="en" selected="false">
          <title xml:lang="en">Accept Remote rsyslog Messages Only on Designated Log Hosts</title>
          <description xml:lang="en">This check verifies if imtcp.so module and  InputTCPServerRun parameter are set correctly in /etc/rsyslog.conf for the hosts that are designated log hosts. The ModLoad tells rsyslog to load the imtcp.so module so it can listen over a network via TCP. 
          The InputTCPServerRun option instructs rsyslogd to listen on the specified TCP port.</description>
          <rationale xml:lang="en">The guidance in the section ensures that remote log hosts are configured to only accept rsyslog data from hosts within the specified domain and that those systems 
          that are not designed to be log hosts do not accept any remote rsyslog messages. This provides protection from spoofed log data and ensures that system administrators are reviewing reasonably complete syslog data in a central location.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08801</ident>
          <fixtext xml:lang="en" fixref="F-AcceptRemoteRsyslogMessagesOnlyOnDesignatedLogHosts" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">On hosts that are designated as log hosts edit the /etc/rsyslog.conf file and un-comment the following lines: $ModLoad imtcp.so $InputTCPServerRun 514
          Note: On hosts that are not designated log hosts these lines should be commented out instead.
          Execute the following command to restart rsyslogd: # pkill -HUP rsyslogd</fixtext>
          <fix id="F-AcceptRemoteRsyslogMessagesOnlyOnDesignatedLogHosts" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:249542" />
          </check>
        </Rule>
        <Group id="CIS_4.2.1.1EnableRsyslogService" xml:lang="en">
          <title xml:lang="en">CIS 4.2.1.1 Ensure rsyslog Service is enabled</title>
          <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var29" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">2</value>
          </Value>
          <Value id="ShouldTheServiceBeEnabledOrDisabled_var33" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">true</value>
          </Value>
          <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var30" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">3</value>
          </Value>
          <Value id="ShouldTheServiceBeEnabledOrDisabled_var34" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">true</value>
          </Value>
          <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var31" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">4</value>
          </Value>
          <Value id="ShouldTheServiceBeEnabledOrDisabled_var35" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">true</value>
          </Value>
          <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var32" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">5</value>
          </Value>
          <Value id="ShouldTheServiceBeEnabledOrDisabled_var36" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">true</value>
          </Value>
          <Rule id="TestTheRsyslogRunningStatus" xml:lang="en" selected="false">
            <title xml:lang="en">Test the rsyslog running status - runlevel 2</title>
            <description xml:lang="en">This check verifies whether the rsyslog service is enabled or disabled at runlevel 2.</description>
            <rationale xml:lang="en">If the rsyslog service is not activated the system may default to the syslogd service or lack logging instead.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.1</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08742</ident>
            <fixtext xml:lang="en" fixref="F-TestTheRsyslogRunningStatus" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to enable rsyslog:
            # chkconfig rsyslog on</fixtext>
            <fix id="F-TestTheRsyslogRunningStatus" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var29" export-name="oval:com.mcafee.oval:var:79726" />
              <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var33" export-name="oval:com.mcafee.oval:var:87715" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:249338" />
            </check>
          </Rule>
          <Rule id="TestTheRsyslogRunningStatus-Runlevel3" xml:lang="en" selected="false">
            <title xml:lang="en">Test the rsyslog running status - runlevel 3</title>
            <description xml:lang="en">This check verifies whether the rsyslog service is enabled or disabled at runlevel 3.</description>
            <rationale xml:lang="en">If the rsyslog service is not activated the system may default to the syslogd service or lack logging instead.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.1</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08742</ident>
            <fixtext xml:lang="en" fixref="F-TestTheRsyslogRunningStatus-Runlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to enable rsyslog:
            # chkconfig rsyslog on</fixtext>
            <fix id="F-TestTheRsyslogRunningStatus-Runlevel3" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var30" export-name="oval:com.mcafee.oval:var:79726" />
              <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var34" export-name="oval:com.mcafee.oval:var:87715" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:249338" />
            </check>
          </Rule>
          <Rule id="TestTheRsyslogRunningStatus-Runlevel4" xml:lang="en" selected="false">
            <title xml:lang="en">Test the rsyslog running status - runlevel 4</title>
            <description xml:lang="en">This check verifies whether the rsyslog service is enabled or disabled at runlevel 4.</description>
            <rationale xml:lang="en">If the rsyslog service is not activated the system may default to the syslogd service or lack logging instead.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.1</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08742</ident>
            <fixtext xml:lang="en" fixref="F-TestTheRsyslogRunningStatus-Runlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to enable rsyslog:
            # chkconfig rsyslog on</fixtext>
            <fix id="F-TestTheRsyslogRunningStatus-Runlevel4" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var31" export-name="oval:com.mcafee.oval:var:79726" />
              <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var35" export-name="oval:com.mcafee.oval:var:87715" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:249338" />
            </check>
          </Rule>
          <Rule id="TestTheRsyslogRunningStatus-Runlevel5" xml:lang="en" selected="false">
            <title xml:lang="en">Test the rsyslog running status - runlevel 5</title>
            <description xml:lang="en">This check verifies whether the rsyslog service is enabled or disabled at runlevel 5.</description>
            <rationale xml:lang="en">If the rsyslog service is not activated the system may default to the syslogd service or lack logging instead.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">4.2.1.1</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08742</ident>
            <fixtext xml:lang="en" fixref="F-TestTheRsyslogRunningStatus-Runlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to enable rsyslog:
            # chkconfig rsyslog on</fixtext>
            <fix id="F-TestTheRsyslogRunningStatus-Runlevel5" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var32" export-name="oval:com.mcafee.oval:var:79726" />
              <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var36" export-name="oval:com.mcafee.oval:var:87715" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:249338" />
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="CIS_4.2.2ConfigureSyslog-ng" xml:lang="en">
        <title xml:lang="en">CIS 4.2.2 Configure syslog-ng</title>
        <description xml:lang="en">Vendor (Red Hat) does not support syslog-ng officially. So this section rules we are not supporting.</description>
      </Group>
    </Group>
  </Group>
  <Group id="CIS_5SystemAccess_AuthenticationAndAuthorization" xml:lang="en">
    <title xml:lang="en">CIS 5 System Access, Authentication and Authorization</title>
    <Rule id="EnsureRootLoginIsRestrictedToSystemConsole" xml:lang="en" selected="false">
      <title xml:lang="en">Ensure root login is restricted to system console</title>
      <description xml:lang="en">This check verifies root login is restricted to system console.</description>
      <rationale xml:lang="en">Since the system console has special properties to handle emergency situations, it is important to ensure that the console is in a physically secure location and that
        unauthorized consoles have not been defined.</rationale>
      <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.5</ident>
      <fixtext xml:lang="en" fixref="F-EnsureRootLoginIsRestrictedToSystemConsole" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Remove entries for any consoles that are not in a physically secure location.</fixtext>
      <fix id="F-EnsureRootLoginIsRestrictedToSystemConsole" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref href="" name="oval:com.mcafee.oval:def:7026" />
      </check>
    </Rule>
    <Group id="CIS_5.1ConfigureCron" xml:lang="en">
      <title xml:lang="en">CIS 5.1 Configure cron</title>
      <Group id="CIS_5.1.1EnableCrondDaemon" xml:lang="en">
        <title xml:lang="en">CIS 5.1.1Enable crond Daemon</title>
        <description xml:lang="en">The crond daemon is used to execute batch jobs on the system.</description>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">2</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabledCrond_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var26" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var30" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var27" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">4</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var31" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Value id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var28" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">5</value>
        </Value>
        <Value id="ShouldTheServiceBeEnabledOrDisabled_var32" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">true</value>
        </Value>
        <Rule id="TestForService-Crond-RunningStaterunlevel2" xml:lang="en" selected="false">
          <title xml:lang="en">Test for service - crond - running state - runlevel 2</title>
          <description xml:lang="en">This check verifies whether the crond service is enabled or
            disabled at runlevel 2.</description>
          <rationale xml:lang="en">While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run and crond is used to execute them.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04974</ident>
          <fixtext xml:lang="en" fixref="F-TestForService-Crond-RunningStaterunlevel2" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig crond on</fixtext>
          <fix id="F-TestForService-Crond-RunningStaterunlevel2" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabledCrond_var" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803050164" />
          </check>
        </Rule>
        <Rule id="TestTheService-Crond-RunningState-Runlevel3" xml:lang="en" selected="false">
          <title xml:lang="en">Test for service - crond - running state - runlevel 3</title>
          <description xml:lang="en">This check verifies whether the crond service is enabled or
            disabled at runlevel 3.</description>
          <rationale xml:lang="en">While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run and crond is used to execute them.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04974</ident>
          <fixtext xml:lang="en" fixref="F-TestForService-Crond-RunningStaterunlevel3" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig crond on</fixtext>
          <fix id="F-TestForService-Crond-RunningStaterunlevel3" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var26" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var30" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803050164" />
          </check>
        </Rule>
        <Rule id="TestForService-Crond-RunningState-Runlevel4" xml:lang="en" selected="false">
          <title xml:lang="en">Test for service - crond - running state - runlevel 4</title>
          <description xml:lang="en">This check verifies whether the crond service is enabled or
            disabled at runlevel 4.</description>
          <rationale xml:lang="en">While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run and crond is used to execute them.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04974</ident>
          <fixtext xml:lang="en" fixref="F-TestForService-Crond-RunningStaterunlevel4" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig crond on</fixtext>
          <fix id="F-TestForService-Crond-RunningStaterunlevel4" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var27" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var31" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803050164" />
          </check>
        </Rule>
        <Rule id="TestForService-Crond-RunningState-Runlevel5" xml:lang="en" selected="false">
          <title xml:lang="en">Test for service - crond - running state - runlevel 5</title>
          <description xml:lang="en">This check verifies whether the crond service is enabled or
            disabled at runlevel 5.</description>
          <rationale xml:lang="en">While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run and crond is used to execute them.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04974</ident>
          <fixtext xml:lang="en" fixref="F-TestForService-Crond-RunningStaterunlevel5" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chkconfig crond on</fixtext>
          <fix id="F-TestForService-Crond-RunningStaterunlevel5" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="RunlevelAtWhichTheServiceShouldBeEnabledOrDisabled_var28" export-name="oval:com.mcafee.oval:var:79726" />
            <check-export value-id="ShouldTheServiceBeEnabledOrDisabled_var32" export-name="oval:com.mcafee.oval:var:87715" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803050164" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.2SetUser_GroupOwnerAndPermissionOn_Etc_crontab" xml:lang="en">
        <title xml:lang="en">CIS 5.1.2 Set User/Group Owner and Permission on /etc/crontab</title>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var7" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestTheOwnerOfTheFile-_Etc_crontab" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the file - /etc/crontab</title>
          <description xml:lang="en">This check verifies if the owner of the file - /etc/crontab is
            set as per the user input.</description>
          <rationale xml:lang="en">This file contains information on what system jobs are run by cron. Write access to these files could provide unprivileged users with the ability to elevate their privileges. 
            Read access to these files could provide users with the ability to gain insight on system jobs that run on the system and could provide them a way to gain unauthorized privileged access.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05353</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08968</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_crontab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/crontab # chmod og-rwx /etc/crontab</fixtext>
          <fix id="F-TestTheOwnerOfTheFile-_Etc_crontab" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var7" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250128" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheFile-_Etc_crontab" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the file - /etc/crontab</title>
          <description xml:lang="en">This check verifies if the group owner of the file -
            /etc/crontab is set as per the user input.</description>
          <rationale xml:lang="en">This file contains information on what system jobs are run by cron. Write access to these files could provide unprivileged users with the ability to elevate their privileges. 
            Read access to these files could provide users with the ability to gain insight on system jobs that run on the system and could provide them a way to gain unauthorized privileged access.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05353</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08968</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_crontab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/crontab # chmod og-rwx /etc/crontab</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_crontab" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var7" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290132" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheFile-_Etc_crontab" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the file - /etc/crontab</title>
          <description xml:lang="en">This check verifies if the permissions of the file -
            /etc/crontab are set as per the user input.</description>
          <rationale xml:lang="en">This file contains information on what system jobs are run by cron. Write access to these files could provide unprivileged users with the ability to elevate their privileges. 
            Read access to these files could provide users with the ability to gain insight on system jobs that run on the system and could provide them a way to gain unauthorized privileged access.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05353</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08968</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_crontab" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/crontab # chmod og-rwx /etc/crontab</fixtext>
          <fix id="F-TestThePermissionsOfTheFile-_Etc_crontab" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var7" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var7" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var7" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var7" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var7" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var7" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var7" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var7" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var7" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6894" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.3SetUser_GroupOwnerAndPermissionOn_Etc_cron.hourly" xml:lang="en">
        <title xml:lang="en">CIS 5.1.3 Set User/Group Owner and Permission on /etc/cron.hourly</title>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestTheOwnerOfThe_Etc_cron.hourlyDirectory" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the /etc/cron.hourly directory</title>
          <description xml:lang="en">This check verifies if the owner of the /etc/cron.hourly
            directory is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06010</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06011</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfThe_Etc_cron.hourlyDirectory" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.hourly # chmod og-rwx /etc/cron.hourly</fixtext>
          <fix id="F-TestTheOwnerOfThe_Etc_cron.hourlyDirectory" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var8" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250116" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheDirectory-_Etc_cron.hourly" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the directory - /etc/cron.hourly</title>
          <description xml:lang="en">This check verifies if the group owner of the directory -
            /etc/cron.hourly is as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06010</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06011</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.hourly" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.hourly # chmod og-rwx /etc/cron.hourly</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.hourly" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var8" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290120" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheDirectory-_Etc_cron.hourly" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the directory - /etc/cron.hourly</title>
          <description xml:lang="en">This check verifies if the permissions of the directory -
            /etc/cron.hourly are set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06010</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06011</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheDirectory-_Etc_cron.hourly" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.hourly # chmod og-rwx /etc/cron.hourly</fixtext>
          <fix id="F-TestThePermissionsOfTheDirectory-_Etc_cron.hourly" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var8" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var8" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var8" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var8" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var8" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var8" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var8" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var8" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var8" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6882" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.4SetUser_GroupOwnerAndPermissionOn_Etc_cron.daily" xml:lang="en">
        <title xml:lang="en">CIS 5.1.4 Set User/Group Owner and Permission on /etc/cron.daily</title>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var9" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestTheOwnerOfDirectory-_Etc_cron.daily" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of directory - /etc/cron.daily</title>
          <description xml:lang="en">This check verifies if the owner of directory -
            /etc/cron.daily is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06008</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06012</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfDirectory-_Etc_cron.daily" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.daily # chmod og-rwx /etc/cron.daily</fixtext>
          <fix id="F-TestTheOwnerOfDirectory-_Etc_cron.daily" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var9" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250112" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfDirectory-_Etc_cron.daily" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of directory - /etc/cron.daily</title>
          <description xml:lang="en">This check verifies if the group owner of directory -
            /etc/cron.daily is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06008</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06012</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfDirectory-_Etc_cron.daily" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.daily # chmod og-rwx /etc/cron.daily</fixtext>
          <fix id="F-TestTheGroupOwnerOfDirectory-_Etc_cron.daily" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var9" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290100" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheDirectory-_Etc_cron.daily" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the directory - /etc/cron.daily</title>
          <description xml:lang="en">This check verifies if the permissions of directory -
            /etc/cron.daily are set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06008</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06012</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheDirectory-_Etc_cron.daily" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.daily # chmod og-rwx /etc/cron.daily</fixtext>
          <fix id="F-TestThePermissionsOfTheDirectory-_Etc_cron.daily" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var9" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var9" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var9" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var9" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var9" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var9" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var9" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var9" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var9" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6878" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.5SetUser_GroupOwnerAndPermissionOn_Etc_cron.weekly" xml:lang="en">
        <title xml:lang="en">CIS 5.1.5 Set User/Group Owner and Permission on /etc/cron.weekly</title>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var10" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestTheOwnerOfTheDirectory-_Etc_cron.weekly" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the directory - /etc/cron.weekly</title>
          <description xml:lang="en">This check verifies if the owner of the directory -
            /etc/cron.weekly is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06009</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheDirectory-_Etc_cron.weekly" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.weekly # chmod og-rwx /etc/cron.weekly</fixtext>
          <fix id="F-TestTheOwnerOfTheDirectory-_Etc_cron.weekly" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var10" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250124" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheDirectory-_Etc_cron.weekly" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the directory - /etc/cron.weekly</title>
          <description xml:lang="en">This check verifies if the group owner of the directory -
            /etc/cron.weekly is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06009</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.weekly" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.weekly # chmod og-rwx /etc/cron.weekly</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.weekly" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var10" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290112" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheDirectory-_Etc_cron.weekly" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the directory - /etc/cron.weekly</title>
          <description xml:lang="en">This check verifies if the permissions of the directory -
            /etc/cron.weekly are set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.5</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06009</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheDirectory-_Etc_cron.weekly" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown"># chown root:root /etc/cron.weekly # chmod og-rwx /etc/cron.weekly</fixtext>
          <fix id="F-TestThePermissionsOfTheDirectory-_Etc_cron.weekly" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var10" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var10" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var10" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var10" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var10" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var10" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var10" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var10" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var10" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6890" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.6SetUser_GroupOwnerAndPermissionOn_Etc_cron.monthly" xml:lang="en">
        <title xml:lang="en">CIS 5.1.6 Set User/Group Owner and Permission on /etc/cron.monthly</title>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var11" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestTheGroupOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the directory - /etc/cron.monthly
            directory</title>
          <description xml:lang="en">This check verifies if the group owner of the directory -
            /etc/cron.monthly directory is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06013</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06007</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/cron.monthly:
            # chown root:root /etc/cron.monthly
            # chmod og-rwx /etc/cron.monthly</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var11" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290116" />
          </check>
        </Rule>
        <Rule id="TestTheOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of the directory - /etc/cron.monthly
            directory</title>
          <description xml:lang="en">Test the owner of the directory - /etc/cron.monthly directory
            is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06013</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06007</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/cron.monthly:
            # chown root:root /etc/cron.monthly
            # chmod og-rwx /etc/cron.monthly</fixtext>
          <fix id="F-TestTheOwnerOfTheDirectory-_Etc_cron.monthlyDirectory" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var11" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250120" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheDirectory-_Etc_cron.monthly" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the directory - /etc/cron.monthly</title>
          <description xml:lang="en">This check verifies if the permissions of the directory -
            /etc/cron.monthly are set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.6</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06013</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06007</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheDirectory-_Etc_cron.monthly" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/cron.monthly:
            # chown root:root /etc/cron.monthly
            # chmod og-rwx /etc/cron.monthly</fixtext>
          <fix id="F-TestThePermissionsOfTheDirectory-_Etc_cron.monthly" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var11" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var11" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var11" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var11" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var11" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var11" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var11" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var11" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var11" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6886" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.7SetUser_GroupOwnerAndPermissionOn_Etc_cron.d" xml:lang="en">
        <title xml:lang="en">CIS 5.1.7 Set User/Group Owner and Permission on /etc/cron.d</title>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var12" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="TestTheOwnerOf_Etc_cron.dDirectory" xml:lang="en" selected="false">
          <title xml:lang="en">Test the owner of /etc/cron.d directory</title>
          <description xml:lang="en">This check verifies if the owner of /etc/cron.d directory is
            set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05304</ident>
          <fixtext xml:lang="en" fixref="F-TestTheOwnerOf_Etc_cron.dDirectory" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/cron.d:
            # chown root:root /etc/cron.d
            # chmod og-rwx /etc/cron.d</fixtext>
          <fix id="F-TestTheOwnerOf_Etc_cron.dDirectory" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var12" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250108" />
          </check>
        </Rule>
        <Rule id="TestTheGroupOwnerOfTheDirectory-_Etc_cron.d" xml:lang="en" selected="false">
          <title xml:lang="en">Test the group owner of the directory - /etc/cron.d</title>
          <description xml:lang="en">This check will verify the group owner of the directory -
            /etc/cron.d is set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05304</ident>
          <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.d" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/cron.d:
            # chown root:root /etc/cron.d
            # chmod og-rwx /etc/cron.d</fixtext>
          <fix id="F-TestTheGroupOwnerOfTheDirectory-_Etc_cron.d" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var12" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78840" />
          </check>
        </Rule>
        <Rule id="TestThePermissionsOfTheDirectory-_Etc_cron.d" xml:lang="en" selected="false">
          <title xml:lang="en">Test the permissions of the directory - /etc/cron.d</title>
          <description xml:lang="en">This check verifies if the permissions of the directory -
            /etc/cron.d are set as per the user input.</description>
          <rationale xml:lang="en">Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. 
            Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.7</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05304</ident>
          <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheDirectory-_Etc_cron.d" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/cron.d:
            # chown root:root /etc/cron.d
            # chmod og-rwx /etc/cron.d</fixtext>
          <fix id="F-TestThePermissionsOfTheDirectory-_Etc_cron.d" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var12" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var12" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var12" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var12" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var12" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var12" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var12" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var12" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var12" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6874" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.1.8RestrictAt_CronDaemon" xml:lang="en">
        <title xml:lang="en">CIS 5.1.8 Restrict at/cron Daemon</title>
        <Group id="RestrictAtDaemon" xml:lang="en">
          <title xml:lang="en">Restrict at Daemon</title>
          <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldOthersHaveWRITEAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldOthersHaveEXECUTEAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldOthersHaveREADAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheUserHaveEXECUTEAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheUserHaveREADAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">1</value>
          </Value>
          <Value id="ShouldTheUserHaveWRITEAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">1</value>
          </Value>
          <Value id="ShouldTheGroupHaveWRITEAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheGroupHaveREADAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheGroupHaveEXECUTEAccess_var13" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Rule id="TestTheExistenceOfTheFile-_Etc_cron.deny" xml:lang="en" selected="false">
            <title xml:lang="en">Test the existence of the file - /etc/cron.deny</title>
            <description xml:lang="en">This check ensures that the file /etc/cron.deny does not exist on the system.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
              manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06003</ident>
            <fixtext xml:lang="en" fixref="F-TestTheExistenceOfTheFile-_Etc_cron.deny" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
              set permissions and ownership for /etc/cron.allow and /etc/at.allow:
              # rm /etc/cron.deny
              # rm /etc/at.deny
              # touch /etc/cron.allow
              # touch /etc/at.allow
              # chmod og-rwx /etc/cron.allow
              # chmod og-rwx /etc/at.allow
              # chown root:root /etc/cron.allow
              # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestTheExistenceOfTheFile-_Etc_cron.deny" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:239207" />
            </check>
          </Rule>
          <Rule id="TestIfTheFile-_Etc_at.allowExists" xml:lang="en" selected="false">
            <title xml:lang="en">Test if the file - /etc/at.allow exists</title>
            <description xml:lang="en">his check ensures that the file - /etc/at.allow exists on the system.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
              manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08787</ident>
            <fixtext xml:lang="en" fixref="F-TestIfTheFile-_Etc_at.allowExists" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
              set permissions and ownership for /etc/cron.allow and /etc/at.allow:
              # rm /etc/cron.deny
              # rm /etc/at.deny
              # touch /etc/cron.allow
              # touch /etc/at.allow
              # chmod og-rwx /etc/cron.allow
              # chmod og-rwx /etc/at.allow
              # chown root:root /etc/cron.allow
              # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestIfTheFile-_Etc_at.allowExists" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:238335" />
            </check>
          </Rule>
          <Rule id="TestTheGroupOwnerOfTheFile-Etc_at.allow" xml:lang="en" selected="false">
            <title xml:lang="en">Test the group owner of the file - /etc/cron.d/at.allow</title>
            <description xml:lang="en">This check verifies if the owner of the file - /etc/cron.d/at.allow is set as per the user input.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08787</ident>
            <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-Etc_at.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestTheGroupOwnerOfTheFile-Etc_at.allow" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var13" export-name="oval:com.mcafee.oval:var:80125" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:7245" />
            </check>
          </Rule>
          <Rule id="TestTheOwnerOfTheFile-_Etc_at.allow" xml:lang="en" selected="false">
            <title xml:lang="en">Test the owner of the file - /etc/at.allow</title>
            <description xml:lang="en">This check verifies if the owner of the file - /etc/at.allow is set as per the user input.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08787</ident>
            <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_at.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestTheOwnerOfTheFile-_Etc_at.allow" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var13" export-name="oval:com.mcafee.oval:var:80228" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:78859" />
            </check>
          </Rule>
          <Rule id="TestThePermissionsOfTheFile-_Etc_at.allow" xml:lang="en" selected="false">
            <title xml:lang="en">Test the permissions of the file - /etc/at.allow</title>
            <description xml:lang="en">This check verifies if the permissions of the file - /etc/at.allow is set as per the user input.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08787</ident>
            <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_at.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestThePermissionsOfTheFile-_Etc_at.allow" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="ShouldTheUserHaveREADAccess_var13" export-name="oval:com.mcafee.oval:var:78640" />
              <check-export value-id="ShouldTheUserHaveWRITEAccess_var13" export-name="oval:com.mcafee.oval:var:78641" />
              <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var13" export-name="oval:com.mcafee.oval:var:78642" />
              <check-export value-id="ShouldTheGroupHaveREADAccess_var13" export-name="oval:com.mcafee.oval:var:78643" />
              <check-export value-id="ShouldTheGroupHaveWRITEAccess_var13" export-name="oval:com.mcafee.oval:var:78644" />
              <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var13" export-name="oval:com.mcafee.oval:var:78645" />
              <check-export value-id="ShouldOthersHaveREADAccess_var13" export-name="oval:com.mcafee.oval:var:78646" />
              <check-export value-id="ShouldOthersHaveWRITEAccess_var13" export-name="oval:com.mcafee.oval:var:78647" />
              <check-export value-id="ShouldOthersHaveEXECUTEAccess_var13" export-name="oval:com.mcafee.oval:var:78648" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:78697" />
            </check>
          </Rule>
        </Group>
        <Group id="RestrictAt_cronToAuthorizedUsers" xml:lang="en">
          <title xml:lang="en">Restrict at/cron to Authorized Users</title>
          <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var14" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var14" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldOthersHaveWRITEAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldOthersHaveEXECUTEAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldOthersHaveREADAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheUserHaveEXECUTEAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheUserHaveREADAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">1</value>
          </Value>
          <Value id="ShouldTheUserHaveWRITEAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">1</value>
          </Value>
          <Value id="ShouldTheGroupHaveWRITEAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheGroupHaveREADAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Value id="ShouldTheGroupHaveEXECUTEAccess_var15" xml:lang="en" type="string" operator="equals" interactive="false">
            <value selector="">0</value>
          </Value>
          <Rule id="TestTheExistenceOfTheFile-_Etc_at.deny" xml:lang="en" selected="false">
            <title xml:lang="en">Test the existence of the file - /etc/at.deny</title>
            <description xml:lang="en">This check ensures that the file /etc/at.deny does not exist on the system.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <fixtext xml:lang="en" fixref="F-TestTheExistenceOfTheFile-_Etc_at.deny" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestTheExistenceOfTheFile-_Etc_at.deny" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:239206" />
            </check>
          </Rule>
          <Rule id="TestIfTheFile-_Etc_cron.allowExists" xml:lang="en" selected="false">
            <title xml:lang="en">Test if the file - /etc/cron.allow exists</title>
            <description xml:lang="en">This check ensures that the file - /etc/cron.allow exists on the system.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06002</ident>
            <fixtext xml:lang="en" fixref="F-TestIfTheFile-_Etc_cron.allowExists" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestIfTheFile-_Etc_cron.allowExists" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref href="" name="oval:com.mcafee.oval:def:238336" />
            </check>
          </Rule>
          <Rule id="TestTheOwnerOfTheFile-_Etc_cron.allow" xml:lang="en" selected="false">
            <title xml:lang="en">Test the owner of the file - /etc/cron.allow</title>
            <description xml:lang="en">This check verifies if the owner of the file - /etc/cron.allow is set as per the user input.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06002</ident>
            <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_cron.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestTheOwnerOfTheFile-_Etc_cron.allow" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var14" export-name="oval:com.mcafee.oval:var:80228" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:78861" />
            </check>
          </Rule>
          <Rule id="TestTheGroupOwerOfTheFile-_Etc_cron.allow" xml:lang="en" selected="false">
            <title xml:lang="en">Test the group ower of the file - /etc/cron.allow</title>
            <description xml:lang="en">This check verifies if the group owner of the file - /etc/cron.allow is set as per the user input.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06002</ident>
            <fixtext xml:lang="en" fixref="F-TestTheGroupOwerOfTheFile-_Etc_cron.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestTheGroupOwerOfTheFile-_Etc_cron.allow" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var14" export-name="oval:com.mcafee.oval:var:80125" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:7276" />
            </check>
          </Rule>
          <Rule id="TestThePermissionsOfTheFile-_Etc_cron.allow" xml:lang="en" selected="false">
            <title xml:lang="en">Test the permissions of the file - /etc/cron.allow</title>
            <description xml:lang="en">This check verifies if the permissions of the file - /etc/cron.allow are set as per the user input.</description>
            <rationale xml:lang="en">On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to
            manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.</rationale>
            <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.1.8</ident>
            <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06002</ident>
            <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_cron.allow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to remove /etc/cron.deny and /etc/at.deny and create and
            set permissions and ownership for /etc/cron.allow and /etc/at.allow:
            # rm /etc/cron.deny
            # rm /etc/at.deny
            # touch /etc/cron.allow
            # touch /etc/at.allow
            # chmod og-rwx /etc/cron.allow
            # chmod og-rwx /etc/at.allow
            # chown root:root /etc/cron.allow
            # chown root:root /etc/at.allow</fixtext>
            <fix id="F-TestThePermissionsOfTheFile-_Etc_cron.allow" />
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export value-id="ShouldTheUserHaveREADAccess_var15" export-name="oval:com.mcafee.oval:var:78640" />
              <check-export value-id="ShouldTheUserHaveWRITEAccess_var15" export-name="oval:com.mcafee.oval:var:78641" />
              <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var15" export-name="oval:com.mcafee.oval:var:78642" />
              <check-export value-id="ShouldTheGroupHaveREADAccess_var15" export-name="oval:com.mcafee.oval:var:78643" />
              <check-export value-id="ShouldTheGroupHaveWRITEAccess_var15" export-name="oval:com.mcafee.oval:var:78644" />
              <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var15" export-name="oval:com.mcafee.oval:var:78645" />
              <check-export value-id="ShouldOthersHaveREADAccess_var15" export-name="oval:com.mcafee.oval:var:78646" />
              <check-export value-id="ShouldOthersHaveWRITEAccess_var15" export-name="oval:com.mcafee.oval:var:78647" />
              <check-export value-id="ShouldOthersHaveEXECUTEAccess_var15" export-name="oval:com.mcafee.oval:var:78648" />
              <check-content-ref href="" name="oval:com.mcafee.oval:def:78699" />
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="CIS_5.2SSHServerConfiguration" xml:lang="en">
      <title xml:lang="en">CIS 5.2 SSH Server Configuration</title>
      <description xml:lang="en">SSH is a secure, encrypted replacement for common login services such as telnet, ftp, rlogin, rsh, and rcp. It is strongly recommended that sites abandon older clear-text login
        protocols and use SSH to prevent session hijacking and sniffing of sensitive data off the network.</description>
      <Value id="SelectSSHLogLevelSetting-TheseAreTheVerbosityLevelsThatAreUsedWhenLoggingMessagesFromSshd._var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">INFO</value>
      </Value>
      <Value id="AllowX11Forwarding_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Value id="SetSSHMaxAuthTries-EnterTheIntegerValue._var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">4</value>
      </Value>
      <Value id="ShouldRhostsBeIgnoredInSSH_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">yes</value>
      </Value>
      <Value id="SSHHost-basedAuthenticationShouldBeEnabledOrDisabled_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Value id="PermitRootLogin_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Value id="ShouldEmptyPasswordsBePermitted_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Value id="AllowPermitUserEnvironmentSetting_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">no</value>
      </Value>
      <Value id="WhatIsTheExpectedSSHProtocolVersionRHEL6_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">2</value>
      </Value>
      <Value id="SetSSHLoginGraceTime-EnterTheIntegerValue_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">60</value>
      </Value>
      <Rule id="TestTheConfigurationStatusFor-SSHProtocolRHEL6" xml:lang="en" selected="false">
        <title xml:lang="en">Test the configuration status for - SSH Protocol</title>
        <description xml:lang="en">This rule ensures that the SSH Protocol version is set
          appropriately in /etc/ssh/sshd_config file as per the user input.</description>
        <rationale xml:lang="en">SSH v1 suffers from insecurities that do not affect SSH v2.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04465</ident>
        <fixtext xml:lang="en" fixref="F-TestTheConfigurationStatusFor-SSHProtocolRHEL6" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: Protocol 2</fixtext>
        <fix id="F-TestTheConfigurationStatusFor-SSHProtocolRHEL6" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheExpectedSSHProtocolVersionRHEL6_var" export-name="oval:com.mcafee.oval:var:230372" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:230333" />
        </check>
      </Rule>
      <Rule id="SetSSHLogLevel" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH LogLevel</title>
        <description xml:lang="en">SSH provides several logging levels with varying amounts of
          verbosity. The INFO parameter specifices that record login and logout activity will be
          logged. This rule ensures that the SSH LogLevel parameter is set appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically not recommended other than strictly for debugging SSH communications since 
          it provides so much data that it is difficult to identify important security information. INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, 
          it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09006</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHLogLevel" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: LogLevel INFO</fixtext>
        <fix id="F-SetSSHLogLevel" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="SelectSSHLogLevelSetting-TheseAreTheVerbosityLevelsThatAreUsedWhenLoggingMessagesFromSshd._var" export-name="oval:com.mcafee.oval:var:242726" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242722" />
        </check>
      </Rule>
      <Rule id="SetSSHX11Forwarding" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH X11 Forwarding</title>
        <description xml:lang="en">The X11Forwarding parameter provides the ability to tunnel X11
          traffic through the connection to enable remote graphic connections. There is a small risk
          that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be
          compromised by other users on the X11 server. This rule ensures that the X11 forwarding
          parameter is set appropriately in /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be 
          compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05723</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHX11Forwarding" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: X11Forwarding no</fixtext>
        <fix id="F-SetSSHX11Forwarding" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="AllowX11Forwarding_var" export-name="oval:com.mcafee.oval:var:79445" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8665" />
        </check>
      </Rule>
      <Rule id="SetSSHMaxAuthTries" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH MaxAuthTries</title>
        <description xml:lang="en">The MaxAuthTries parameter specifies the maximum number of
          authentication attempts permitted per connection. Setting the MaxAuthTries parameter to a
          low number will minimize the risk of successful brute force attacks to the SSH server. This
          rule ensures that the SSH MaxAuthTries parameter is set appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. While the recommended setting is 4, it is set the number based on site policy.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05750</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHMaxAuthTries" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: MaxAuthTries 4</fixtext>
        <fix id="F-SetSSHMaxAuthTries" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="SetSSHMaxAuthTries-EnterTheIntegerValue._var" export-name="oval:com.mcafee.oval:var:242731" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242727" />
        </check>
      </Rule>
      <Rule id="SetSSHIgnoreRhosts" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH IgnoreRhosts</title>
        <description xml:lang="en">The IgnoreRhosts parameter specifies that .rhosts and .shosts
          files will not be used in RhostsRSAAuthentication or HostbasedAuthentication. Setting this
          parameter forces users to enter a password when authenticating with ssh. This rule verifies
          that the SSH IgnoreRhosts parameter is set appropriately in /etc/ssh/sshd_config
          file.</description>
        <rationale xml:lang="en">Setting this parameter forces users to enter a password when authenticating with ssh.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09951</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHIgnoreRhosts" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: IgnoreRhosts yes</fixtext>
        <fix id="F-SetSSHIgnoreRhosts" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldRhostsBeIgnoredInSSH_var" export-name="oval:com.mcafee.oval:var:79442" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:8666" />
        </check>
      </Rule>
      <Rule id="SetSSHHostbasedAuthentication" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH HostbasedAuthentication</title>
        <description xml:lang="en">The HostbasedAuthentication parameter specifies if
          authentication is allowed through trusted hosts via the user of .rhosts, or
          /etc/hosts.equiv, along with successful public key client host authentication. Even though
          the .rhosts files are ineffective if support is disabled in /etc/pam.conf, disabling the
          ability to use .rhosts files in SSH provides an additional layer of protection. This rule
          ensures that the SSH HostbasedAuthentication parameter is set appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, disabling the ability to use .rhosts files in SSH provides an additional layer of protection.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05576</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHHostbasedAuthentication" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: HostbasedAuthentication no</fixtext>
        <fix id="F-SetSSHHostbasedAuthentication" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="SSHHost-basedAuthenticationShouldBeEnabledOrDisabled_var" export-name="oval:com.mcafee.oval:var:94515" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200803050006" />
        </check>
      </Rule>
      <Rule id="SetSSHRootLogin" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH Root Login</title>
        <description xml:lang="en">The PermitRootLogin parameter specifies if the root user can log
          in using ssh. Disallowing root logins over SSH requires server admins to authenticate using
          their own individual account, then escalating to root via sudo or su. This in turn limits
          opportunity for non-repudiation and provides a clear audit trail in the event of a security
          incident. This rule ensures that SSH PermitRootLogin parameter is set appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Disallowing root logins over SSH requires server admins to authenticate using their own individual account, then escalating to root via sudo or su. This in turn limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.8</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05574</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHRootLogin" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitRootLogin no</fixtext>
        <fix id="F-SetSSHRootLogin" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="PermitRootLogin_var" export-name="oval:com.mcafee.oval:var:79443" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200803050011" />
        </check>
      </Rule>
      <Rule id="SetSSHPermitEmptyPasswords" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH PermitEmptyPasswords</title>
        <description xml:lang="en">The PermitEmptyPasswords parameter specifies if the server
          allows login to accounts with empty password strings. Disallowing remote shell access to
          accounts that have an empty password reduces the probability of unauthorized access to the
          system. This rule ensures that the SSH ermitEmptyPasswords is set appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.9</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09926</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHPermitEmptyPasswords" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitEmptyPasswords no</fixtext>
        <fix id="F-SetSSHPermitEmptyPasswords" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldEmptyPasswordsBePermitted_var" export-name="oval:com.mcafee.oval:var:97905" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:97902" />
        </check>
      </Rule>
      <Rule id="SetSSHEnvironmentOptions" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH User Environment Options</title>
        <description xml:lang="en">The PermitUserEnvironment option allows users to present
          environment options to the ssh daemon. Permitting users the ability to set environment
          variables through the SSH daemon could potentially allow users to bypass security controls.
          This rule ensures that the SSH PermitUserEnvironment parameter is set appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has ssh executing trojaned programs).</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.10</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08789</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHEnvironmentOptions" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitUserEnvironment no</fixtext>
        <fix id="F-SetSSHEnvironmentOptions" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="AllowPermitUserEnvironmentSetting_var" export-name="oval:com.mcafee.oval:var:242736" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242732" />
        </check>
      </Rule>
      <Rule id="UseOnlyApprovedCipherInCounterMode" xml:lang="en" selected="false">
        <title xml:lang="en">Use Only Approved Cipher in Counter Mode</title>
        <description xml:lang="en">This check ensures that SSH uses approved ciphers (of new Counter mode algorithms) during communication.</description>
        <rationale xml:lang="en">Based on research conducted at various institutions, it was determined that the symmetric portion of the SSH Transport Protocol (as described in RFC 4253) 
          has security weaknesses that allowed recovery of up to 32 bits of plaintext from a block of ciphertext that was encrypted with the Cipher Block Chaining (CBC) method. From that research, 
          new Counter mode algorithms (as described in RFC4344) were designed that are not vulnerable to these types of attacks and these algorithms are now recommended for standard use.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08790</ident>
        <fixtext xml:lang="en" fixref="F-UseOnlyApprovedCipherInCounterMode" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: Ciphers aes128-ctr,aes192-ctr,aes256-ctr</fixtext>
        <fix id="F-UseOnlyApprovedCipherInCounterMode" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487895" />
        </check>
      </Rule>
      <Rule id="EnsureOnlyApprovedMACAlgorithmsAreUsed" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure only approved MAC algorithms are used</title>
        <description xml:lang="en">This check ensures that types of MAC algorithms that SSH can use during communication.</description>
        <rationale xml:lang="en">MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of
          attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.12</ident>
        <fixtext xml:lang="en" fixref="F-EnsureOnlyApprovedMACAlgorithmsAreUsed" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter in accordance with site
          policy. The following includes all supported and accepted MACs:
          MACs hmac-sha2-512,hmac-sha2-256</fixtext>
        <fix id="F-EnsureOnlyApprovedMACAlgorithmsAreUsed" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412350" />
        </check>
      </Rule>
      <Rule id="SetSSHLoginGraceTime" xml:lang="en" selected="false">
        <title xml:lang="en">Set SSH LoginGraceTime</title>
        <description xml:lang="en">The LoginGraceTime parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections
          can exist. This rule ensures that the SSH MaxAuthTries parameter is set appropriately in /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Setting the LoginGraceTime parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent
          unauthenticated connections While the recommended setting is 60 seconds (1 Minute), set the number based on site policy.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.14</ident>
        <fixtext xml:lang="en" fixref="F-SetSSHLoginGraceTime" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows:
          LoginGraceTime 60</fixtext>
        <fix id="F-SetSSHLoginGraceTime" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="SetSSHLoginGraceTime-EnterTheIntegerValue_var" export-name="oval:com.mcafee.oval:var:2487798" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487794" />
        </check>
      </Rule>
      <Rule id="LimitAccessViaSSH" xml:lang="en" selected="false">
        <title xml:lang="en">Limit Access via SSH</title>
        <description xml:lang="en">To limit which users and group can access the system via SSH,
          any of these options - AllowUsers or AllowGroups or DenyUsers or DenyGroups should be set.
          This rule ensures that the access is limited to Users and Groups appropriately in
          /etc/ssh/sshd_config file.</description>
        <rationale xml:lang="en">Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.15</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09952</ident>
        <fixtext xml:lang="en" fixref="F-LimitAccessViaSSH" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set one or more of the parameter as follows: AllowUsers 'userlist&gt; AllowGroups 'grouplist&gt; DenyUsers 'userlist&gt; DenyGroups 'grouplist&gt;</fixtext>
        <fix id="F-LimitAccessViaSSH" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:242747" />
        </check>
      </Rule>
      <Rule id="SSHWarningBanner" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure SSH warning banner is configured</title>
        <description xml:lang="en">The Banner parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed.</description>
        <rationale xml:lang="en">Banners are used to warn connecting users of the particular site's policy regarding connection. Presenting a warning message prior to the normal user 
          login may assist the prosecution of trespassers on the computer system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.16</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01597</ident>
        <fixtext xml:lang="en" fixref="F-SSHWarningBanner" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows:
          Banner /etc/issue.net</fixtext>
        <fix id="F-SSHWarningBanner" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:405727" />
        </check>
      </Rule>
      <Group id="CIS_5.2.1SetPermissionsOn_Etc_ssh_sshd_config" xml:lang="en">
        <title xml:lang="en">CIS 5.2.1 Set Permissions on /etc/ssh/sshd_config</title>
        <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveWRITEAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveEXECUTEAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldOthersHaveREADAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveEXECUTEAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheUserHaveREADAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheUserHaveWRITEAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">1</value>
        </Value>
        <Value id="ShouldTheGroupHaveWRITEAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveREADAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Value id="ShouldTheGroupHaveEXECUTEAccess_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="FileGroupFor_Etc_ssh_sshd_config" xml:lang="en" selected="false">
          <title xml:lang="en">Test the File group for /etc/ssh/sshd_config</title>
          <description xml:lang="en">The /etc/ssh/sshd_config file contains configuration
            specifications for sshd. This rule verifies if the group owner of the file
            /etc/ssh/sshd_config is set appropriately.</description>
          <rationale xml:lang="en">The /etc/ssh/sshd_config file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04475</ident>
          <fixtext xml:lang="en" fixref="F-FileGroupFor_Etc_ssh_sshd_config" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/ssh/sshd_config:
            # chown root:root /etc/ssh/sshd_config
            # chmod og-rwx /etc/ssh/sshd_config</fixtext>
          <fix id="F-FileGroupFor_Etc_ssh_sshd_config" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var" export-name="oval:com.mcafee.oval:var:80125" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78813" />
          </check>
        </Rule>
        <Rule id="FileOwnerFor_Etc_ssh_sshd_config" xml:lang="en" selected="false">
          <title xml:lang="en">Test the File owner for /etc/ssh/sshd_config</title>
          <description xml:lang="en">The /etc/ssh/sshd_config file contains configuration
            specifications for sshd. This rule verifies if the owner of the file /etc/ssh/sshd_config
            is set appropriately.</description>
          <rationale xml:lang="en">The /etc/ssh/sshd_config file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04475</ident>
          <fixtext xml:lang="en" fixref="F-FileOwnerFor_Etc_ssh_sshd_config" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/ssh/sshd_config:
            # chown root:root /etc/ssh/sshd_config
            # chmod og-rwx /etc/ssh/sshd_config</fixtext>
          <fix id="F-FileOwnerFor_Etc_ssh_sshd_config" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var" export-name="oval:com.mcafee.oval:var:80228" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78890" />
          </check>
        </Rule>
        <Rule id="FilePermissionsFor_Etc_ssh_sshd_config" xml:lang="en" selected="false">
          <title xml:lang="en">Test the File permissions for /etc/ssh/sshd_config</title>
          <description xml:lang="en">The /etc/ssh/sshd_config file contains configuration
            specifications for sshd. This rule verifies if the permissions of the file
            /etc/ssh/sshd_config are set appropriately.</description>
          <rationale xml:lang="en">The /etc/ssh/sshd_config file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 04475</ident>
          <fixtext xml:lang="en" fixref="F-FilePermissionsFor_Etc_ssh_sshd_config" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set ownership and permissions on /etc/ssh/sshd_config:
            # chown root:root /etc/ssh/sshd_config
            # chmod og-rwx /etc/ssh/sshd_config</fixtext>
          <fix id="F-FilePermissionsFor_Etc_ssh_sshd_config" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="ShouldTheUserHaveREADAccess_var" export-name="oval:com.mcafee.oval:var:78640" />
            <check-export value-id="ShouldTheUserHaveWRITEAccess_var" export-name="oval:com.mcafee.oval:var:78641" />
            <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var" export-name="oval:com.mcafee.oval:var:78642" />
            <check-export value-id="ShouldTheGroupHaveREADAccess_var" export-name="oval:com.mcafee.oval:var:78643" />
            <check-export value-id="ShouldTheGroupHaveWRITEAccess_var" export-name="oval:com.mcafee.oval:var:78644" />
            <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var" export-name="oval:com.mcafee.oval:var:78645" />
            <check-export value-id="ShouldOthersHaveREADAccess_var" export-name="oval:com.mcafee.oval:var:78646" />
            <check-export value-id="ShouldOthersHaveWRITEAccess_var" export-name="oval:com.mcafee.oval:var:78647" />
            <check-export value-id="ShouldOthersHaveEXECUTEAccess_var" export-name="oval:com.mcafee.oval:var:78648" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:78733" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.2.13SetIdleTimeoutIntervalForUserLogin" xml:lang="en">
        <title xml:lang="en">CIS 5.2.13 Set Idle Timeout Interval for User Login</title>
        <Value id="SetSSHClientAliveInterval-EnterTheIntegerValue._var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">300</value>
        </Value>
        <Value id="SetSSHClientAliveCountMax-EnterTheIntegerValue._var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="SetSSHClientAliveInterval" xml:lang="en" selected="false">
          <title xml:lang="en">Set SSH ClientAliveInterval</title>
          <description xml:lang="en">The ClientAliveInterval option controls the timeout of ssh
            sessions. When the ClientAliveInterval variable is set, ssh sessions that have no
            activity for the specified length of time are terminated. Having no timeout value
            associated with a connection could allow an unauthorized user access to another user's
            ssh session. This rule verifies that the ClientAliveInterval parameter is set
            appropriately in /etc/ssh/sshd_config file.</description>
          <rationale xml:lang="en">Having no timeout value associated with a connection could allow an unauthorized user access to another user's ssh session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening..
            While the recommended setting is 300 seconds (5 minutes), set this timeout value based on site policy. The recommended setting for ClientAliveCountMax is 0. In this case, the client session will be terminated after 5 minutes of idle time and no keepalive messages will be sent.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.13</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01763</ident>
          <fixtext xml:lang="en" fixref="F-SetSSHClientAliveInterval" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: ClientAliveInterval 300 ClientAliveCountMax 0</fixtext>
          <fix id="F-SetSSHClientAliveInterval" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="SetSSHClientAliveInterval-EnterTheIntegerValue._var" export-name="oval:com.mcafee.oval:var:242741" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242737" />
          </check>
        </Rule>
        <Rule id="SetSSHClientAliveCountMax" xml:lang="en" selected="false">
          <title xml:lang="en">Set SSH ClientAliveCountMax</title>
          <description xml:lang="en">ClientAliveCountMax parameter control the timeout of ssh
            sessions. When the ClientAliveCountMax variable is set, sshd will send client alive
            messages at every ClientAliveInterval interval. Having no timeout value associated with a
            connection could allow an unauthorized user access to another user's ssh session. This
            rule verifies that the SSH ClientAliveCountMax parameter is set appropriately in
            /etc/ssh/sshd_config file.</description>
          <rationale xml:lang="en">Having no timeout value associated with a connection could allow an unauthorized user access to another user's ssh session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening..
            While the recommended setting is 300 seconds (5 minutes), set this timeout value based on site policy. The recommended setting for ClientAliveCountMax is 0. In this case, the client session will be terminated after 5 minutes of idle time and no keepalive messages will be sent.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.2.13</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01763</ident>
          <fixtext xml:lang="en" fixref="F-SetSSHClientAliveCountMax" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/ssh/sshd_config file to set the parameter as follows: ClientAliveInterval 300 ClientAliveCountMax 0</fixtext>
          <fix id="F-SetSSHClientAliveCountMax" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="SetSSHClientAliveCountMax-EnterTheIntegerValue._var" export-name="oval:com.mcafee.oval:var:242746" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:242742" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_5.3ConfigurePAM" xml:lang="en">
      <title xml:lang="en">CIS 5.3 Configure PAM</title>
      <description xml:lang="en">PAM (Pluggable Authentication Modules) is a service that implements modular authentication modules on UNIX systems. PAM is implemented as a set of shared objects
        that are loaded and executed when a program needs to authenticate a user. Files for PAM are typically located in the /etc/pam.d directory. PAM must be carefully configured to secure system authentication.</description>
      <Value id="NumberOfPasswordsToRemember_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">5</value>
      </Value>
      <Rule id="SetLockoutForFailedPasswordAttempts-pam_faillock" xml:lang="en" selected="false">
        <title xml:lang="en">Set Lockout for Failed Password Attempts - pam_faillock</title>
        <description xml:lang="en">This check ensures that the settings are appropriate for password lock out userIDs after n unsuccessful consecutive login attempts in /etc/pam.d/system-auth file.</description>
        <rationale xml:lang="en">Locking out userIDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 07604</ident>
        <fixtext xml:lang="en" fixref="F-SetLockoutForFailedPasswordAttempts-pam_faillock" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files and add the
          following pam_faillock.so lines surrounding a pam_unix.so line modify
          the pam_unix.so is [success=1 default=bad] as listed in both:
          auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900
          auth [success=1 default=bad] pam_unix.so
          auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
          auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
          Notes: authconfig may overwrite any changes made as part of this recommendation. It is advisable to maintain a backup and audit this recommendation anytime authconfig is
          used. Additional module options may be set, recommendation only covers those listed here. If a user has been locked out because they have reached the maximum consecutive failure
          count defined by deny= in the pam_faillock.so module, the user can be unlocked by issuing the command faillock -u --reset respectively. This command sets the failed count to 0, effectively unlocking the user.</fixtext>
        <fix id="F-SetLockoutForFailedPasswordAttempts-pam_faillock" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244697" />
        </check>
      </Rule>
      <Rule id="PasswordHistory_system-auth_file" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure password reuse is limited - system-auth file</title>
        <description xml:lang="en">Password reuse should be restricted by enforcing password
          history. This policy should be specified by the security policy and enforced globally.
          Default accounts, daemon accounts and the root account may have separate password
          policies.</description>
        <rationale xml:lang="en">Forcing users not to reuse their past 5 passwords make it less likely that an attacker will be able to guess the password.
          Note that these change only apply to accounts configured on the local system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08724</ident>
        <fixtext xml:lang="en" fixref="F-PasswordHistory_system-auth_file" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
          remember option and conform to site policy as shown:
          password sufficient pam_unix.so remember=5</fixtext>
        <fix id="F-PasswordHistory_system-auth_file" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="NumberOfPasswordsToRemember_var" export-name="oval:com.mcafee.oval:var:51127" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:54360" />
        </check>
      </Rule>
      <Rule id="PasswordHistory_password-auth_file" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure password reuse is limited - password-auth file</title>
        <description xml:lang="en">Password reuse should be restricted by enforcing password
          history. This policy should be specified by the security policy and enforced globally.
          Default accounts, daemon accounts and the root account may have separate password
          policies.</description>
        <rationale xml:lang="en">Forcing users not to reuse their past 5 passwords make it less likely that an attacker will be able to guess the password.
          Note that these change only apply to accounts configured on the local system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08724</ident>
        <fixtext xml:lang="en" fixref="F-PasswordHistory_password-auth_file" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
          remember option and conform to site policy as shown:
          password sufficient pam_unix.so remember=5</fixtext>
        <fix id="F-PasswordHistory_password-auth_file" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="NumberOfPasswordsToRemember_var" export-name="oval:com.mcafee.oval:var:51127" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412364" />
        </check>
      </Rule>
      <Rule id="PasswordHashingAlgorithm_system-auth_file" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure password hashing algorithm is SHA-512 in system-auth file</title>
        <description xml:lang="en">The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts 
          will need to perform a password change to upgrade the stored hashes to the new algorithm.</description>
        <rationale xml:lang="en">The SHA-512 algorithm provides much stronger hashing than MD5, thus providing additional protection to the system by increasing the level of effort for an attacker to successfully determine passwords.
          Note that these change only apply to accounts configured on the local system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08723</ident>
        <fixtext xml:lang="en" fixref="F-PasswordHashingAlgorithm_system-auth_file" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
          sha512 option for pam_unix.so as shown:
          password sufficient pam_unix.so sha512</fixtext>
        <fix id="F-PasswordHashingAlgorithm_system-auth_file" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244364" />
        </check>
      </Rule>
      <Rule id="PasswordHashingAlgorithm_password-auth_file" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure password hashing algorithm is SHA-512 in password-auth file</title>
        <description xml:lang="en">The commands below change password encryption from md5 to sha512 (a much stronger hashing algorithm). All existing accounts 
          will need to perform a password change to upgrade the stored hashes to the new algorithm.</description>
        <rationale xml:lang="en">The SHA-512 algorithm provides much stronger hashing than MD5, thus providing additional protection to the system by increasing the level of effort for an attacker to successfully determine passwords.
          Note that these change only apply to accounts configured on the local system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08723</ident>
        <fixtext xml:lang="en" fixref="F-PasswordHashingAlgorithm_password-auth_file" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
          sha512 option for pam_unix.so as shown:
          password sufficient pam_unix.so sha512</fixtext>
        <fix id="F-PasswordHashingAlgorithm_password-auth_file" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:1412365" />
        </check>
      </Rule>
      <Group id="CIS_5.3.1SetPasswordCreationRequirementParametersUsingPam_cracklib" xml:lang="en">
        <title xml:lang="en">CIS 5.3.1 Set Password Creation Requirement Parameters Using pam_cracklib</title>
        <description xml:lang="en">The pam_cracklib module checks of the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain
        length, contains a mix of characters (e.g. alphabet, numeric, other) and more.</description>
        <Value id="WhatIsTheMinimumPasswordLength_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">14</value>
        </Value>
        <Value id="TheNumberOfNumericCharactersRequiredByThePolicy_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">-1</value>
        </Value>
        <Value id="TheNumberOfOtherCharactersRequiredByThePolicy_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">-1</value>
        </Value>
        <Value id="TheNumberOfUpperCaseCharactersRequiredByThePolicy_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">-1</value>
        </Value>
        <Value id="TheNumberOfLowecaseCharactersRequiredByThePolicy_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">-1</value>
        </Value>
        <Value id="WhatIsTheMaximumNumberTimesTheUserMustBePromptedBeforeReturningTheError._var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">3</value>
        </Value>
        <Rule id="Pam_cracklib_system-auth_file-Minlen" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - minlen</title>
          <description xml:lang="en">This check verifies if the minimum password length on the
            system matches with what is expected by the user.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-Minlen" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-Minlen" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheMinimumPasswordLength_var" export-name="oval:com.mcafee.oval:var:79420" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244412" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-Minlen" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - minlen</title>
          <description xml:lang="en">This check verifies if the minimum password length on the
            system matches with what is expected by the user.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-Minlen" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-Minlen" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheMinimumPasswordLength_var" export-name="oval:com.mcafee.oval:var:79420" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412357" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_system-auth_file-dcredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - dcredit</title>
          <description xml:lang="en">Password policy should specify a minimum number of numeric
            characters and all systems should enforce this policy. There may be separate policies for
            daemon accounts, default accounts and the root account.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-dcredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-dcredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfNumericCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:223145" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:54325" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-dcredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - dcredit</title>
          <description xml:lang="en">Password policy should specify a minimum number of numeric
            characters and all systems should enforce this policy. There may be separate policies for
            daemon accounts, default accounts and the root account.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-dcredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-dcredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfNumericCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:223145" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412358" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_system-auth_file-Ocredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - ocredit</title>
          <description xml:lang="en">This check ensured that the password contains at least one
            special character.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-Ocredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-Ocredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfOtherCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:79441" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:6801" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-Ocredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - ocredit</title>
          <description xml:lang="en">This check ensured that the password contains at least one
            special character.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-Ocredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-Ocredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfOtherCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:79441" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412359" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_system-auth_file-Ucredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - ucredit</title>
          <description xml:lang="en">Password policy should specify a minimum number of upper case
          characters and all systems should enforce this policy. There may be separate policies for
          daemon accounts, default accounts and the root account.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-Ucredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-Ucredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfUpperCaseCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:51078" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:51110" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-Ucredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - ucredit</title>
          <description xml:lang="en">Password policy should specify a minimum number of upper case
            characters and all systems should enforce this policy. There may be separate policies for
            daemon accounts, default accounts and the root account.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-Ucredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-Ucredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfUpperCaseCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:51078" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412360" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_system-auth_file-Lcredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - lcredit</title>
          <description xml:lang="en">This check ensured that the password contains at least one
            lowercase character.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-Lcredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-Lcredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfLowecaseCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:240800" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244653" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-Lcredit" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - lcredit</title>
          <description xml:lang="en">This check ensured that the password contains at least one
            lowercase character.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-Lcredit" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-Lcredit" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="TheNumberOfLowecaseCharactersRequiredByThePolicy_var" export-name="oval:com.mcafee.oval:var:240800" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412361" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_system-auth_file-Retry" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - retry</title>
          <description xml:lang="en">This check verifies if the password retry parameter is set as
          per the user input. It is the maximum number of times the user needs to be prompted
          before returning with error.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-Retry" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-Retry" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheMaximumNumberTimesTheUserMustBePromptedBeforeReturningTheError._var" export-name="oval:com.mcafee.oval:var:244432" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244428" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-Retry" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - retry</title>
          <description xml:lang="en">This check verifies if the password retry parameter is set as
            per the user input. It is the maximum number of times the user needs to be prompted
            before returning with error.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-Retry" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-Retry" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheMaximumNumberTimesTheUserMustBePromptedBeforeReturningTheError._var" export-name="oval:com.mcafee.oval:var:244432" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412362" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_system-auth_file-Try_first_pass" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in system-auth file - try_first_pass</title>
          <description xml:lang="en">This check verifies if the retrieve password from a previous
          stacked PAM module option is been set. If this is not available, then it would prompt the
          user for a password.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_system-auth_file-Try_first_pass" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_system-auth_file-Try_first_pass" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:244422" />
          </check>
        </Rule>
        <Rule id="Pam_cracklib_password-auth_file-Try_first_pass" xml:lang="en" selected="false">
          <title xml:lang="en">Ensure password creation requirements are configured in pam_cracklib.so module in password-auth file - try_first_pass</title>
          <description xml:lang="en">This check verifies if the retrieve password from a previous
            stacked PAM module option is been set. If this is not available, then it would prompt the
            user for a password.</description>
          <rationale xml:lang="en">Strong passwords protect systems from being hacked through brute force methods.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.3.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09953</ident>
          <fixtext xml:lang="en" fixref="F-Pam_cracklib_password-auth_file-Try_first_pass" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/pam.d/password-auth and /etc/pam.d/system-auth files to include the
            appropriate options for pam_cracklib.so and to conform to site policy:
            password requisite pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1
            ucredit=-1 ocredit=-1 lcredit=-1</fixtext>
          <fix id="F-Pam_cracklib_password-auth_file-Try_first_pass" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412363" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_5.4UserAccountsAndEnvironment" xml:lang="en">
      <title xml:lang="en">CIS 5.4 User Accounts and Environment</title>
      <description xml:lang="en">This section provides guidance on setting up secure defaults for system and user accounts and their environment.</description>
      <Rule id="DisableSystemAccounts" xml:lang="en" selected="false">
        <title xml:lang="en">Disable System Accounts</title>
        <description xml:lang="en">This script verifies for those accounts that have been locked are prohibited from running commands on the system.</description>
        <rationale xml:lang="en">It is important to make sure that accounts that are not being used by regular users are locked to prevent them from being used to provide an interactive shell. 
          By default, Red Hat sets the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to /sbin/nologin. This prevents the account from potentially being used to run any commands.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09954</ident>
        <fixtext xml:lang="en" fixref="F-DisableSystemAccounts" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the shell for any accounts returned by the audit script to /sbin/nologin:
          # usermod -s /sbin/nologin 'user'
            The following script will automatically set all user shells required to /sbin/nologin and
            lock the sync, shutdown, and halt users:
            #!/bin/bash
            for user in `awk -F: '($3 &lt; 500) {print $1 }' /etc/passwd`; do
            if [ $user != "root" ]; then
            usermod -L $user
            if [ $user != "sync" ] &amp;&amp; [ $user != "shutdown" ] &amp;&amp; [ $user != "halt" ]; then
            usermod -s /sbin/nologin $user
            fi
            fi
            done</fixtext>
        <fix id="F-DisableSystemAccounts" />
        <check system="http://www.mcafee.com/xccdf/script/1.0">
          <check-content>/bin/sh
30
            #!/bin/sh
            cmd_output=`egrep -v "^\+" /etc/passwd | awk -F: '($1!="root" &amp;&amp; $1!="sync" &amp;&amp; $1!="shutdown" &amp;&amp; $1!="halt" &amp;&amp; $3&lt;500 &amp;&amp; $7!="/sbin/nologin") {print}'`
            
            if [ -n "$cmd_output" ]
            then
            exit 1
            fi</check-content>
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheAccount-Root" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the account - root</title>
        <description xml:lang="en">This check verifies if the group owner of the root account is
          set as per the user input.</description>
        <rationale xml:lang="en">Using GID 0 for the root account helps prevent root-owned files from accidentally becoming accessible to non-privileged users.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01586</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheAccount-Root" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set the root user default group to GID 0:
          # usermod -g 0 root</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheAccount-Root" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDForTheRootAccount_var" export-name="oval:com.mcafee.oval:var:231047" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:230890" />
        </check>
      </Rule>
      <Group id="CIS_5.4.1SetShadowPasswordSuiteParameters" xml:lang="en">
        <title xml:lang="en">5.4.1 Set Shadow Password Suite Parameters</title>
        <description xml:lang="en">While a majority of the password control parameters have been moved to PAM, some parameters are still available through the shadow password suite. Any changes made to
          /etc/login.defs will only be applied if the usermod command is used. If user IDs are added a different way, use the chage command to effect changes to individual user IDs.</description>
        <Value id="WhatIsTheMaximumPasswordAge_inDays__var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">90</value>
        </Value>
        <Value id="WhatIsTheMinimumPasswordAge_inDays__var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">7</value>
        </Value>
        <Value id="WhatIsTheExpectedPasswordWarningValue_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">7</value>
        </Value>
        <Value id="WhatIsTheDurationForInactiveUserAccountsLockOut_inDays__var0" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">30</value>
        </Value>
        <Value id="WhatIsTheRequiredGroupIDForTheRootAccount_var" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">0</value>
        </Value>
        <Rule id="SetPasswordExpirationDays" xml:lang="en" selected="false">
          <title xml:lang="en">Set Password Expiration Days</title>
          <description xml:lang="en">The PASS_MAX_DAYS parameter in /etc/login.defs allows an
            administrator to force passwords to expire once they reach a defined age. This rule ensures
            that the maximum expiration days for password is set appropriately in
            /etc/login.defs.</description>
          <rationale xml:lang="en">The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute force attack is limited by the age of the password. 
            Therefore, reducing the maximum age of a password also reduces an attacker's window of opportunity.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.1.1</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 08576</ident>
          <fixtext xml:lang="en" fixref="F-SetPasswordExpirationDays" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the PASS_MAX_DAYS parameter to 90 in /etc/login.defs: PASS_MAX_DAYS 90
            Modify active user parameters to match: # chage --maxdays 90 'user'</fixtext>
          <fix id="F-SetPasswordExpirationDays" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheMaximumPasswordAge_inDays__var" export-name="oval:com.mcafee.oval:var:79418" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7199" />
          </check>
        </Rule>
        <Rule id="SetPasswordChangeMinimumNumberOfDays" xml:lang="en" selected="false">
          <title xml:lang="en">Set Password Change Minimum Number of Days</title>
          <description xml:lang="en">The PASS_MIN_DAYS parameter in /etc/login.defs allows an
            administrator to prevent users from changing their password until a minimum number of days
            have passed since the last time the user changed their password. This rule ensures that the
            PASS_MIN_DAYS parameter is set appropriately in /etc/login.defs</description>
          <rationale xml:lang="en">By restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an attempt to circumvent password reuse controls.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.1.2</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01703</ident>
          <fixtext xml:lang="en" fixref="F-SetPasswordChangeMinimumNumberOfDays" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the PASS_MIN_DAYS parameter to 7 in /etc/login.defs: PASS_MIN_DAYS 7
            Modify active user parameters to match: # chage --mindays 7 'user'</fixtext>
          <fix id="F-SetPasswordChangeMinimumNumberOfDays" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheMinimumPasswordAge_inDays__var" export-name="oval:com.mcafee.oval:var:79419" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:7203" />
          </check>
        </Rule>
        <Rule id="SetPasswordExpiringWarningDays" xml:lang="en" selected="false">
          <title xml:lang="en">Set Password Expiring Warning Days</title>
          <description xml:lang="en">The PASS_WARN_AGE parameter in /etc/login.defs allows an
            administrator to notify users that their password will expire in a defined number of days.
            This rule ensures that the PASS_WARN_AGE parameter is set appropriately in
            /etc/login.defs.</description>
          <rationale xml:lang="en">Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.1.3</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01745</ident>
          <fixtext xml:lang="en" fixref="F-SetPasswordExpiringWarningDays" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Set the PASS_WARN_AGE parameter to 7 in /etc/login.defs: PASS_WARN_AGE 7
            Modify active user parameters to match: # chage --warndays 7 'user'</fixtext>
          <fix id="F-SetPasswordExpiringWarningDays" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheExpectedPasswordWarningValue_var" export-name="oval:com.mcafee.oval:var:79421" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:200803070538" />
          </check>
        </Rule>
        <Rule id="TestTheConfigurationStatusFor-DurationOfInactiveUserAccountsLock" xml:lang="en" selected="false">
          <title xml:lang="en">Test the configuration status for - duration of inactive user accounts lock</title>
          <description xml:lang="en">This check verifies if duration of inactive user accounts lock
            out is set appropriately in /etc/default/useradd file. Inactive accounts pose a threat to
            system security since the users are not logging in to notice failed login attempts or other
            anomalies.</description>
          <rationale xml:lang="en">Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.1.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09921</ident>
          <fixtext xml:lang="en" fixref="F-TestTheConfigurationStatusFor-DurationOfInactiveUserAccountsLock" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set the default password inactivity period to 30 days:
            # useradd -D -f 30
            Modify user parameters for all users with a password set to match:
            # chage --inactive 30 'user'</fixtext>
          <fix id="F-TestTheConfigurationStatusFor-DurationOfInactiveUserAccountsLock" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatIsTheDurationForInactiveUserAccountsLockOut_inDays__var0" export-name="oval:com.mcafee.oval:var:232497" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:1412352" />
          </check>
        </Rule>
      </Group>
      <Group id="CIS_5.4.4DefaultUserUmask" xml:lang="en">
        <title xml:lang="en">CIS 5.4.4 Default User Umask</title>
        <Value id="WhatShouldBeTheUmaskValue_var8" xml:lang="en" type="string" operator="equals" interactive="false">
          <value selector="">027</value>
        </Value>
        <Rule id="DefaultUserUmask-Etc_bashrc" xml:lang="en" selected="false">
          <title xml:lang="en">Default User Umask - /etc/bashrc</title>
          <description xml:lang="en">This check verifies very secure default value for umask - /etc/bashrc.</description>
          <rationale xml:lang="en">Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions. A default umask setting of 077 causes files and directories
            created by users to not be readable by any other user on the system. A umask of 027 would make files and directories readable by users in the same Unix group, while a umask of 022
            would make files readable by every user on the system.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01591</ident>
          <fixtext xml:lang="en" fixref="F-DefaultUserUmask-Etc_bashrc" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/bashrc and /etc/profile files (and the appropriate files for any other shell
            supported on your system) and add or edit any umask parameters as follows:
            umask 027</fixtext>
          <fix id="F-DefaultUserUmask-Etc_bashrc" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatShouldBeTheUmaskValue_var8" export-name="oval:com.mcafee.oval:var:98454" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:919577" />
          </check>
        </Rule>
        <Rule id="DefaultUserUmask-Etc_profile" xml:lang="en" selected="false">
          <title xml:lang="en">Default User Umask - /etc/profile</title>
          <description xml:lang="en">This check verifies very secure default value for umask - /etc/profile.</description>
          <rationale xml:lang="en">Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions. A default umask setting of 077 causes files and directories
            created by users to not be readable by any other user on the system. A umask of 027 would make files and directories readable by users in the same Unix group, while a umask of 022
            would make files readable by every user on the system.</rationale>
          <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.4.4</ident>
          <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01591</ident>
          <fixtext xml:lang="en" fixref="F-DefaultUserUmask-Etc_profile" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Edit the /etc/bashrc and /etc/profile files (and the appropriate files for any other shell
            supported on your system) and add or edit any umask parameters as follows:
            umask 027</fixtext>
          <fix id="F-DefaultUserUmask-Etc_profile" />
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export value-id="WhatShouldBeTheUmaskValue_var8" export-name="oval:com.mcafee.oval:var:98454" />
            <check-content-ref href="" name="oval:com.mcafee.oval:def:238333" />
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="CIS_5.6RestrictAccessToTheSu" xml:lang="en">
      <title xml:lang="en">CIS 5.6 Restrict Access to the su</title>
      <Rule id="LimitAccessToTheRootAccountFromSu" xml:lang="en" selected="false">
        <title xml:lang="en">Limit access to the root account from su</title>
        <description xml:lang="en">This check verifies for the pam_wheel.so statement in
          /etc/pam.d/su file. By uncommenting the pam_wheel.so statement in /etc/pam.d/su, the su
          command will only allow users in the wheel group to execute su.</description>
        <rationale xml:lang="en">Restricting the use of su, and using sudo in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. 
          The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via sudo, whereas su can only record that a user executed the su program.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01595</ident>
        <fixtext xml:lang="en" fixref="F-LimitAccessToTheRootAccountFromSu" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/pam.d/su file:
          auth required pam_wheel.so use_uid
          Create a comma separated list of users in the wheel statement in the /etc/group file:
          wheel:x:10:root,'user list'</fixtext>
        <fix id="F-LimitAccessToTheRootAccountFromSu" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:50114" />
        </check>
      </Rule>
      <Rule id="RestrictAccessToTheSuCommand-UsersListInTheWheelStatement-_Etc_group" xml:lang="en" selected="false">
        <title xml:lang="en">Restrict Access to the su Command - Users list in the wheel statement
          - /etc/group</title>
        <description xml:lang="en">This check verifies for the comma separated list of users in the
          wheel statement in the /etc/group file.</description>
        <rationale xml:lang="en">Restricting the use of su, and using sudo in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. 
          The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via sudo, whereas su can only record that a user executed the su program.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">5.6</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01595</ident>
        <fixtext xml:lang="en" fixref="F-RestrictAccessToTheSuCommand-UsersListInTheWheelStatement-_Etc_group" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Add the following line to the /etc/pam.d/su file:
          auth required pam_wheel.so use_uid
          Create a comma separated list of users in the wheel statement in the /etc/group file:
          wheel:x:10:root,'user list'</fixtext>
        <fix id="F-RestrictAccessToTheSuCommand-UsersListInTheWheelStatement-_Etc_group" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:244738" />
        </check>
      </Rule>
    </Group>
  </Group>
  <Group id="CIS_6SystemMaintenance" xml:lang="en">
    <title xml:lang="en">CIS 6 System Maintenance</title>
    <description xml:lang="en">Recommendations in this section are intended as maintenance and are intended to be checked on a frequent basis to ensure system stability. Many recommendations do not
      have quick remediations and require investigation into the cause and best fix available and may indicate an attempted breach of system security.</description>
    <Group id="CIS_6.1SystemFilePermissions" xml:lang="en">
      <title xml:lang="en">CIS 6.1 System File Permissions</title>
      <description xml:lang="en">This section provides guidance on securing aspects of system files and directories.</description>
      <Value id="ShouldOthersHaveWRITEAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccessShadow_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwnerShadow_var3" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwnerShadow_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var4" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwner_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwner_var5" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccessPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwnerPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwnerPasswd-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccessShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwnerShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwnerShadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccessgroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwnergroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwnergroup-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccessgshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredUserIDOfTheFileOwnergshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="WhatIsTheRequiredGroupIDOfTheFileOwnergshadow-_var" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Rule id="TestThePermissionsOfTheFile-_Etc_passwd" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/passwd</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/passwd
          file are set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/passwd file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05326</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05498</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_passwd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/passwd:
          # chown root:root /etc/passwd
          # chmod 644 /etc/passwd</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_passwd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var3" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var3" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var3" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var3" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var3" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var3" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var3" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var3" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var3" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:6922" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_passwd" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/passwd</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/passwd
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/passwd file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05326</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05498</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_passwd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/passwd:
          # chown root:root /etc/passwd
          # chmod 644 /etc/passwd</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_passwd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var3" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290144" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfTheFile-_Etc_passwd" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the file - /etc/passwd</title>
        <description xml:lang="en">This ensures that the owner of the file /etc/passwd is set
          appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/passwd file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05326</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05498</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_passwd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/passwd:
          # chown root:root /etc/passwd
          # chmod 644 /etc/passwd</fixtext>
        <fix id="F-TestTheOwnerOfTheFile-_Etc_passwd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var3" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250144" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_shadow" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/shadow</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/shadow
          are set appropriately as per the user input.</description>
        <rationale xml:lang="en">If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert the user accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05326</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05502</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_shadow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/shadow:
          # chown root:root /etc/shadow
          # chmod 000 /etc/shadow</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_shadow" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccessShadow_var5" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:6946" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfTheFile-_Etc_shadow" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the file - /etc/shadow</title>
        <description xml:lang="en">This ensures that the owner of the file /etc/shadow is set
          appropriately as per the user input.</description>
        <rationale xml:lang="en">If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert the user accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05326</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05502</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_shadow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/shadow:
          # chown root:root /etc/shadow
          # chmod 000 /etc/shadow</fixtext>
        <fix id="F-TestTheOwnerOfTheFile-_Etc_shadow" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwnerShadow_var3" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250160" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_shadow" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/shadow</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/shadow
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert the user accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05326</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05502</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_shadow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following commands to set permissions on /etc/shadow:
          # chown root:root /etc/shadow
          # chmod 000 /etc/shadow</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_shadow" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwnerShadow_var4" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290140" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_group" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/group</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/group
          are set appropriately as per the user input.</description>
        <rationale xml:lang="en">The /etc/group file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05349</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05454</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_group" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">If the permissions of the /etc/group file are incorrect, run the following command to correct them: # /bin/chmod 644 /etc/group</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_group" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var5" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var5" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var5" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var5" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var5" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var5" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var5" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var5" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var5" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:6898" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_group" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/group</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/group is
          set appropriately as per the user input.</description>
        <rationale xml:lang="en">The /etc/group file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05349</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05454</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_group" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">If the ownership of the /etc/group file are incorrect, run the following command to correct them: # /bin/chown root:root /etc/group</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_group" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var5" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290128" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfTheFile-_Etc_group" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the file - /etc/group</title>
        <description xml:lang="en">This rule ensures that the owner of the file /etc/group is set
          appropriately as per the user input.</description>
        <rationale xml:lang="en">The /etc/group file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05349</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05454</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfTheFile-_Etc_group" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">If the ownership of the /etc/group file are incorrect, run the following command to correct them: # /bin/chown root:root /etc/group</fixtext>
        <fix id="F-TestTheOwnerOfTheFile-_Etc_group" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var5" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250132" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_gshadow" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/gshadow</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/gshadow
          are set appropriately as per the user input.</description>
        <rationale xml:lang="en">If attackers can gain read access to the /etc/gshadow file, they can easily run a password cracking program against the hashed password to break it. 
          Other security information that is stored in the /etc/gshadow file (such as expiration) could also be useful to subvert the group accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05350</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05486</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_gshadow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following chown to set permissions on /etc/gshadow:
          # chown root:root /etc/gshadow
          # chmod 000 /etc/gshadow</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_gshadow" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var4" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var4" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var4" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var4" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var4" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var4" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var4" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var4" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var4" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:6910" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_gshadow" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/gshadow</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/gshadow
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">If attackers can gain read access to the /etc/gshadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/gshadow file (such as expiration) could also be useful to subvert the group accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05350</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05486</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_gshadow" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following chown to set permissions on /etc/gshadow:
          # chown root:root /etc/gshadow
          # chmod 000 /etc/gshadow</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_gshadow" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwner_var4" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802290148" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfThe_Etc_gshadowFile" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the /etc/gshadow file</title>
        <description xml:lang="en">This rule ensures that the owner of the file /etc/gshadow file
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">If attackers can gain read access to the /etc/gshadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/gshadow file (such as expiration) could also be useful to subvert the group accounts.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05350</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05486</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfThe_Etc_gshadowFile" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following chown to set permissions on /etc/gshadow:
          # chown root:root /etc/gshadow
          # chmod 000 /etc/gshadow</fixtext>
        <fix id="F-TestTheOwnerOfThe_Etc_gshadowFile" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwner_var4" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:200802250140" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_passwd-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/passwd-</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/passwd- are set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/passwd- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.6</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_passwd-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/passwd-:
          # chown root:root /etc/passwd-
          # chmod 600 /etc/passwd-</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_passwd-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccessPasswd-_var" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487762" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_passwd-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/passwd-</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/passwd-
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/passwd- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.6</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_passwd-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/passwd-:
          # chown root:root /etc/passwd-
          # chmod 600 /etc/passwd-</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_passwd-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwnerPasswd-_var" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487763" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfThe_Etc_passwd-File" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the /etc/passwd- file</title>
        <description xml:lang="en">This rule ensures that the owner of the file /etc/passwd- file
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/passwd- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.6</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfThe_Etc_passwd-File" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/passwd-:
          # chown root:root /etc/passwd-
          # chmod 600 /etc/passwd-</fixtext>
        <fix id="F-TestTheOwnerOfThe_Etc_passwd-File" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwnerPasswd-_var" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487761" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_shadow-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/shadow-</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/shadow- are set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/shadow- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.7</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_shadow-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/shadow-:
          # chown root:root /etc/shadow-
          # chmod 600 /etc/shadow-</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_shadow-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccessShadow-_var" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487772" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_shadow-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/shadow-</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/shadow-
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/shadow- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.7</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_shadow-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/shadow-:
          # chown root:root /etc/shadow-
          # chmod 600 /etc/shadow-</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_shadow-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwnerShadow-_var" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487770" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfThe_Etc_shadow-File" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the /etc/shadow- file</title>
        <description xml:lang="en">This rule ensures that the owner of the file /etc/shadow- file
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/shadow- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.7</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfThe_Etc_shadow-File" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/shadow-:
          # chown root:root /etc/shadow-
          # chmod 600 /etc/shadow-</fixtext>
        <fix id="F-TestTheOwnerOfThe_Etc_shadow-File" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwnerShadow-_var" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487771" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_group-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/group-</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/group- are set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/group- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.8</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_group-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/group-:
          # chown root:root /etc/group-
          # chmod 600 /etc/group-</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_group-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccessgroup-_var" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487780" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_group-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/group-</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/group-
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/group- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.8</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_group-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/group-:
          # chown root:root /etc/group-
          # chmod 600 /etc/group-</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_group-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwnergroup-_var" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487778" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfThe_Etc_group-File" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the /etc/group- file</title>
        <description xml:lang="en">This rule ensures that the owner of the file /etc/group- file
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/group- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.8</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfThe_Etc_group-File" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/group-:
          # chown root:root /etc/group-
          # chmod 600 /etc/group-</fixtext>
        <fix id="F-TestTheOwnerOfThe_Etc_group-File" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwnergroup-_var" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487779" />
        </check>
      </Rule>
      <Rule id="TestThePermissionsOfTheFile-_Etc_gshadow-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the permissions of the file - /etc/gshadow-</title>
        <description xml:lang="en">This rule ensures that the permissions of the file /etc/gshadow- are set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/gshadow- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.9</ident>
        <fixtext xml:lang="en" fixref="F-TestThePermissionsOfTheFile-_Etc_gshadow-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/gshadow-:
          # chown root:root /etc/gshadow-
          # chmod 600 /etc/gshadow-</fixtext>
        <fix id="F-TestThePermissionsOfTheFile-_Etc_gshadow-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccessgshadow-_var" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487786" />
        </check>
      </Rule>
      <Rule id="TestTheGroupOwnerOfTheFile-_Etc_gshadow-" xml:lang="en" selected="false">
        <title xml:lang="en">Test the group owner of the file - /etc/gshadow-</title>
        <description xml:lang="en">This rule ensures that the group owner of the file /etc/gshadow-
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/gshadow- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.9</ident>
        <fixtext xml:lang="en" fixref="F-TestTheGroupOwnerOfTheFile-_Etc_gshadow-" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/gshadow-:
          # chown root:root /etc/gshadow-
          # chmod 600 /etc/gshadow-</fixtext>
        <fix id="F-TestTheGroupOwnerOfTheFile-_Etc_gshadow-" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredGroupIDOfTheFileOwnergshadow-_var" export-name="oval:com.mcafee.oval:var:80125" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487787" />
        </check>
      </Rule>
      <Rule id="TestTheOwnerOfThe_Etc_gshadow-File" xml:lang="en" selected="false">
        <title xml:lang="en">Test the owner of the /etc/gshadow- file</title>
        <description xml:lang="en">This rule ensures that the owner of the file /etc/gshadow- file
          is set appropriately as per the user input.</description>
        <rationale xml:lang="en">It is critical to ensure that the /etc/gshadow- file is protected from unauthorized access. Although it is protected by default, the file 
          permissions could be changed either inadvertently or through malicious actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.1.9</ident>
        <fixtext xml:lang="en" fixref="F-TestTheOwnerOfThe_Etc_gshadow-File" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Run the following command to set permissions on /etc/gshadow-:
          # chown root:root /etc/gshadow-
          # chmod 600 /etc/gshadow-</fixtext>
        <fix id="F-TestTheOwnerOfThe_Etc_gshadow-File" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="WhatIsTheRequiredUserIDOfTheFileOwnergshadow-_var" export-name="oval:com.mcafee.oval:var:80228" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:2487788" />
        </check>
      </Rule>
    </Group>
    <Group id="CIS_6.2UserAndGroupSettings" xml:lang="en">
      <title xml:lang="en">CIS 6.2 User and Group Settings</title>
      <description xml:lang="en">This section provides guidance on securing aspects of the users and groups.</description>
      <Value id="ShouldOthersHaveWRITEAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var17" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var18" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveWRITEAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveEXECUTEAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldOthersHaveREADAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheUserHaveEXECUTEAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveREADAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheUserHaveWRITEAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveWRITEAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">0</value>
      </Value>
      <Value id="ShouldTheGroupHaveREADAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Value id="ShouldTheGroupHaveEXECUTEAccess_var14" xml:lang="en" type="string" operator="equals" interactive="false">
        <value selector="">1</value>
      </Value>
      <Rule id="EnsurePasswordFieldsAreNotEmpty" xml:lang="en" selected="false">
        <title xml:lang="en">Ensure Password Fields are Not Empty</title>
        <description xml:lang="en">This check ensures that there are no user accounts with empty
          password fields.</description>
        <rationale xml:lang="en">All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.1</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01579</ident>
        <fixtext xml:lang="en" fixref="F-EnsurePasswordFieldsAreNotEmpty" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">If any accounts in the /etc/shadow file do not have a password, run the following
          command to lock the account until it can be determined why it does not have a password:
          # passwd -l 'username'
            Also, check to see if the account is logged in and investigate what it is being used for to
            determine if it needs to be forced off.</fixtext>
        <fix id="F-EnsurePasswordFieldsAreNotEmpty" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:238498" />
        </check>
      </Rule>
      <Rule id="VerifyNoLegacy___EntriesExistIn_Etc_passwdFile" xml:lang="en" selected="false">
        <title xml:lang="en">Verify No Legacy "+" Entries Exist in /etc/passwd File</title>
        <description xml:lang="en">This check will verify if the Access control files contain a
          plus sign (+) - /etc/passwd</description>
        <rationale xml:lang="en">These entries may provide an avenue for attackers to gain privileged access on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.2</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01584</ident>
        <fixtext xml:lang="en" fixref="F-VerifyNoLegacy___EntriesExistIn_Etc_passwdFile" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Remove any legacy '+' entries from /etc/passwd if they exist.</fixtext>
        <fix id="F-VerifyNoLegacy___EntriesExistIn_Etc_passwdFile" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:50674" />
        </check>
      </Rule>
      <Rule id="VerifyNoLegacy___EntriesExistIn_Etc_shadowFile" xml:lang="en" selected="false">
        <title xml:lang="en">Verify No Legacy "+" Entries Exist in /etc/shadow File</title>
        <description xml:lang="en">This check will verify if the Access control files contain a
          plus sign (+) - /etc/shadow.</description>
        <rationale xml:lang="en">These entries may provide an avenue for attackers to gain privileged access on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.3</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01584</ident>
        <fixtext xml:lang="en" fixref="F-VerifyNoLegacy___EntriesExistIn_Etc_shadowFile" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Remove any legacy '+' entries from /etc/shadow if they exist.</fixtext>
        <fix id="F-VerifyNoLegacy___EntriesExistIn_Etc_shadowFile" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:50671" />
        </check>
      </Rule>
      <Rule id="VerifyNoLegacy___EntriesExistIn_Etc_groupFile" xml:lang="en" selected="false">
        <title xml:lang="en">Verify No Legacy "+" Entries Exist in /etc/group File</title>
        <description xml:lang="en">This check will verify if the Access control files contain a
          plus sign (+) - /etc/group.</description>
        <rationale xml:lang="en">These entries may provide an avenue for attackers to gain privileged access on the system.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.4</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01584</ident>
        <fixtext xml:lang="en" fixref="F-VerifyNoLegacy___EntriesExistIn_Etc_groupFile" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Remove any legacy '+' entries from /etc/group if they exist.</fixtext>
        <fix id="F-VerifyNoLegacy___EntriesExistIn_Etc_groupFile" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:50676" />
        </check>
      </Rule>
      <Rule id="VerifyNoUID0AccountsExistOtherThanRoot" xml:lang="en" selected="false">
        <title xml:lang="en">Verify No UID 0 Accounts Exist Other Than root</title>
        <description xml:lang="en">This check verifies if root account is the only account with UID
          zero. This also ensures that non-root users have UID other than 0.</description>
        <rationale xml:lang="en">This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged account using an approved
          mechanism as noted in Item 5.6 Ensure access to the su command is restricted.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.5</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 00558</ident>
        <fixtext xml:lang="en" fixref="F-VerifyNoUID0AccountsExistOtherThanRoot" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Remove any users other than root with UID 0 or assign them a new UID if appropriate.</fixtext>
        <fix id="F-VerifyNoUID0AccountsExistOtherThanRoot" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:6835" />
        </check>
      </Rule>
      <Rule id="CheckThatUsersAreAssignedHomeDirectories" xml:lang="en" selected="false">
        <title xml:lang="en">Check That Users Are Assigned Valid Home Directories</title>
        <description xml:lang="en">This checks verifies that all the non-system accounts have home
          directories defined and they exist on the system.</description>
        <rationale xml:lang="en">If the user's home directory does not exist or is unassigned, the user will be placed in "/" and will not be able to write any files or have local environment variables set.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.7</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06018</ident>
        <fixtext xml:lang="en" fixref="F-CheckThatUsersAreAssignedHomeDirectories" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">If any users' home directories do not exist, create them and make sure the respective user owns the directory. 
          Users without an assigned home directory should be removed or assigned a home directory as appropriate.</fixtext>
        <fix id="F-CheckThatUsersAreAssignedHomeDirectories" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:246577" />
        </check>
      </Rule>
      <Rule id="CheckPermissionsOnUserHomeDirectories" xml:lang="en" selected="false">
        <title xml:lang="en">Check Permissions on User Home Directories</title>
        <description xml:lang="en">This checks verifies the file permissions of all the user home directories of all the accounts other than root, sync, shutdown and halt and also home directories of the accounts whose login shell is not equal to /sbin/nologin.</description>
        <rationale xml:lang="en">Group or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.8</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06019</ident>
        <fixtext xml:lang="en" fixref="F-CheckPermissionsOnUserHomeDirectories" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Making global modifications to user home directories without alerting the user community can result in unexpected outages and unhappy users. 
          Therefore, it is recommended that a monitoring policy be established to report user file permissions and determine the action to be taken in accordance with site policy.</fixtext>
        <fix id="F-CheckPermissionsOnUserHomeDirectories" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var14" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var14" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var14" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var14" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var14" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var14" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var14" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var14" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var14" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:405194" />
        </check>
      </Rule>
      <Rule id="CheckUserHomeDirectoryOwnership" xml:lang="en" selected="false">
        <title xml:lang="en">Check User Home Directory Ownership</title>
        <description xml:lang="en">The user home directory is space defined for the particular user
          to set local environment variables and to store personal files. Since the user is
          accountable for files stored in the user home directory, the user must be the owner of the
          directory.</description>
        <rationale xml:lang="en">Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.9</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06021</ident>
        <fixtext xml:lang="en" fixref="F-CheckUserHomeDirectoryOwnership" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Change the ownership any home directories that are not owned by the defined user to the correct user.</fixtext>
        <fix id="F-CheckUserHomeDirectoryOwnership" />
        <check system="http://www.mcafee.com/xccdf/script/1.0">
          <check-content>/bin/sh
30
            #!/bin/sh
            cat /etc/passwd | awk -F: '{ print $1 " " $3 " " $6 }' | \
            while read user uid dir; do
            if [ $uid -ge 500 -a -d "$dir" -a $user != "nfsnobody" ]; then
            owner=$(stat -L -c "%U" "$dir")
            if [ "$owner" != "$user" ];	then
            #echo "The home directory ($dir) of user $user is owned by $owner."
            exit 1;
            fi
            fi
            done</check-content>
        </check>
      </Rule>
      <Rule id="CheckUserDotFilePermissions" xml:lang="en" selected="false">
        <title xml:lang="en">Check User Dot File Permissions</title>
        <description xml:lang="en">This checks verifies the file permissions of all the netrc files
        in the home directories of all the accounts other than root, sync, shutdown and halt and
        home directories of the accounts whose login shell is not equal to
        /sbin/nologin.</description>
        <rationale xml:lang="en">Group or world-writable user configuration files may enable malicious users to steal or modify other users' data or to gain another user's system privileges.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.10</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01589</ident>
        <fixtext xml:lang="en" fixref="F-CheckUserDotFilePermissions" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. 
          Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken in accordance with site policy.</fixtext>
        <fix id="F-CheckUserDotFilePermissions" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var17" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var17" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var17" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var17" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var17" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var17" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var17" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var17" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var17" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:246602" />
        </check>
      </Rule>
      <Rule id="CheckForPresenceOfUser.forwardFiles" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Presence of User .forward Files</title>
        <description xml:lang="en">This check ensures that dot-forward (.forward) files does not
          exist in any users home directories.</description>
        <rationale xml:lang="en">Use of the .forward file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. 
          The .forward file also poses a risk as it can be used to execute commands that may perform unintended actions.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.11</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09957</ident>
        <fixtext xml:lang="en" fixref="F-CheckForPresenceOfUser.forwardFiles" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. 
          Therefore, it is recommended that a monitoring policy be established to report user .forward files and determine the action to be taken in accordance with site policy.</fixtext>
        <fix id="F-CheckForPresenceOfUser.forwardFiles" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:246548" />
        </check>
      </Rule>
      <Rule id="CheckForPresenceOfUser.netrcFiles" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Presence of User .netrc Files</title>
        <description xml:lang="en">This check ensures that dot-netrc (.netrc) files does not exist
          in any users home directories.</description>
        <rationale xml:lang="en">The .netrc file presents a significant security risk since it stores passwords in unencrypted form. Even if FTP is disabled, user accounts may have brought over .netrc files from other systems which could pose a risk to those systems.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.12</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 01590</ident>
        <fixtext xml:lang="en" fixref="F-CheckForPresenceOfUser.netrcFiles" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. 
          Therefore, it is recommended that a monitoring policy be established to report user .netrc files and determine the action to be taken in accordance with site policy.</fixtext>
        <fix id="F-CheckForPresenceOfUser.netrcFiles" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:246542" />
        </check>
      </Rule>
      <Rule id="CheckPermissionsOnUser.netrcFiles" xml:lang="en" selected="false">
        <title xml:lang="en">Check Permissions on User .netrc Files</title>
        <description xml:lang="en">This checks verifies the file permissions of the .netrc files in
        the home directories of all the accounts other than root, sync, shutdown and halt and home
        directories of the accounts whose login shell is not equal to /sbin/nologin.</description>
        <rationale xml:lang="en">.netrc files may contain unencrypted passwords that may be used to attack other systems.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.13</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 06022</ident>
        <fixtext xml:lang="en" fixref="F-CheckPermissionsOnUser.netrcFiles" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. 
          Therefore, it is recommended that a monitoring policy be established to report user .netrc file permissions and determine the action to be taken in accordance with site policy.</fixtext>
        <fix id="F-CheckPermissionsOnUser.netrcFiles" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export value-id="ShouldTheUserHaveREADAccess_var18" export-name="oval:com.mcafee.oval:var:78640" />
          <check-export value-id="ShouldTheUserHaveWRITEAccess_var18" export-name="oval:com.mcafee.oval:var:78641" />
          <check-export value-id="ShouldTheUserHaveEXECUTEAccess_var18" export-name="oval:com.mcafee.oval:var:78642" />
          <check-export value-id="ShouldTheGroupHaveREADAccess_var18" export-name="oval:com.mcafee.oval:var:78643" />
          <check-export value-id="ShouldTheGroupHaveWRITEAccess_var18" export-name="oval:com.mcafee.oval:var:78644" />
          <check-export value-id="ShouldTheGroupHaveEXECUTEAccess_var18" export-name="oval:com.mcafee.oval:var:78645" />
          <check-export value-id="ShouldOthersHaveREADAccess_var18" export-name="oval:com.mcafee.oval:var:78646" />
          <check-export value-id="ShouldOthersHaveWRITEAccess_var18" export-name="oval:com.mcafee.oval:var:78647" />
          <check-export value-id="ShouldOthersHaveEXECUTEAccess_var18" export-name="oval:com.mcafee.oval:var:78648" />
          <check-content-ref href="" name="oval:com.mcafee.oval:def:246594" />
        </check>
      </Rule>
      <Rule id="CheckForPresenceOfUser.rhostsFiles" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Presence of User .rhosts Files</title>
        <description xml:lang="en">This checks verifies that the user home directories of all the
        accounts other than root, sync, shutdown and halt and home directories of the accounts
        whose login shell is not equal to /sbin/nologin do not contain .rhost files.</description>
        <rationale xml:lang="en">This action is only meaningful if .rhosts support is permitted in the file /etc/pam.conf. Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, 
          they may have been brought over from other systems and could contain information useful to an attacker for those other systems.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.14</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05527</ident>
        <fixtext xml:lang="en" fixref="F-CheckForPresenceOfUser.rhostsFiles" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Making global modifications to users' files without alerting the user community can result
          in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user .rhosts files and determine the action to be taken in accordance with site policy.</fixtext>
        <fix id="F-CheckForPresenceOfUser.rhostsFiles" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:246586" />
        </check>
      </Rule>
      <Rule id="CheckGroupsIn_Etc_passwd" xml:lang="en" selected="false">
        <title xml:lang="en">Check Groups in /etc/passwd</title>
        <description xml:lang="en">All GIDs referenced in the /etc/passwd file must be defined in
          the /etc/group file.</description>
        <rationale xml:lang="en">Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.15</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 05139</ident>
        <fixtext xml:lang="en" fixref="F-CheckGroupsIn_Etc_passwd" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found.</fixtext>
        <fix id="F-CheckGroupsIn_Etc_passwd" />
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref href="" name="oval:com.mcafee.oval:def:236469" />
        </check>
      </Rule>
      <Rule id="CheckForDuplicateUIDs" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Duplicate UIDs</title>
        <description xml:lang="en">Although the useradd program will not let you create a duplicate
        User ID (UID), it is possible for an administrator to manually edit the /etc/passwd file
        and change the UID field.</description>
        <rationale xml:lang="en">Users must be assigned unique UIDs for accountability and to ensure appropriate access protections.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.16</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09930</ident>
        <fixtext xml:lang="en" fixref="F-CheckForDuplicateUIDs" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Based on the results of the script, establish unique UIDs and review all files owned by the shared UID to determine which UID they are supposed to belong to.</fixtext>
        <fix id="F-CheckForDuplicateUIDs" />
        <check system="http://www.mcafee.com/xccdf/script/1.0">
          <check-content>/bin/sh
30
#!/bin/bash
# echo "The Output for the Audit of Control 6.2.16 - Check for Duplicate UIDs is"
/bin/cat /etc/passwd | /bin/cut -f3 -d":" | /bin/sort -n | /usr/bin/uniq -c |\
while read x ; do
    [ -z "${x}" ] &amp;&amp; break
    set - $x
    if [ $1 -gt 1 ]; then
        users=`/bin/gawk -F: '($3 == n) { print $1 }' n=$2 /etc/passwd | /usr/bin/xargs` 
            # echo "Duplicate UID ($2): ${users}"
            exit 1;
    fi
done</check-content>
        </check>
      </Rule>
      <Rule id="CheckForDuplicateGIDs" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Duplicate GIDs</title>
        <description xml:lang="en">Although the groupadd program will not let you create a
        duplicate Group ID (GID), it is possible for an administrator to manually edit the
        /etc/group file and change the GID field. User groups must be assigned unique GIDs for
        accountability and to ensure appropriate access protections. In the case of extremely large groups it can become necessary to split a GID across group names due to character limits per line. Any such instances should be carefully audited, unless absolutely necessary such instances should be avoided.</description>
        <rationale xml:lang="en">User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.17</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09931</ident>
        <fixtext xml:lang="en" fixref="F-CheckForDuplicateGIDs" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Based on the results of the script, establish unique GIDs and review all files owned by the shared GID to determine which group they are supposed to belong to.</fixtext>
        <fix id="F-CheckForDuplicateGIDs" />
        <check system="http://www.mcafee.com/xccdf/script/1.0">
          <check-content>/bin/sh
30
#!/bin/bash
#echo "The Output for the Audit of Control 9.2.15 - Check for Duplicate GIDs is"
/bin/cat /etc/group | /bin/cut -f3 -d":" | /bin/sort -n | /usr/bin/uniq -c |\
 while read x ; do
      [ -z "${x}" ] &amp;&amp; break
      set - $x
      if [ $1 -gt 1 ]; then
          grps=`/bin/gawk -F: '($3 == n) { print $1 }' n=$2 \ /etc/group | xargs`
          # echo "Duplicate GID ($2): ${grps}"
          exit 1
       fi
    done</check-content>
        </check>
      </Rule>
      <Rule id="CheckForDuplicateUserNames" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Duplicate User Names</title>
        <description xml:lang="en">If a user is assigned a duplicate user name, it will create and
          have access to files with the first UID for that username in /etc/passwd.</description>
        <rationale xml:lang="en">If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in /etc/passwd. For example, if "test4" has a UID of 1000 and a subsequent "test4" 
          entry has a UID of 2000, logging in as "test4" will use UID 1000. Effectively, the UID is shared, which is a security problem.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.18</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09956</ident>
        <fixtext xml:lang="en" fixref="F-CheckForDuplicateUserNames" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Based on the results of the script, establish unique user names for the users. File ownerships will automatically reflect the change as long as the users have unique UIDs.</fixtext>
        <fix id="F-CheckForDuplicateUserNames" />
        <check system="http://www.mcafee.com/xccdf/script/1.0">
          <check-content>/bin/sh
30
#!/bin/bash
#echo "The Output for the Audit of Control 9.2.16 - Check for Duplicate User Names is"
/bin/cat /etc/passwd | /bin/cut -f1 -d":" | /bin/sort -n | /usr/bin/uniq -c |\
while read x ; do
    [ -z "${x}" ] &amp;&amp; break
    set - $x 
    if [ $1 -gt 1 ]; then
        uids=`/bin/gawk -F: '($1 == n) { print $3 }' n=$2 \ /etc/passwd | xargs`
        #echo "Duplicate User Name ($2): ${uids}"
        exit 1
     fi
  done</check-content>
        </check>
      </Rule>
      <Rule id="CheckForDuplicateGroupNames" xml:lang="en" selected="false">
        <title xml:lang="en">Check for Duplicate Group Names</title>
        <description xml:lang="en">If a group is assigned a duplicate group name, it will create
          and have access to files with the first GID for that group in /etc/group.</description>
        <rationale xml:lang="en">If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in /etc/group. Effectively, the GID is shared, which is a security problem.</rationale>
        <ident system="CIS_Oracle_Linux_6_Benchmark_v1.0.0">6.2.19</ident>
        <ident system="https%3A%2F%2Fwww.unifiedcompliance.com">UCF CC ID 09932</ident>
        <fixtext xml:lang="en" fixref="F-CheckForDuplicateGroupNames" reboot="false" strategy="unknown" disruption="unknown" complexity="unknown">Based on the results of the script, establish unique names for the user groups. File group ownerships will automatically reflect the change as long as the groups have unique GIDs.</fixtext>
        <fix id="F-CheckForDuplicateGroupNames" />
        <check system="http://www.mcafee.com/xccdf/script/1.0">
          <check-content>/bin/sh
30
#!/bin/bash
#echo "The Output for the Audit of Control 9.2.17 - Check for Duplicate Group Names is"
/bin/cat /etc/group | /bin/cut -f1 -d":" | /bin/sort -n | /usr/bin/uniq -c |\
while read x ; do
    [ -z "${x}" ] &amp;&amp; break
    set - $x 
    if [ $1 -gt 1 ]; then
        gids=`/bin/gawk -F: '($1 == n) { print $3 }' n=$2 /etc/passwd | xargs`
        #echo "Duplicate Group Name ($2): ${gids}"
        exit 1
     fi
  done</check-content>
        </check>
      </Rule>
    </Group>
  </Group>
</Benchmark>