ssg-debian 0.1.31-5 / usr / share / scap-security-guide / ssg-debian8-ds.xml

<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_ssg-debian8-xccdf-1.2.xml" schematron-version="1.2">
  <ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_ssg-debian8-xccdf-1.2.xml" scap-version="1.2" use-case="OTHER">
    <ds:dictionaries>
      <ds:component-ref id="scap_org.open-scap_cref_output--ssg-debian8-cpe-dictionary.xml" xlink:href="#scap_org.open-scap_comp_output--ssg-debian8-cpe-dictionary.xml">
        <cat:catalog>
          <cat:uri name="ssg-debian8-cpe-oval.xml" uri="#scap_org.open-scap_cref_output--ssg-debian8-cpe-oval.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:dictionaries>
    <ds:checklists>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-xccdf-1.2.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-xccdf-1.2.xml">
        <cat:catalog>
          <cat:uri name="ssg-debian8-oval.xml" uri="#scap_org.open-scap_cref_ssg-debian8-oval.xml"/>
          <cat:uri name="ssg-debian8-ocil.xml" uri="#scap_org.open-scap_cref_ssg-debian8-ocil.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:checklists>
    <ds:checks>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-oval.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-ocil.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-ocil.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_output--ssg-debian8-cpe-oval.xml" xlink:href="#scap_org.open-scap_comp_output--ssg-debian8-cpe-oval.xml"/>
    <ds:component-ref id="scap_org.open-scap_cref_output--ssg-debian8-oval.xml" xlink:href="#scap_org.open-scap_comp_output--ssg-debian8-oval.xml"/></ds:checks>
  </ds:data-stream>
  <ds:component id="scap_org.open-scap_comp_ssg-debian8-oval.xml" timestamp="2017-08-11T21:23:22">
    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
  <generator>
    <oval:product_name>python</oval:product_name>
    <oval:product_version>2.7.13+</oval:product_version>
    <oval:schema_version>5.11</oval:schema_version>
    <oval:timestamp>2017-08-11T21:23:21</oval:timestamp>
  </generator>
  <definitions>
    <definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate group.</description>
      <reference ref_id="rsyslog_files_groupownership" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>File permissions for all syslog log files should be set correctly.</description>
      <reference ref_id="rsyslog_files_permissions" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="1">
      <metadata>
        <title>Verify /etc/group Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/group is owned by 0, group owned by 0, and has mode 0644. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_group" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/gshadow Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 42, and has mode 0640. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_gshadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="1">
      <metadata>
        <title>Verify /etc/passwd Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_passwd" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/shadow Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/shadow is owned by 0, group owned by 42, and has mode 0640. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_shadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_shadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_auditd_installed:def:1" version="1">
      <metadata>
        <title>Package auditd Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package auditd should be installed.</description>
      <reference ref_id="package_auditd_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package auditd is installed" test_ref="oval:ssg-test_package_auditd_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cron_installed:def:1" version="1">
      <metadata>
        <title>Package cron Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package cron should be installed.</description>
      <reference ref_id="package_cron_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package cron is installed" test_ref="oval:ssg-test_package_cron_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1">
      <metadata>
        <title>Package inetutils-telnetd Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package inetutils-telnetd should be removed.</description>
      <reference ref_id="package_inetutils-telnetd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_nis_removed:def:1" version="1">
      <metadata>
        <title>Package nis Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package nis should be removed.</description>
      <reference ref_id="package_nis_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">
      <metadata>
        <title>Package ntp Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package ntp should be installed.</description>
      <reference ref_id="package_ntp_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">
      <metadata>
        <title>Package ntpdate Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package ntpdate should be removed.</description>
      <reference ref_id="package_ntpdate_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">
      <metadata>
        <title>Package openssh-server Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package openssh-server should be removed.</description>
      <reference ref_id="package_openssh-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">
      <metadata>
        <title>Package rsyslog Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package rsyslog should be installed.</description>
      <reference ref_id="package_rsyslog_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1">
      <metadata>
        <title>Package telnetd-ssl Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package telnetd-ssl should be removed.</description>
      <reference ref_id="package_telnetd-ssl_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnetd_removed:def:1" version="1">
      <metadata>
        <title>Package telnetd Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package telnetd should be removed.</description>
      <reference ref_id="package_telnetd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">
      <metadata>
        <title>Service auditd Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The auditd service should be enabled if possible.</description>
      <reference ref_id="service_auditd_enabled" source="ssg"/></metadata>
      <criteria comment="package auditd installed and service auditd is configured to start" operator="AND">
        <extend_definition comment="auditd installed" definition_ref="oval:ssg-package_auditd_installed:def:1"/>
        <criteria operator="OR" comment="service auditd is configured to start">
          <criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cron_enabled:def:1" version="1">
      <metadata>
        <title>Service cron Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The cron service should be enabled if possible.</description>
      <reference ref_id="service_cron_enabled" source="ssg"/></metadata>
      <criteria comment="package cron installed and service cron is configured to start" operator="AND">
        <extend_definition comment="cron installed" definition_ref="oval:ssg-package_cron_installed:def:1"/>
        <criteria operator="OR" comment="service cron is configured to start">
          <criterion comment="multi-user.target wants cron" test_ref="oval:ssg-test_multi_user_wants_cron:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">
      <metadata>
        <title>Service ntpd Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The ntpd service should be enabled if possible.</description>
      <reference ref_id="service_ntpd_enabled" source="ssg"/></metadata>
      <criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
        <extend_definition comment="ntp installed" definition_ref="oval:ssg-package_ntp_installed:def:1"/>
        <criteria operator="OR" comment="service ntpd is configured to start">
          <criterion comment="multi-user.target wants ntpd" test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">
      <metadata>
        <title>Service rsyslog Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The rsyslog service should be enabled if possible.</description>
      <reference ref_id="service_rsyslog_enabled" source="ssg"/></metadata>
      <criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
        <extend_definition comment="rsyslog installed" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>
        <criteria operator="OR" comment="service rsyslog is configured to start">
          <criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">
      <metadata>
        <title>Service sshd Disabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The sshd service should be disabled if possible.</description>
      <reference ref_id="service_sshd_disabled" source="ssg"/></metadata>
      <criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
        <extend_definition comment="openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criteria operator="OR" comment="service sshd is not configured to start">
          <criterion comment="sshd not wanted by multi-user.target" test_ref="oval:ssg-test_sshd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_hardlinks" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "fs.protected_hardlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1"/>
        <extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_symlinks" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "fs.protected_symlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1"/>
        <extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "fs.suid_dumpable" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>
        <extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.dmesg_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>
        <extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.kptr_restrict" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.kptr_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1"/>
        <extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.perf_cpu_time_max_percent" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1"/>
        <extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.perf_event_max_sample_rate" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1"/>
        <extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_paranoid" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.perf_event_paranoid" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1"/>
        <extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.pid_max" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.pid_max" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_pid_max" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1"/>
        <extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.randomize_va_space" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>
        <extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.sysrq" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.sysrq" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_sysrq" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1"/>
        <extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "net.ipv4.ip_forward" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>
        <extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_hardlinks" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_protected_hardlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_hardlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_symlinks" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_symlinks" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_protected_symlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_symlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_dmesg_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.kptr_restrict" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_kptr_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.kptr_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_kptr_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_max_sample_rate" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_paranoid" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_perf_event_paranoid" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_paranoid:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.pid_max" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.pid_max" parameter should be set to "65536" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_pid_max" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_runtime_sysctl_kernel_pid_max:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.sysrq" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.sysrq" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_sysrq" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_runtime_sysctl_kernel_sysrq:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3">
      <metadata>
        <title>Kernel "vm.mmap_min_addr" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "vm.mmap_min_addr" parameter should be set to "65536" in system runtime.</description>
      <reference ref_id="sysctl_runtime_vm_mmap_min_addr" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_runtime_sysctl_vm_mmap_min_addr:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_hardlinks" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_protected_hardlinks" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_symlinks" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_symlinks" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_protected_symlinks" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.kptr_restrict" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_kptr_restrict" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_perf_cpu_time_max_percent" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_perf_event_max_sample_rate" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_paranoid" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_perf_event_paranoid" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.pid_max" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.pid_max" parameter should be set to "65536" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_pid_max" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1"/>
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1"/>
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1"/>
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1"/>
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.sysrq" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.sysrq" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_sysrq" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1"/>
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1"/>
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3">
      <metadata>
        <title>Kernel "vm.mmap_min_addr" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "vm.mmap_min_addr" parameter should be set to "65536" in the system configuration.</description>
      <reference ref_id="sysctl_static_vm_mmap_min_addr" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1"/>
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1"/>
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3">
      <metadata>
        <title>Kernel "vm.mmap_min_addr" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "vm.mmap_min_addr" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_vm_mmap_min_addr" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="vm.mmap_min_addr configuration setting check" definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1"/>
        <extend_definition comment="vm.mmap_min_addr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate user.</description>
      <reference ref_id="rsyslog_files_ownership" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_systemmap:def:1" version="1">
      <metadata>
        <title>Verify that System.map files are readable only by root</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>
        Checks that /boot/System.map-* are only readable by root.
      </description>
      <reference ref_id="file_permissions_systemmap" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_debian8:def:1" version="3">
      <metadata>
        <title>Debian 8</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <reference ref_id="cpe:/o:debian:debian_linux:8" source="CPE"/>
        <description>The operating system installed on the system is Debian 8</description>
      <reference ref_id="installed_OS_is_debian8" source="ssg"/></metadata>
      <criteria comment="current Debian version is Debian jessie" operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
        <criterion comment="Debian8 is installed" test_ref="oval:ssg-test_debian_8:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">
      <metadata>
        <title>Ensure /home Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>If user home directories will be stored locally, create a
      separate partition for /home. If /home will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
      <reference ref_id="partition_for_home" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_home_partition:tst:1" comment="/home on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_srv:def:1" version="1">
      <metadata>
        <title>Ensure /srv Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>If a file server (FTP, TFTP...) is hosted locally, create a separate partition
      for /srv at installation time (or migrate it later using LVM). If
      /srv will be mounted from another system such as an NFS server, then
      creating a separate partition is not necessary at installation time, and the
      mountpoint can instead be configured later.</description>
      <reference ref_id="partition_for_srv" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_srv_partition:tst:1" comment="/srv on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">
      <metadata>
        <title>Ensure /tmp Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The /tmp directory is a world-writable directory used for
      temporary file storage. Verify that it has its own partition or logical
      volume.</description>
      <reference ref_id="partition_for_tmp" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_tmp_partition:tst:1" comment="/tmp on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">
      <metadata>
        <title>Ensure /var Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>Ensuring that /var is mounted on its own partition enables
      the setting of more restrictive mount options, which is used as temporary
      storage by many program, particularly system services such as daemons. It
      is not uncommon for the /var directory to contain world-writable
      directories, installed by other software packages.</description>
      <reference ref_id="partition_for_var" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_partition:tst:1" comment="/var on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">
      <metadata>
        <title>Ensure /var/log Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>System logs are stored in the /var/log directory. Ensure
      that it has its own partition or logical volume.</description>
      <reference ref_id="partition_for_var_log" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_partition:tst:1" comment="/var/log on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">
      <metadata>
        <title>Ensure /var/log/audit Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>Audit logs are stored in the /var/log/audit directory.
      Ensure that it has its own partition or logical volume. Make absolutely
      certain that it is large enough to store all audit logs that will be
      created by the auditing daemon.</description>
      <reference ref_id="partition_for_var_log_audit" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-account_unique_name:def:1" version="1">
      <metadata>
        <title>Set All Accounts To Have Unique Names</title>
        <affected family="unix">
        </affected>
        <description>All accounts on the system should have unique names for proper accountability.</description>
      <reference ref_id="account_unique_name" source="ssg"/></metadata>
      <criteria comment="There should not exist duplicate user name entries in /etc/passwd">
        <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The maximum password age policy should meet minimum requirements.</description>
      <reference ref_id="accounts_maximum_age_login_defs" source="ssg"/></metadata>
      <criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The minimum password age policy should be set appropriately.</description>
      <reference ref_id="accounts_minimum_age_login_defs" source="ssg"/></metadata>
      <criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1">
      <metadata>
        <title>UID 0 Belongs Only To Root</title>
        <affected family="unix">
        </affected>
        <description>Only the root account should be assigned a user id of 0.</description>
      <reference ref_id="accounts_no_uid_except_zero" source="ssg"/></metadata>
      <criteria>
        <criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_all_shadowed:def:1" version="1">
      <metadata>
        <title>All Password Hashes Shadowed</title>
        <affected family="unix">
        </affected>
        <description>All password hashes should be shadowed.</description>
      <reference ref_id="accounts_password_all_shadowed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password minimum length should be set appropriately.</description>
      <reference ref_id="accounts_password_minlen_login_defs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password expiration warning age should be set appropriately.</description>
      <reference ref_id="accounts_password_warn_age_login_defs" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="4">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference ref_id="accounts_passwords_pam_faillock_deny" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" comment="pam_faillock.so authfail deny value set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" comment="pam_faillock.so set in account phase of system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" comment="pam_faillock.so authfail deny value set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" comment="pam_faillock.so set in account phase of password-auth"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2">
      <metadata>
        <title>Write permissions are disabled for group and other in all
      directories in Root's Path</title>
        <affected family="unix">
        </affected>
        <description>Check each directory in root's path and make use it does
      not grant write permission to group and other</description>
      <reference ref_id="accounts_root_path_dirs_no_write" source="ssg"/></metadata>
      <criteria comment="Check that write permission to group and other in root's path is denied">
        <criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1">
      <metadata>
        <title>The syslog Plugin Of the Audit Event Multiplexor (audispd) Is Activated</title>
        <affected family="unix">
        </affected>
        <description>active setting in /etc/audisp/plugins.d/syslog.conf is set to 'yes'</description>
      <reference ref_id="auditd_audispd_syslog_plugin_activated" source="ssg"/></metadata>
      <criteria>
        <criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1">
      <metadata>
        <title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</title>
        <affected family="unix">
        </affected>
        <description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</description>
      <reference ref_id="auditd_conf_log_group_not_root" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2">
      <metadata>
        <title>Auditd Email Account to Notify Upon Action</title>
        <affected family="unix">
        </affected>
        <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
      <reference ref_id="auditd_data_retention_action_mail_acct" source="ssg"/></metadata>
      <criteria>
        <criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Disk is Low on Space</title>
        <affected family="unix">
        </affected>
        <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_admin_space_left_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Log File Size</title>
        <affected family="unix">
        </affected>
        <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference ref_id="auditd_data_retention_max_log_file" source="ssg"/></metadata>
      <criteria>
        <criterion comment="max_log_file setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Maximum Log Size Reached</title>
        <affected family="unix">
        </affected>
        <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_max_log_file_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Number of Logs to Retain</title>
        <affected family="unix">
        </affected>
        <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference ref_id="auditd_data_retention_num_logs" source="ssg"/></metadata>
      <criteria>
        <criterion comment="num_logs setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3">
      <metadata>
        <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
        <affected family="unix">
        </affected>
        <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_space_left_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1">
      <metadata>
        <title>Ensure Yum gpgcheck Globally Activated</title>
        <affected family="unix">
        </affected>
        <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
      <reference ref_id="ensure_gpgcheck_globally_activated" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="Fedora installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          <criterion comment="check value of gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1"/>
        </criteria>
        <criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_logrotate_activated:def:1" version="1">
      <metadata>
        <title>Ensure the logrotate utility performs the automatic rotation of log files on daily basis</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </description>
      <reference ref_id="ensure_logrotate_activated" source="ssg"/></metadata>
      <criteria comment="/etc/logrotate.conf contains daily setting or /etc/cron.daily/logrotate file exists" operator="OR">
        <criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
        <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_var_log_audit:def:1" version="3">
      <metadata>
        <title>Verify /var/log/audit Ownership</title>
        <affected family="unix">
        </affected>
        <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
      <reference ref_id="file_ownership_var_log_audit" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="directories are root owned">
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
        </criteria>
        <criteria operator="AND" comment="log_group in auditd.conf is not root">
          <extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_home_dirs:def:1" version="1">
      <metadata>
        <title>Proper Permissions User Home Directories</title>
        <affected family="unix">
        </affected>
        <description>File permissions should be set correctly for the home directories for all user accounts.</description>
      <reference ref_id="file_permissions_home_dirs" source="ssg"/></metadata>
      <criteria>
        <criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_antivirus:def:1" version="1">
      <metadata>
        <title>Package Antivirus Installed</title>
        <affected family="unix">
        </affected>
        <description>Antivirus software should be installed.</description>
      <reference ref_id="install_antivirus" source="ssg"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met">
        <extend_definition comment="McAfee A/V Installed" definition_ref="oval:ssg-install_mcafee_antivirus:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_antivirus:def:1" version="1">
      <metadata>
        <title>Package McAfeeVSEForLinux Installed</title>
        <affected family="unix">
        </affected>
        <description>McAfee Antivirus software should be installed.</description>
      <reference ref_id="install_mcafee_antivirus" source="ssg"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met" operator="AND">
        <extend_definition comment="McAfee Runtime Libraries and Agent" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <criterion comment="Linuxshield AntiVirus package is installed" test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_cma_rt:def:1" version="1">
      <metadata>
        <title>Install the McAfee Runtime Libraries and Linux Agent</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</description>
      <reference ref_id="install_mcafee_cma_rt" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="McAfee runtime library package installed" test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1"/>
        <criterion comment="McAfee management agent package installed" test_ref="oval:ssg-test_mcafee_management_agent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss:def:1" version="1">
      <metadata>
        <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
        <affected family="unix">
        </affected>
        <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</description>
      <reference ref_id="install_mcafee_hbss" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_hips:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1">
      <metadata>
        <title>Install the Asset Configuration Compliance Module (ACCM)</title>
        <affected family="unix">
        </affected>
        <description>Install the Asset Configuration Compliance Module (ACCM).</description>
      <reference ref_id="install_mcafee_hbss_accm" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee ACCM is installed" test_ref="oval:ssg-test_mcafee_accm_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_hips:def:1" version="1">
      <metadata>
        <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is
      absolutely necessary. If SELinux is enabled, do not install or enable this module.</description>
      <reference ref_id="install_mcafee_hbss_hips" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee IPS  is installed" test_ref="oval:ssg-test_mcafee_hbss_hips_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1">
      <metadata>
        <title>Install the Policy Auditor (PA) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the Policy Auditor (PA) Module.</description>
      <reference ref_id="install_mcafee_hbss_pa" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee Policy Auditor is installed" test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
      <metadata>
        <title>CentOS 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 6</description>
      <reference ref_id="installed_OS_is_centos6" source="ssg"/></metadata>
      <criteria>
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
      <metadata>
        <title>CentOS 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 7</description>
      <reference ref_id="installed_OS_is_centos7" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
      <metadata>
        <title>Installed operating system is Fedora</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:fedoraproject:fedora:22" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:23" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:24" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:25" source="CPE"/>
        <description>The operating system installed on the system is Fedora</description>
      <reference ref_id="installed_OS_is_fedora" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="fedora-release RPM package is installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
        <criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
      <metadata>
        <title>Installed operating system is part of the Unix family</title>
        <affected family="unix">
        </affected>
        <description>The operating system installed on the system is part of the Unix OS family</description>
      <reference ref_id="installed_OS_is_part_of_Unix_family" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel6:def:1" version="2">
      <metadata>
        <title>Red Hat Enterprise Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 6</description>
      <reference ref_id="installed_OS_is_rhel6" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 6 Workstation is installed" test_ref="oval:ssg-test_rhel_workstation:tst:1"/>
          <criterion comment="RHEL 6 Server is installed" test_ref="oval:ssg-test_rhel_server:tst:1"/>
          <criterion comment="RHEL 6 Compute Node is installed" test_ref="oval:ssg-test_rhel_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
      <metadata>
        <title>Red Hat Enterprise Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
      <reference ref_id="installed_OS_is_rhel7" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
          <criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
          <criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
      <metadata>
        <title>Scientific Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 6</description>
      <reference ref_id="installed_OS_is_sl6" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
      <metadata>
        <title>Scientific Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 7</description>
      <reference ref_id="installed_OS_is_sl7" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux:def:1" version="1">
      <metadata>
        <title>WRLinux</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
        <description>The operating system installed on the system is
      Wind River Linux</description>
      <reference ref_id="installed_OS_is_wrlinux" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux:tst:1"/>
        <criterion comment="WRLinux is installed" test_ref="oval:ssg-test_wrlinux:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_direct_root_logins:def:1" version="1">
      <metadata>
        <title>Direct root Logins Not Allowed</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</description>
      <reference ref_id="no_direct_root_logins" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_empty_passwords:def:1" version="1">
      <metadata>
        <title>No nullok Option in /etc/pam.d/system-auth</title>
        <affected family="unix">
        </affected>
        <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
      <reference ref_id="no_empty_passwords" source="ssg"/></metadata>
      <criteria>
        <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_insecure_locks_exports:def:1" version="1">
      <metadata>
        <title>Ensure insecure_locks is disabled</title>
        <affected family="unix">
        </affected>
        <description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</description>
      <reference ref_id="no_insecure_locks_exports" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check for insecure NFS locks in /etc/exports" test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_netrc_files:def:1" version="1">
      <metadata>
        <title>Verify No netrc Files Exist</title>
        <affected family="unix">
        </affected>
        <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
      <reference ref_id="no_netrc_files" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2">
      <metadata>
        <title>System Accounts Do Not Run a Shell</title>
        <affected family="unix">
        </affected>
        <description>The root account is the only system account that should have
      a login shell.</description>
      <reference ref_id="no_shelllogin_for_systemaccounts" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- If SYS_UID_MIN and SYS_UID_MAX is not defined in /etc/login.defs
           perform the check that all /etc/passwd entries having shell defined
           have UIDs outside the default <0, UID_MIN -1> range.
           If at least one UID with shell defined exists within that range,
           the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
          <criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
          <criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
        </criteria>
        <!-- If both SYS_UID_MIN and SYS_UID_MAX are defined in /etc/login.defs
           perform both checks:
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for reserved system accounts <0, SYS_UID_MIN> range,
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for dynamically allocated system accounts <SYS_UID_MIN, SYS_UID_MAX>
           If at least one UID with shell defined exists within some of the two
           ranges, the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true"/>
          <criterion comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true"/>
          <criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
          <criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_net-snmp_removed:def:1" version="1">
      <metadata>
        <title>Package net-snmp Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package net-snmp should be removed.</description>
      <reference ref_id="package_net-snmp_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_prelink_removed:def:1" version="1">
      <metadata>
        <title>Package prelink Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package prelink should be removed.</description>
      <reference ref_id="package_prelink_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package prelink is removed" test_ref="oval:ssg-test_package_prelink_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-restrict_serial_port_logins:def:1" version="1">
      <metadata>
        <title>Restrict Serial Port Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
      <reference ref_id="restrict_serial_port_logins" source="ssg"/></metadata>
      <criteria>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_remote_loghost:def:1" version="1">
      <metadata>
        <title>Send Logs to a Remote Loghost</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Syslog logs should be sent to a remote loghost</description>
      <reference ref_id="rsyslog_remote_loghost" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
        <criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-securetty_root_login_console_only:def:1" version="1">
      <metadata>
        <title>Restrict Virtual Console Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
      <reference ref_id="securetty_root_login_console_only" source="ssg"/></metadata>
      <criteria>
        <criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_not_default_password:def:1" version="2">
      <metadata>
        <title>SNMP default communities disabled</title>
        <affected family="unix">
        </affected>
        <description>SNMP default communities must be removed.</description>
      <reference ref_id="snmpd_not_default_password" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP communities" test_ref="oval:ssg-test_snmp_default_communities:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2">
      <metadata>
        <title>SNMP use newer protocols</title>
        <affected family="unix">
        </affected>
        <description>SNMP version 1 and 2c must not be enabled.</description>
      <reference ref_id="snmpd_use_newer_protocol" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1">
      <metadata>
        <title>Ensure Only Protocol 2 Connections Allowed</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The OpenSSH daemon should be running protocol 2.</description>
      <reference ref_id="sshd_allow_only_protocol2" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1">
      <metadata>
        <title>Disable Empty Passwords</title>
        <affected family="unix">
        </affected>
        <description>Remote connections from accounts with empty passwords should
      be disabled (and dependencies are met)</description>
      <reference ref_id="sshd_disable_empty_passwords" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitEmptyPasswords in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitemptypasswords_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for Rhosts RSA Authentication</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</description>
      <reference ref_id="sshd_disable_rhosts_rsa" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_root_login:def:1" version="1">
      <metadata>
        <title>Disable root Login via SSH</title>
        <affected family="unix">
        </affected>
        <description>Root login via SSH should be disabled (and dependencies are
      met)</description>
      <reference ref_id="sshd_disable_root_login" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitrootlogin_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for User Known Hosts</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow system users host-based authentication
to connect to systems if a cache of the remote systems public keys are available.
This should be disabled.</description>
      <reference ref_id="sshd_disable_user_known_hosts" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check IgnoreUserKnownHosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_idle_timeout:def:1" version="1">
      <metadata>
        <title>Set OpenSSH Idle Timeout Interval</title>
        <affected family="unix">
        </affected>
        <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
      <reference ref_id="sshd_set_idle_timeout" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_keepalive:def:1" version="1">
      <metadata>
        <title>Set ClientAliveCountMax for User Logins</title>
        <affected family="unix">
        </affected>
        <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
      <reference ref_id="sshd_set_keepalive" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_64bit:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for 64-bit Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for 64-bit architectures to be used by other tests</description>
      <reference ref_id="system_info_architecture_64bit" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
        <extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for PPC and PPCLE Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for PPC PPC64LE architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_ppc_64" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
        <criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86 architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_x86" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86_64 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86_64 architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_x86_64" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" comment="System log files are owned by root group">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" comment="Permissions of system log files are 0640">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/group mode and ownership" id="oval:ssg-test_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_group_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_group_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_group_state_mode_0644:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="oval:ssg-test_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_gid_42:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_mode_0640:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/passwd mode and ownership" id="oval:ssg-test_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_mode_0644:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/shadow mode and ownership" id="oval:ssg-test_etc_shadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_shadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_gid_42:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_mode_0640:ste:1"/>
    </unix:file_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_auditd_installed:tst:1" version="1" comment="package auditd is installed">
      <linux:object object_ref="oval:ssg-obj_package_auditd_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cron_installed:tst:1" version="1" comment="package cron is installed">
      <linux:object object_ref="oval:ssg-obj_package_cron_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" comment="package inetutils-telnetd is removed">
      <linux:object object_ref="oval:ssg-obj_package_inetutils-telnetd_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nis_removed:tst:1" version="1" comment="package nis is removed">
      <linux:object object_ref="oval:ssg-obj_package_nis_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
      <linux:object object_ref="oval:ssg-obj_package_ntp_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" comment="package ntpdate is removed">
      <linux:object object_ref="oval:ssg-obj_package_ntpdate_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_openssh-server_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
      <linux:object object_ref="oval:ssg-obj_package_rsyslog_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" comment="package telnetd-ssl is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnetd-ssl_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" comment="package telnetd is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnetd_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_cron:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_cron_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_sshd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_sshd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_sshd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.protected_hardlinks set to 1" id="oval:ssg-test_runtime_sysctl_fs_protected_hardlinks:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_hardlinks:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_hardlinks:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.protected_symlinks set to 1" id="oval:ssg-test_runtime_sysctl_fs_protected_symlinks:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_symlinks:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_symlinks:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_suid_dumpable:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_suid_dumpable:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="oval:ssg-test_runtime_sysctl_kernel_dmesg_restrict:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_dmesg_restrict:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_dmesg_restrict:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.kptr_restrict set to 1" id="oval:ssg-test_runtime_sysctl_kernel_kptr_restrict:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_kptr_restrict:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_kptr_restrict:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" id="oval:ssg-test_runtime_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" id="oval:ssg-test_runtime_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" id="oval:ssg-test_runtime_sysctl_kernel_perf_event_paranoid:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_event_paranoid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_paranoid:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.pid_max set to 65536" id="oval:ssg-test_runtime_sysctl_kernel_pid_max:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_pid_max:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_pid_max:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_randomize_va_space:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_randomize_va_space:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.sysrq set to 0" id="oval:ssg-test_runtime_sysctl_kernel_sysrq:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_sysrq:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_sysrq:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_ip_forward:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_forward:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter vm.mmap_min_addr set to 65536" id="oval:ssg-test_runtime_sysctl_vm_mmap_min_addr:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_vm_mmap_min_addr:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_vm_mmap_min_addr:ste:1"/>
    </unix:sysctl_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.protected_hardlinks static configuration" id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.protected_symlinks static configuration" id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration" id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.dmesg_restrict static configuration" id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.kptr_restrict static configuration" id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_cpu_time_max_percent static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_event_max_sample_rate static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_event_paranoid static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.pid_max static configuration" id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration" id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.sysrq static configuration" id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="vm.mmap_min_addr static configuration" id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" comment="System log files are owned by root">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="system.map files readable only by root" id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_systemmap_files:obj:1"/>
      <unix:state state_ref="oval:ssg-state_owner_systemmap:ste:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_systemmap:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
      <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_8:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_debian_8:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_home_partition:tst:1" version="1" comment="/home on own partition">
      <linux:object object_ref="oval:ssg-object_mount_home_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_srv_partition:tst:1" version="1" comment="/srv on own partition">
      <linux:object object_ref="oval:ssg-object_mount_srv_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition:tst:1" version="1" comment="/tmp on own partition">
      <linux:object object_ref="oval:ssg-object_own_tmp_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition:tst:1" version="1" comment="/var on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition:tst:1" version="1" comment="/var/log on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition:tst:1" version="1" comment="check for /var/log/audit partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_audit_own_partition:obj:1"/>
    </linux:partition_test>
    <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user name entries in /etc/passwd" version="1">
      <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:password_test check="all" comment="password hashes are shadowed" id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
    </unix:password_test>
    <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="Check if there aren't directories in root's path having write permission set for group or other" id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" comment="audispd syslog plugin activated" id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" check="all" check_existence="none_exist" comment="log_group = root" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="email account for actions" id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="max log file size" id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/yum.conf" id="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the presence of daily setting in /etc/logrotate.conf file" id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_home_dirs_wrong_perm:ste:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" comment="AntiVirus package is installed">
      <linux:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" comment="Runtime Libraries package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" comment="Agent package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee ACCM installed" id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_hbss_hips_installed:tst:1" version="1" comment="McAfee IPS is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee Policy Auditor installed" id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="fedora-release RPM package is installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
      <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 6" id="oval:ssg-test_rhel_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 6" id="oval:ssg-test_rhel_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 6" id="oval:ssg-test_rhel_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_computenode:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_unix_wrlinux:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_wrlinux:ste:1"/>
    </ind:family_test>
    <unix:file_test check_existence="at_least_one_exists" version="1" id="oval:ssg-test_wrlinux:tst:1" check="all" comment="Test presence of /etc/wrlinux-release.">
      <unix:object object_ref="oval:ssg-obj_test_wrlinux:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/securetty file exists" id="oval:ssg-test_etc_securetty_exists:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="no entries in /etc/securetty" id="oval:ssg-test_no_direct_root_logins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="oval:ssg-test_no_empty_passwords:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the insecure locks in /etc/exports" id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="oval:ssg-test_no_netrc_files_home:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
    </unix:file_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_default_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_default_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="SYS_UID_MIN not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="SYS_UID_MAX not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_reserved_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_reserved_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1"/>
    </ind:variable_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" comment="package net-snmp is removed">
      <linux:object object_ref="oval:ssg-obj_package_net-snmp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_prelink_removed:tst:1" version="1" comment="package prelink is removed">
      <linux:object object_ref="oval:ssg-obj_package_prelink_removed:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_default_communities:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_versions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitEmptyPasswords[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitemptypasswords_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitRootLogin[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitrootlogin_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitrootlogin_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the IgnoreUserKnownHosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="32 bit architecture" id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
    </unix:uname_test>
  </tests>
  <objects>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_etc_group:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>group</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_etc_gshadow:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>gshadow</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_etc_passwd:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>passwd</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_etc_shadow:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>shadow</unix:filename>
    </unix:file_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_auditd_installed:obj:1" version="1">
      <linux:name>auditd</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_cron_installed:obj:1" version="1">
      <linux:name>cron</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_inetutils-telnetd_removed:obj:1" version="1">
      <linux:name>inetutils-telnetd</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_nis_removed:obj:1" version="1">
      <linux:name>nis</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_ntp_installed:obj:1" version="1">
      <linux:name>ntp</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_ntpdate_removed:obj:1" version="1">
      <linux:name>ntpdate</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_openssh-server_removed:obj:1" version="1">
      <linux:name>openssh-server</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_rsyslog_installed:obj:1" version="1">
      <linux:name>rsyslog</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_telnetd-ssl_removed:obj:1" version="1">
      <linux:name>telnetd-ssl</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_telnetd_removed:obj:1" version="1">
      <linux:name>telnetd</linux:name>
    </linux:dpkginfo_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sshd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_hardlinks:obj:1" version="1">
      <unix:name>fs.protected_hardlinks</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_symlinks:obj:1" version="1">
      <unix:name>fs.protected_symlinks</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_suid_dumpable:obj:1" version="1">
      <unix:name>fs.suid_dumpable</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_dmesg_restrict:obj:1" version="1">
      <unix:name>kernel.dmesg_restrict</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_kptr_restrict:obj:1" version="1">
      <unix:name>kernel.kptr_restrict</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <unix:name>kernel.perf_cpu_time_max_percent</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <unix:name>kernel.perf_event_max_sample_rate</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
      <unix:name>kernel.perf_event_paranoid</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_pid_max:obj:1" version="1">
      <unix:name>kernel.pid_max</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <unix:name>kernel.randomize_va_space</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_sysrq:obj:1" version="1">
      <unix:name>kernel.sysrq</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <unix:name>net.ipv4.ip_forward</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_vm_mmap_min_addr:obj:1" version="1">
      <unix:name>vm.mmap_min_addr</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:file_object comment="system.mapfiles" id="oval:ssg-object_file_permissions_systemmap_files:obj:1" version="1">
      <!-- Check that /boot/System.map-* files is readable only by root -->
      <unix:path>/boot</unix:path>
      <unix:filename operation="pattern match">^System\.map.*$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
      <unix:filepath>/etc/debian_version</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_debian_8:obj:1" version="1" comment="Check Debian version">
      <ind:filepath>/etc/debian_version</ind:filepath>
      <ind:pattern operation="pattern match">^8.[0-9]+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_mount_home_own_partition:obj:1" version="1">
      <linux:mount_point>/home</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_srv_own_partition:obj:1" version="1">
      <linux:mount_point>/srv</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_own_tmp_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_own_partition:obj:1" version="1">
      <linux:mount_point>/var</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_audit_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log/audit</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <!-- User names from /etc/passwd (1-th column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MAX_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MAX_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
      <unix:username operation="pattern match">.*</unix:username>
    </unix:password_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_LEN directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_LEN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_WARN_AGE directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_WARN_AGE directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/password-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
      <ind:pid xsi:nil="true" datatype="int"/>
      <ind:name>PATH</ind:name>
    </ind:environmentvariable58_object>
    <unix:file_object comment="root's path directories with wrong group / other write permissions" id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1">
      <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</filter>
      <filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
      <ind:filepath>/etc/audisp/plugins.d/syslog.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" comment="log_group = root" version="1">
      <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/dnf/dnf.conf" version="1">
      <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
      <!-- Read whole /etc/logrotate.conf at once (as single line) -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/logrotate.conf</ind:filepath>
      <!-- From the content extract the text chunk after the last (uncommented)
         occurrence of 'daily' keyword till the EOF (including the 'daily'
         string itself) -->
      <ind:pattern operation="pattern match">(?:daily)*.*(?=[\n][\s]*daily)(.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
      <!-- From the found object exclude that one containing some (uncommented)
         occurrence of (weekly / monthly / yearly) outside the {} block section
         of /etc/logrotate.conf -->
      <filter action="exclude">oval:ssg-state_another_rotate_interval_after_daily:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
      <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s]*/etc/logrotate.conf(?:.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="home directories" id="oval:ssg-object_file_permissions_home_dirs:obj:1" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="exclude">oval:ssg-state_home_dirs_home_itself:ste:1</filter>
      <filter action="include">oval:ssg-state_home_dirs_wrong_perm:ste:1</filter>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
      <linux:name>McAfeeVSEForLinux</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
      <linux:name>MFErt</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
      <linux:name>MFEcma</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/accm/bin</unix:path>
      <unix:filename>accm</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1" version="1">
      <linux:name>MFEhiplsm</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/auditengine/bin</unix:path>
      <unix:filename>auditmanager</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
      <linux:name>fedora-release</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
      <ind:filepath>/etc/system-release-cpe</ind:filepath>
      <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_unix_wrlinux:obj:1" version="1"/>
    <unix:file_object version="1" id="oval:ssg-obj_test_wrlinux:obj:1">
      <unix:filepath>/etc/wrlinux-release</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object comment="/etc/securetty file exists" id="oval:ssg-object_etc_securetty_exists:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="no entries /etc/securetty" id="oval:ssg-object_no_direct_root_logins:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
      <ind:filepath>/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="look for .netrc in /home" id="oval:ssg-object_no_netrc_files_home:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename operation="pattern match">^\.netrc$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance od UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n(?!#|SYS_)(UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MAX directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MAX[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_default_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_default_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_reserved_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_reserved_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_dynalloc_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_net-snmp_removed:obj:1" version="1">
      <linux:name>net-snmp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_prelink_removed:obj:1" version="1">
      <linux:name>prelink</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
      <ind:path>/etc/rsyslog.d</ind:path>
      <ind:filename operation="pattern match">.*</ind:filename>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity|createUser).*(public|private)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitrootlogin_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreUserKnownHosts(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
    <unix:uname_object comment="32 bit architecture" id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1"/>
  </objects>
  <states>
    <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:group_id datatype="int">4</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_group_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_group_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_group_state_mode_0644:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_gid_42:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">42</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_mode_0640:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_mode_0644:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_gid_42:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">42</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_mode_0640:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">auditd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cron_on:ste:1" comment="cron listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">cron.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">ntpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">rsyslog.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sshd_off:ste:1" comment="sshd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">sshd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_hardlinks:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_symlinks:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_suid_dumpable:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_dmesg_restrict:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_kptr_restrict:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_event_paranoid:ste:1" version="1">
      <unix:value datatype="int" operation="equals">2</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_pid_max:ste:1" version="1">
      <unix:value datatype="int" operation="equals">65536</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_randomize_va_space:ste:1" version="1">
      <unix:value datatype="int" operation="equals">2</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_sysrq:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_ip_forward:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_ip_forward_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_vm_mmap_min_addr:ste:1" version="1">
      <unix:value datatype="int" operation="equals">65536</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_ip_forward_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_systemmap:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_systemmap:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
      <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
      <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
      <unix:password>x</unix:password>
    </unix:password_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state comment="group or other has write privilege" id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state comment="symbolic link" id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_max_log_file:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_num_logs:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_another_rotate_interval_after_daily:ste:1" version="1">
      <!-- if some of (weekly / monthly / yearly) uncommented setting is found
         (in the previously selected chunk of text) in one of the following
         parts:
         * before the first '{' character,
         * somewhere after '}' character and before another '{' character,
         * after final '}' character and before end of the chunk
         exclude such object from the found ones (since in that case earlier
         daily setting would be replaced with the found setting) -->
      <ind:subexpression datatype="string" operation="pattern match">}[^{]+[\n][\s]*(weekly|monthly|yearly)|[\n][\s]*(weekly|monthly|yearly)[^}]+{</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_home_itself:ste:1" version="1">
      <!-- Exclude /home directory itself from the check. Check /home/* directories only. -->
      <unix:path operation="equals">/home</unix:path>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_wrong_perm:ste:1" version="1" operator="OR">
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_server:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_wrlinux:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_default_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_reserved_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:textfilecontent54_state comment="upper bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state comment="lower bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
      <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64le</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="32 bit architecture" id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1">
      <unix:processor_type operation="equals">i686</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1">
      <unix:processor_type operation="equals">x86_64</unix:processor_type>
    </unix:uname_state>
  </states>
  <variables>
    <local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfg_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfg_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfp_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfp_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_log_files_paths:obj:1"/>
    </local_variable>
    <external_variable comment="External variable for net.ipv4.ip_forward" datatype="int" id="oval:ssg-sysctl_net_ipv4_ip_forward_value:var:1" version="1"/>
    <local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfo_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfo_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
      <count>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of unique username rows retrieved from /etc/passwd">
      <count>
        <unique>
          <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
        </unique>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Maximum password age" datatype="int" id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Minimum password age in days" datatype="int" id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Password minimum length" datatype="int" id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="password expiration warning age in days" datatype="int" id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1"/>
    <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
    <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1">
      <split delimiter=":">
        <object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
      </split>
    </local_variable>
    <external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1"/>
    <external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1"/>
    <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg-var_auditd_max_log_file:var:1" version="1"/>
    <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1"/>
    <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg-var_auditd_num_logs:var:1" version="1"/>
    <external_variable comment="audit space_left_action setting" datatype="string" id="oval:ssg-var_auditd_space_left_action:var:1" version="2"/>
    <local_variable id="oval:ssg-variable_sys_uids_etc_passwd:var:1" datatype="int" comment="UIDs retrieved from /etc/passwd" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_uid_min_value:var:1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_default_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - (UID_MIN - 1)) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Get (x - (UID_MIN -1)) result -->
        <arithmetic arithmetic_operation="add">
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get -1 * (UID_MIN - 1) result -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <!-- Get (UID_MIN -1) result -->
            <arithmetic arithmetic_operation="add">
              <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
              <variable_component var_ref="oval:ssg-variable_uid_min_value:var:1"/>
              <literal_component datatype="int">-1</literal_component>
            </arithmetic>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_reserved_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - SYS_UID_MIN) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_dynalloc_range_quad_expr:var:1" datatype="int" comment="Construct (x - SYS_UID_MIN) * (x - SYS_UID_MAX) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
        <!-- Construct (x - SYS_UID_MAX) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MAX -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <external_variable comment="timeout value" datatype="int" id="oval:ssg-sshd_idle_timeout_value:var:1" version="1"/>
  </variables>
</oval_definitions>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-debian8-ocil.xml" timestamp="2017-08-11T21:23:22">
    <ocil xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://scap.nist.gov/schema/ocil/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml">
  <generator>
    <schema_version>2.0</schema_version>
    <timestamp>2017-08-11T09:18:08Z</timestamp>
  </generator>
  <questionnaires>
    <questionnaire id="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1">
      <title>Verify that local System.map file (if exists) is readable only by root</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_systemmap_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1">
      <title>Verify Permissions and ownership on shadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_shadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1">
      <title>Verify Permissions and ownership on gshadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_gshadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1">
      <title>Verify Permissions and ownership on passwd File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_passwd_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1">
      <title>Verify Permissions and ownership on group File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_group_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1">
      <title>Disable Core Dumps for SUID programs</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1">
      <title>Enable Randomized Layout of Virtual Address Space</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1">
      <title>Restrict exposed kernel pointers addresses access</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_tmp_ocil:questionnaire:1">
      <title>Ensure /tmp Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_tmp_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_var_ocil:questionnaire:1">
      <title>Ensure /var Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_var_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_var_log_ocil:questionnaire:1">
      <title>Ensure /var/log Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_var_log_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1">
      <title>Ensure /var/log/audit Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_var_log_audit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_home_ocil:questionnaire:1">
      <title>Ensure /home Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_home_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_srv_ocil:questionnaire:1">
      <title>Ensure /srv Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_srv_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1">
      <title>Disallow creating symlinks to a file you not own</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1">
      <title>Disallow creating symlinks to a file you not own</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1">
      <title>Ensure rsyslog is Installed</title>
      <actions>
        <test_action_ref>ocil:ssg-package_rsyslog_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1">
      <title>Enable rsyslog Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rsyslog_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1">
      <title>Ensure Log Files Are Owned By Appropriate User</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_files_ownership_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1">
      <title>Ensure Log Files Are Owned By Appropriate Group</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_files_groupownership_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1">
      <title>Ensure System Log Files Have Correct Permissions</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_files_permissions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1">
      <title>Ensure Logs Sent To Remote Host</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_remote_loghost_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1">
      <title>Ensure Logrotate Runs Periodically</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_logrotate_activated_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1">
      <title>Enable the auditd service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_auditd_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1">
      <title>Enable the ntpd service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_ntpd_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1">
      <title>Allow Only SSH Protocol 2</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1">
      <title>Set SSH Idle Timeout Interval</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_set_idle_timeout_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1">
      <title>Set SSH Client Alive Count</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_set_keepalive_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1">
      <title>Disable SSH Root Login</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_root_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1">
      <title>Disable SSH Access via Empty Passwords</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_empty_passwords_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
  </questionnaires>
  <test_actions>
    <boolean_question_test_action id="ocil:ssg-file_permissions_systemmap_action:testaction:1" question_ref="ocil:ssg-file_permissions_systemmap_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_passwd_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_group_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_tmp_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_var_action:testaction:1" question_ref="ocil:ssg-partition_for_var_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_var_log_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_var_log_audit_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_audit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_home_action:testaction:1" question_ref="ocil:ssg-partition_for_home_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_srv_action:testaction:1" question_ref="ocil:ssg-partition_for_srv_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_rsyslog_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rsyslog_enabled_action:testaction:1" question_ref="ocil:ssg-service_rsyslog_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_files_ownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_ownership_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_files_groupownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_groupownership_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_files_permissions_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_permissions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_remote_loghost_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_loghost_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_logrotate_activated_action:testaction:1" question_ref="ocil:ssg-ensure_logrotate_activated_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_auditd_enabled_action:testaction:1" question_ref="ocil:ssg-service_auditd_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntpd_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_allow_only_protocol2_action:testaction:1" question_ref="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_set_idle_timeout_action:testaction:1" question_ref="ocil:ssg-sshd_set_idle_timeout_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_root_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_empty_passwords_action:testaction:1" question_ref="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
  </test_actions>
  <questions>
    <boolean_question id="ocil:ssg-file_permissions_systemmap_question:question:1">
      <question_text>
              
    To check the permissions of /boot/Sysem.map-*, run the command:
    $ ls -l /boot/Sysem.map-*
    If properly configured, the output should indicate the following permissions:
    -rw-------
              
    To check the ownership of /boot/System.map-*, run the command:
    $ ls -lL /boot/System.map-*
    If properly configured, the output should indicate the following owner:
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_shadow_question:question:1">
      <question_text>
              
    To check the permissions of /etc/shadow, run the command:
    $ ls -l /etc/shadow
    If properly configured, the output should indicate the following permissions:
    -rw-r-----
              
    To check the ownership of /etc/shadow, run the command:
    $ ls -lL /etc/shadow
    If properly configured, the output should indicate the following owner:
    root
              
    To check the group ownership of /etc/shadow, run the command:
    $ ls -lL /etc/shadow
    If properly configured, the output should indicate the following group-owner.
    shadow
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
      <question_text>
              
    To check the permissions of /etc/gshadow, run the command:
    $ ls -l /etc/gshadow
    If properly configured, the output should indicate the following permissions:
    -rw-r-----
              
    To check the ownership of /etc/gshadow, run the command:
    $ ls -lL /etc/gshadow
    If properly configured, the output should indicate the following owner:
    root
              
    To check the group ownership of /etc/gshadow, run the command:
    $ ls -lL /etc/gshadow
    If properly configured, the output should indicate the following group-owner.
    shadow
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_passwd_question:question:1">
      <question_text>
              
    To check the permissions of /etc/passwd, run the command:
    $ ls -l /etc/passwd
    If properly configured, the output should indicate the following permissions:
    -rw-r--r--
              
    To check the ownership of /etc/passwd, run the command:
    $ ls -lL /etc/passwd
    If properly configured, the output should indicate the following owner:
    root
              
    To check the group ownership of /etc/passwd, run the command:
    $ ls -lL /etc/passwd
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_group_question:question:1">
      <question_text>
              
    To check the permissions of /etc/passwd, run the command:
    $ ls -l /etc/passwd
    If properly configured, the output should indicate the following permissions:
    -rw-r--r--
              
    To check the ownership of /etc/passwd, run the command:
    $ ls -lL /etc/passwd
    If properly configured, the output should indicate the following owner:
    root
              
    To check the group ownership of /etc/passwd, run the command:
    $ ls -lL /etc/passwd
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
      <question_text>
              
    The status of the fs.suid_dumpable kernel parameter can be queried
    by running the following command:
    preserve$ sysctl fs.suid_dumpable
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
      <question_text>
              
    The status of the kernel.randomize_va_space kernel parameter can be queried
    by running the following command:
    preserve$ sysctl kernel.randomize_va_space
    The output of the command should indicate a value of 2.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
      <question_text>
              
    The status of the kernel.kptr_restrict kernel parameter can be queried
    by running the following command:
    preserve$ sysctl kernel.kptr_restrict
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_tmp_question:question:1">
      <question_text>
            
    Run the following command to determine if /tmp 
    is on its own partition or logical volume:

  $ mount | grep "on /tmp "
  If /tmp  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_var_question:question:1">
      <question_text>
            
    Run the following command to determine if /var 
    is on its own partition or logical volume:

  $ mount | grep "on /var "
  If /var  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_var_log_question:question:1">
      <question_text>
            
    Run the following command to determine if /var/log 
    is on its own partition or logical volume:

  $ mount | grep "on /var/log "
  If /var/log  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_var_log_audit_question:question:1">
      <question_text>
            
    Run the following command to determine if /var/log/audit 
    is on its own partition or logical volume:

  $ mount | grep "on /var/log/audit "
  If /var/log/audit  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_home_question:question:1">
      <question_text>
            
    Run the following command to determine if /home 
    is on its own partition or logical volume:

  $ mount | grep "on /home "
  If /home  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_srv_question:question:1">
      <question_text>
            
    Run the following command to determine if /home 
    is on its own partition or logical volume:

  $ mount | grep "on /home "
  If /home  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
      <question_text>
            
    The status of the fs.protected_symlinks kernel parameter can be queried
    by running the following command:
    preserve$ sysctl fs.protected_symlinks
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
          
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
      <question_text>
            
    The status of the fs.protected_hardlinks kernel parameter can be queried
    by running the following command:
    preserve$ sysctl fs.protected_hardlinks
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
          
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_rsyslog_installed_question:question:1">
      <question_text>
          
    Run the following command to determine if the rsyslog package is installed:
    $ rpm -q rsyslog
        
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rsyslog_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
rsyslog service:
        $ sudo service rsyslog status
        If the service is enabled, it should return the following: rsyslog is running...
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_files_ownership_question:question:1">
      <question_text>
The owner of all log files written by rsyslog should be root.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the owner of a given log file, run the following command:
$ ls -l LOGFILE

			Is it the case that the owner is not root?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_files_groupownership_question:question:1">
      <question_text>
The group-owner of all log files written by rsyslog should be adm.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the group-owner of a given log file, run the following command:
$ ls -l LOGFILE

			Is it the case that the group-owner is not adm?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_files_permissions_question:question:1">
      <question_text>
The file permissions for all log files written by rsyslog 
should be set to 640, or more restrictive.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the permissions of a given log file, run the following command:
$ ls -l LOGFILE
The permissions should be 640, or more restrictive.

			Is it the case that the permissions are not correct?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_remote_loghost_question:question:1">
      <question_text>
To ensure logs are sent to a remote host, examine the file
/etc/rsyslog.conf.
If using UDP, a line similar to the following should be present:
 *.* @loghost.example.com
If using TCP, a line similar to the following should be present:
 *.* @@loghost.example.com
If using RELP, a line similar to the following should be present:
 *.* :omrelp:loghost.example.com

			Is it the case that none of these are present?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_logrotate_activated_question:question:1">
      <question_text>
To determine the status and frequency of logrotate, run the following command:
$ sudo grep logrotate /var/log/cron*
If logrotate is configured properly, output should include references to 
/etc/cron.daily.

			Is it the case that logrotate is not configured to run daily?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_auditd_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
auditd service:
        $ sudo service auditd status
        If the service is enabled, it should return the following: auditd is running...
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_ntpd_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
ntpd service:
        $ sudo service ntpd status
        If the service is enabled, it should return the following: ntpd is running...
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
      <question_text>
To check which SSH protocol version is allowed, run the following command:
$ sudo grep Protocol /etc/ssh/sshd_config
If configured properly, output should be Protocol 2

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_set_idle_timeout_question:question:1">
      <question_text>
Run the following command to see what the timeout interval is:
$ sudo grep ClientAliveInterval /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveInterval 900

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_set_keepalive_question:question:1">
      <question_text>
To ensure the SSH idle timeout will occur when the ClientAliveCountMax is set, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, output should be:
ClientAliveCountMax 0

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_root_login_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    PermitRootLogin
    option is set, run the following command:
    preserve$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config
      If a line indicating no is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    PermitEmptyPasswords
    option is set, run the following command:
    preserve$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config
      If no line, a commented line, or a line indicating the value
      no is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
  </questions>
</ocil>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-debian8-xccdf-1.2.xml" timestamp="2017-08-11T21:23:22">
    <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.ssgproject.content_benchmark_DEBIAN-8" resolved="1" xml:lang="en-US" style="SCAP_1.2">
  <status date="2017-08-11">draft</status>
  <title xml:lang="en-US">Guide to the Secure Configuration of Debian 8</title>
  <description xml:lang="en-US">This guide presents a catalog of security-relevant
configuration settings for Debian 8. It is a rendering of
content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
in order to support security automation.  The SCAP content is
is available in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">scap-security-guide</html:code> package which is developed at
<html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Providing system administrators with such guidance informs them how to securely
configure systems under their control in a variety of network roles. Policy
makers and baseline creators can use this catalog of settings, with its
associated references to higher-level security control catalogs, in order to
assist them in security baseline creation. This guide is a <html:i xmlns:html="http://www.w3.org/1999/xhtml">catalog, not a
checklist,</html:i> and satisfaction of every item is not likely to be possible or
sensible in many operational scenarios. However, the XCCDF format enables
granular selection and adjustment of settings, and their association with OVAL
and OCIL content provides an automated checking capability. Transformations of
this document, and its associated automated checking content, are capable of
providing baselines that meet a diverse set of policy objectives. Some example
XCCDF <html:i xmlns:html="http://www.w3.org/1999/xhtml">Profiles</html:i>, which are selections of items that form checklists and
can be used as baselines, are available with this guide. They can be
processed, in an automated fashion, with tools that support the Security
Content Automation Protocol (SCAP). The DISA STIG for Debian 8,
which provides required settings for US Department of Defense systems, is
one example of a baseline created from this guidance.
</description>
  <notice xml:lang="en-US" id="terms_of_use">Do not attempt to implement any of the settings in
this guide without first testing them in a non-operational environment. The
creators of this guidance assume no responsibility whatsoever for its use by
other parties, and makes no guarantees, expressed or implied, about its
quality, reliability, or any other characteristic.</notice>
  <front-matter xml:lang="en-US">The SCAP Security Guide Project<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a></front-matter>
  <rear-matter xml:lang="en-US">Red Hat and Red Hat Enterprise Linux are either registered
trademarks or trademarks of Red Hat, Inc. in the United States and other
countries. All other names are registered trademarks or trademarks of their
respective companies.</rear-matter>
  <platform idref="cpe:/o:debianproject:debian:8"/>
  <version update="https://github.com/OpenSCAP/scap-security-guide/releases/latest">0.1.31</version>
  <metadata>
    <dc:publisher xmlns:dc="http://purl.org/dc/elements/1.1/">SCAP Security Guide Project</dc:publisher>
    <dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">SCAP Security Guide Project</dc:creator>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gabe Alford &lt;redhatrises@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Christopher Anderson &lt;cba@fedoraproject.org&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chuck Atkins &lt;chuck.atkins@kitware.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Molly Jo Bault &lt;Molly.Jo.Bault@ballardtech.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joseph Bisch &lt;joseph.bisch@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeffrey Blank &lt;blank@eclipse.ncsc.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Blake Burkhart &lt;blake.burkhart@us.af.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Patrick Callahan &lt;pmc@patrickcallahan.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Carboni &lt;ncarboni@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank Caviggia &lt;fcaviggi@ra.iad.redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Eric Christensen &lt;echriste@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Caleb Cooper &lt;coopercd@ornl.gov&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Maura Dailey &lt;maura@eclipse.ncsc.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Klaas Demter &lt;demter@atix.de&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jean-Baptiste Donnette &lt;jean-baptiste.donnette@epita.fr&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">drax &lt;applezip@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Greg Elin &lt;gregelin@gitmachines.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew Gilmore &lt;agilmore2@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joshua Glemza &lt;jglemza@nasa.gov&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Steve Grubb &lt;sgrubb@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Trey Henefield &lt;thenefield@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Robin Price II &lt;robin@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeremiah Jahn &lt;jeremiah@goodinassociates.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Stephan Joerrens &lt;Stephan.Joerrens@fiduciagad.de&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yuli Khodorkovskiy &lt;ykhodorkovskiy@tresys.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Luke Kordell &lt;luke.t.kordell@lmco.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">kspargur &lt;kspargur@kspargur.csb&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Fen Labalme &lt;fen@civicactions.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Lieskovsky &lt;jlieskov@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">&#352;imon Luka&#353;&#237;k &lt;slukasik@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jamie Lorwey Martin &lt;jlmartin@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael McConachie &lt;michael@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rodney Mercer &lt;rmercer@harris.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Millett &lt;bmillett@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">mmosel &lt;mmosel@kde.example.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Zbynek Moravec &lt;zmoravec@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kazuo Moriwaka &lt;moriwaka@users.noreply.github.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael Moseley &lt;michael@eclipse.ncsc.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joe Nall &lt;joe@nall.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michele Newman &lt;mnewman@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kaustubh Padegaonkar &lt;theTuxRacer@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael Palmiotto &lt;mpalmiotto@tresys.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">pcactr &lt;paul.c.arnold4.ctr@mail.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenneth Peeples &lt;kennethwpeeples@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank Lin PIAT &lt;fpiat@klabs.be&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Martin Preisler &lt;mpreisle@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">T.O. Radzy Radzykewycz &lt;radzy@windriver.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rick Renshaw &lt;Richard_Renshaw@xtoenergy.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chris Reynolds &lt;c.reynolds82@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Pat Riehecky &lt;riehecky@fnal.gov&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joshua Roys &lt;roysjosh@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rrenshaw &lt;bofh69@yahoo.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ray Shaw (Cont ARL/CISD) rvshaw &lt;rvshaw@esme.arl.army.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Willy Santos &lt;wsantos@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gautam Satish &lt;gautams@hpe.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Watson Sato &lt;wsato@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Satoru SATOH &lt;satoru.satoh@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Spencer Shimko &lt;sshimko@tresys.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Francisco Slavin &lt;fslavin@tresys.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">David Smith &lt;dsmith@eclipse.ncsc.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kevin Spargur &lt;kspargur@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenneth Stailey &lt;kstailey.lists@gmail.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Leland Steinke &lt;leland.j.steinke.ctr@mail.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Philippe Thierry &lt;phil@reseau-libre.net&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Paul Tittle &lt;ptittle@cmf.nrl.navy.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeb Trayer &lt;jeb.d.trayer@uscg.mil&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Shawn Wells &lt;shawn@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rob Wilmoth &lt;rwilmoth@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lucas Yamanishi &lt;lucas.yamanishi@onyxpoint.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kevin Zimmerman &lt;kevin.zimmerman@kitware.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan &#268;ern&#253; &lt;jcerny@redhat.com&gt;</dc:contributor>
    <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michal &#352;ruba&#345; &lt;msrubar@redhat.com&gt;</dc:contributor>
    <dc:source xmlns:dc="http://purl.org/dc/elements/1.1/">https://github.com/OpenSCAP/scap-security-guide/releases/latest</dc:source>
  </metadata>
  <model system="urn:xccdf:scoring:default"/>
  <Profile id="xccdf_org.ssgproject.content_profile_common">
    <title xml:lang="en-US">Common Profile for General-Purpose Debian Systems</title>
    <description xml:lang="en-US">This profile contains items common to general-purpose Debian 8 installations.</description>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_auditd_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cron_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntp_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_cron_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="5_minutes"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal">
    <title xml:lang="en-US">Profile for ANSSI DAT-NT28 Minimal Level</title>
    <description xml:lang="en-US">This profile contains items to be applied systematically.</description>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_permission_important_state_files" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_restriction" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_fs-part" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_installation-storage-partitioning" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_fs-restrict" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_logging" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_basics" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ssh" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ssh_server" selected="false"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_anssi_np_nt28_average">
    <title xml:lang="en-US" override="true">Profile for ANSSI DAT-NT28 Average (Intermediate) Level</title>
    <description xml:lang="en-US" override="true">This profile contains items for GNU/Linux installations already protected by multiple higher level security stacks.</description>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntp_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="5_minutes"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive">
    <title xml:lang="en-US" override="true">Profile for ANSSI DAT-NT28 Restrictive Level</title>
    <description xml:lang="en-US" override="true">This profile contains items for GNU/Linux installations exposed to unauthenticated flows or multiple sources.</description>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntp_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_auditd_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cron_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="5_minutes"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_anssi_np_nt28_high">
    <title xml:lang="en-US" override="true">Profile for ANSSI DAT-NT28 High (Enforced) Level</title>
    <description xml:lang="en-US" override="true">This profile contains items for GNU/Linux installations storing sensitive informations that can be accessible from unauthenticated or uncontroled networks.</description>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntp_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_auditd_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cron_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_software" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_accounts-restrictions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="5_minutes"/>
  </Profile>
  <Group id="xccdf_org.ssgproject.content_group_remediation_functions">
    <title xml:lang="en-US">Remediation functions used by the SCAP Security Guide Project</title>
    <description xml:lang="en-US">XCCDF form of the various remediation functions as used by
remediation scripts from the SCAP Security Guide Project</description>
    <Value id="xccdf_org.ssgproject.content_value_function_fix_audit_syscall_rule" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to fix syscall audit rule for given system call</title>
      <description xml:lang="en-US">Function to fix syscall audit rule for given system call. It is
based on example audit syscall rule definitions as outlined in
/usr/share/doc/audit-2.3.7/stig.rules file provided with the audit package. It
will combine multiple system calls belonging to the same syscall group into one
audit rule (rather than to create audit rule per different system call) to
avoid audit infrastructure performance penalty in the case of
'one-audit-rule-definition-per-one-system-call'. See:

	https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html

for further details.

Expects five arguments (each of them is required) in the form of:
  * audit tool                          tool used to load audit rules,
                                        either 'auditctl', or 'augenrules
  * audit rules' pattern                audit rule skeleton for same syscall
  * syscall group                       greatest common string this rule shares
                                        with other rules from the same group
  * architecture                        architecture this rule is intended for
  * full form of new rule to add        expected full form of audit rule as to
                                        be added into audit.rules file

Note: The 2-th up to 4-th arguments are used to determine how many existing
audit rules will be inspected for resemblance with the new audit rule
(5-th argument) the function is going to add. The rule's similarity check
is performed to optimize audit.rules definition (merge syscalls of the same
group into one rule) to avoid the "single-syscall-per-audit-rule" performance
penalty.

Example call:

  PATTERN="-a always,exit -F arch=$ARCH -S .* -F auid&gt;=500 -F auid!=4294967295 -k delete"
  # Use escaped BRE regex to specify rule group
  GROUP="\(rmdir\|unlink\|rename\)"
  FULL_RULE="-a always,exit -F arch=$ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid&gt;=500 -F auid!=4294967295 -k delete"
  fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
</description>
      <value>
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
        echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
        echo "Aborting."
        exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
        echo "Unknown audit rules loading tool: $1. Aborting."
        echo "Use either 'auditctl' or 'augenrules'!"
        exit 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
        files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
        # Extract audit $key from audit rule so we can use it later
        key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)')
        # Check if particular audit rule is already defined
        IFS=$'\n' matches=($(sed -s -n -e "/${pattern}/!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules))
        # Reset IFS back to default
        unset $IFS
        for match in "${matches[@]}"
        do
                files_to_inspect=("${files_to_inspect[@]}" "${match}")
        done
        # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
        if [ ${#files_to_inspect[@]} -eq "0" ]
        then
                files_to_inspect="/etc/audit/rules.d/$key.rules"
                if [ ! -e "$files_to_inspect" ]
                then
                        touch "$files_to_inspect"
                        chmod 0640 "$files_to_inspect"
                fi
        fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do

        # Filter existing $audit_file rules' definitions to select those that:
        # * follow the rule pattern, and
        # * meet the hardware architecture requirement, and
        # * are current syscall group specific
        IFS=$'\n' existing_rules=($(sed -e "/${pattern}/!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file"))
        # Reset IFS back to default
        unset $IFS

        # Process rules found case-by-case
        for rule in "${existing_rules[@]}"
        do
                # Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
                if [ "${rule}" != "${full_rule}" ]
                then
                        # If so, isolate just '(-S \w)+' substring of that rule
                        rule_syscalls=$(echo $rule | grep -o -P '(-S \w+ )+')
                        # Check if list of '-S syscall' arguments of that rule is subset
                        # of '-S syscall' list of expected $full_rule
                        if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
                        then
                                # Rule is covered (i.e. the list of -S syscalls for this rule is
                                # subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
                                # Thus delete the rule from audit.rules &amp; our array
                                sed -i -e "/$rule/d" "$audit_file"
                                existing_rules=("${existing_rules[@]//$rule/}")
                        else
                                # Rule isn't covered by $full_rule - it besides -S syscall arguments
                                # for this group contains also -S syscall arguments for other syscall
                                # group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
                                # since 'lchown' &amp; 'fchownat' share 'chown' substring
                                # Therefore:
                                # * 1) delete the original rule from audit.rules
                                # (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
                                # * 2) delete the -S syscall arguments for this syscall group, but
                                # keep those not belonging to this syscall group
                                # (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
                                # * 3) append the modified (filtered) rule again into audit.rules
                                # if the same rule not already present
                                #
                                # 1) Delete the original rule
                                sed -i -e "/$rule/d" "$audit_file"
                                # 2) Delete syscalls for this group, but keep those from other groups
                                # Convert current rule syscall's string into array splitting by '-S' delimiter
                                IFS=$'-S' read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
                                # Reset IFS back to default
                                unset $IFS
                                # Declare new empty string to hold '-S syscall' arguments from other groups
                                new_syscalls_for_rule=''
                                # Walk through existing '-S syscall' arguments
                                for syscall_arg in "${rule_syscalls_as_array[@]}"
                                do
                                        # Skip empty $syscall_arg values
                                        if [ "$syscall_arg" == '' ]
                                        then
                                                continue
                                        fi
                                        # If the '-S syscall' doesn't belong to current group add it to the new list
                                        # (together with adding '-S' delimiter back for each of such item found)
                                        if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
                                        then
                                                new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
                                        fi
                                done
                                # Replace original '-S syscall' list with the new one for this rule
                                updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
                                # Squeeze repeated whitespace characters in rule definition (if any) into one
                                updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
                                # 3) Append the modified / filtered rule again into audit.rules
                                #    (but only in case it's not present yet to prevent duplicate definitions)
                                if ! grep -q -- "$updated_rule" "$audit_file"
                                then
                                        echo "$updated_rule" &gt;&gt; "$audit_file"
                                fi
                        fi
                else
                        # $audit_file already contains the expected rule form for this
                        # architecture &amp; key =&gt; don't insert it second time
                        append_expected_rule=1
                fi
        done

        # We deleted all rules that were subset of the expected one for this arch &amp; key.
        # Also isolated rules containing system calls not from this system calls group.
        # Now append the expected rule if it's not present in $audit_file yet
        if [[ ${append_expected_rule} -eq "0" ]]
        then
                echo "$full_rule" &gt;&gt; "$audit_file"
        fi
done

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_fix_audit_watch_rule" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to fix audit file system object watch rule for given path</title>
      <description xml:lang="en-US">Function to fix audit file system object watch rule for given path:
  * if rule exists, also verifies the -w bits match the requirements
  * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
    audit rules file, depending on the tool which was used to load audit rules

Expects four arguments (each of them is required) in the form of:
  * audit tool                          tool used to load audit rules,
                                        either 'auditctl', or 'augenrules'
  * path                                value of -w audit rule's argument
  * required access bits                value of -p audit rule's argument
  * key                                 value of -k audit rule's argument

Example call:

  fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
</description>
      <value>
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
        echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
        echo "Aborting."
        exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#       auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#       augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#       augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
        echo "Unknown audit rules loading tool: $1. Aborting."
        echo "Use either 'auditctl' or 'augenrules'!"
        exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
        files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
        # Case when particular audit rule is already defined in some of /etc/audit/rules.d/*.rules file
        # Get pair -- filepath : matching_row into @matches array
        IFS=$'\n' matches=($(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules))
        # Reset IFS back to default
        unset $IFS
        # For each of the matched entries
        for match in "${matches[@]}"
        do
                # Extract filepath from the match
                rulesd_audit_file=$(echo $match | cut -f1 -d ':')
                # Append that path into list of files for inspection
                files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file")
        done
        # Case when particular audit rule isn't defined yet
        if [ ${#files_to_inspect[@]} -eq "0" ]
        then
                # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
                files_to_inspect="/etc/audit/rules.d/$key.rules"
                # If the $key.rules file doesn't exist yet, create it with correct permissions
                if [ ! -e "$files_to_inspect" ]
                then
                        touch "$files_to_inspect"
                        chmod 0640 "$files_to_inspect"
                fi
        fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

        # Check if audit watch file system object rule for given path already present
        if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
        then
                # Rule is found =&gt; verify yet if existing rule definition contains
                # all of the required access type bits

                # Escape slashes in path for use in sed pattern below
                local esc_path=${path//$'/'/$'\/'}
                # Define BRE whitespace class shortcut
                local sp="[[:space:]]"
                # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
                current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
                # Split required access bits string into characters array
                # (to check bit's presence for one bit at a time)
                for access_bit in $(echo "$required_access_bits" | grep -o .)
                do
                        # For each from the required access bits (e.g. 'w', 'a') check
                        # if they are already present in current access bits for rule.
                        # If not, append that bit at the end
                        if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
                        then
                                # Concatenate the existing mask with the missing bit
                                current_access_bits="$current_access_bits$access_bit"
                        fi
                done
                # Propagate the updated rule's access bits (original + the required
                # ones) back into the /etc/audit/audit.rules file for that rule
                sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
        else
                # Rule isn't present yet. Append it at the end of $audit_rules_file file
                # with proper key

                echo "-w $path -p $required_access_bits -k $key" &gt;&gt; "$audit_rules_file"
        fi
done
}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_package_command" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to to install or uninstall packages on RHEL and Fedora systems</title>
      <description xml:lang="en-US">Function to install or uninstall packages on RHEL and Fedora systems.

Example Call(s):

  package_command install aide
  package_command remove telnet-server
</description>
      <value>
function package_command {

# Load function arguments into local variables
local package_operation=$1
local package=$2

# Check sanity of the input
if [ $# -ne "2" ]
then
  echo "Usage: package_command 'install/uninstall' 'rpm_package_name"
  echo "Aborting."
  exit 1
fi

# If dnf is installed, use dnf; otherwise, use yum
if [ -f "/usr/bin/dnf" ] ; then
  install_util="/usr/bin/dnf"
else
  install_util="/usr/bin/yum"
fi

if [ "$package_operation" != 'remove' ] ; then
  # If the rpm is not installed, install the rpm
  if ! /bin/rpm -q --quiet $package; then
    $install_util -y $package_operation $package
  fi
else
  # If the rpm is installed, uninstall the rpm
  if /bin/rpm -q --quiet $package; then
    $install_util -y $package_operation $package
  fi
fi

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_service_command" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to enable/disable and start/stop services on RHEL
and Fedora systems</title>
      <description xml:lang="en-US">Function to enable/disable and start/stop services on RHEL and
Fedora systems.

Example Call(s):

  service_command enable bluetooth
  service_command disable bluetooth.service

  Using xinetd:
  service_command disable rsh.socket xinetd=rsh
</description>
      <value>
function service_command {

# Load function arguments into local variables
local service_state=$1
local service=$2
local xinetd=$(echo $3 | cut -d'=' -f2)

# Check sanity of the input
if [ $# -lt "2" ]
then
  echo "Usage: service_command 'enable/disable' 'service_name.service'"
  echo
  echo "To enable or disable xinetd services add \'xinetd=service_name\'"
  echo "as the last argument"
  echo "Aborting."
  exit 1
fi

# If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands
if [ -f "/usr/bin/systemctl" ] ; then
  service_util="/usr/bin/systemctl"
else
  service_util="/sbin/service"
  chkconfig_util="/sbin/chkconfig"
fi

# If disable is not specified in arg1, set variables to enable services.
# Otherwise, variables are to be set to disable services.
if [ "$service_state" != 'disable' ] ; then
  service_state="enable"
  service_operation="start"
  chkconfig_state="on"
else
  service_state="disable"
  service_operation="stop"
  chkconfig_state="off"
fi

# If chkconfig_util is not empty, use chkconfig/service commands.
if ! [ "x$chkconfig_util" = x ] ; then
  $service_util $service $service_operation
  $chkconfig_util --level 0123456 $service $chkconfig_state
else
  $service_util $service_operation $service
  $service_util $service_state $service
fi

# Test if local variable xinetd is empty using non-bashism.
# If empty, then xinetd is not being used.
if ! [ "x$xinetd" = x ] ; then
  grep -qi disable /etc/xinetd.d/$xinetd &amp;&amp; \

  if ! [ "$service_operation" != 'disable' ] ; then
    sed -i "s/disable.*/disable         = no/gI" /etc/xinetd.d/$xinetd
  else
    sed -i "s/disable.*/disable         = yes/gI" /etc/xinetd.d/$xinetd
  fi
fi

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_perform_audit_rules_privileged_commands_remediation" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to perform remediation for 'audit_rules_privileged_commands' rule</title>
      <description xml:lang="en-US">Function to perform remediation for 'audit_rules_privileged_commands' rule

Expects two arguments:

  audit_tool            tool used to load audit rules
                        One of 'auditctl' or 'augenrules'

  min_auid              Minimum original ID the user logged in with
                        '500' for RHEL-6 and before, '1000' for RHEL-7 and after.

Example Call(s):

  perform_audit_rules_privileged_commands_remediation "auditctl" "500"
  perform_audit_rules_privileged_commands_remediation "augenrules" "1000"
</description>
      <value>
function perform_audit_rules_privileged_commands_remediation {
#
# Load function arguments into local variables
local tool="$1"
local min_auid="$2"

# Check sanity of the input
if [ $# -ne "2" ]
then
        echo "Usage: perform_audit_rules_privileged_commands_remediation 'auditctl | augenrules' '500 | 1000'"
        echo "Aborting."
        exit 1
fi

declare -a files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
        echo "Unknown audit rules loading tool: $1. Aborting."
        echo "Use either 'auditctl' or 'augenrules'!"
        exit 1
# If the audit tool is 'auditctl', then:
# * add '/etc/audit/audit.rules'to the list of files to be inspected,
# * specify '/etc/audit/audit.rules' as the output audit file, where
#   missing rules should be inserted
elif [ "$tool" == 'auditctl' ]
then
        files_to_inspect=("/etc/audit/audit.rules")
        output_audit_file="/etc/audit/audit.rules"
#
# If the audit tool is 'augenrules', then:
# * add '/etc/audit/rules.d/*.rules' to the list of files to be inspected
#   (split by newline),
# * specify /etc/audit/rules.d/privileged.rules' as the output file, where
#   missing rules should be inserted
elif [ "$tool" == 'augenrules' ]
then
        IFS=$'\n' files_to_inspect=($(find /etc/audit/rules.d -maxdepth 1 -type f -name *.rules -print))
        output_audit_file="/etc/audit/rules.d/privileged.rules"
fi

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
IFS=$'\n' privileged_binaries=($(find / -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null))

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
declare -a sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

        # Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
        sbinary_esc=${sbinary//$'/'/$'\/'}
        # Check if this sbinary wasn't already handled in some of the previous iterations
        # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
        if [[ $(sed -ne "/${sbinary_esc}$/p" &lt;&lt;&lt; ${sbinaries_to_skip[@]}) ]]
        then
                # If so, don't process it second time &amp; go to process next sbinary
                continue
        fi

        # Reset the counter of inspected files when starting to check
        # presence of existing audit rule for new sbinary
        local count_of_inspected_files=0

        # For each audit rules file from the list of files to be inspected
        for afile in "${files_to_inspect[@]}"
        do

                # Search current audit rules file's content for match. Match criteria:
                # * existing rule is for the same SUID/SGID binary we are currently processing (but
                #   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
                # * existing rule contains all arguments from expected rule form (though can contain
                #   them in arbitrary order)

                base_search=$(sed -e "/-a always,exit/!d" -e "/-F path=${sbinary_esc}$/!d"   \
                                  -e "/-F path=[^[:space:]]\+/!d" -e "/-F perm=.*/!d"       \
                                  -e "/-F auid&gt;=${min_auid}/!d" -e "/-F auid!=4294967295/!d"  \
                                  -e "/-k privileged/!d" $afile)

                # Increase the count of inspected files for this sbinary
                count_of_inspected_files=$((count_of_inspected_files + 1))

                # Define expected rule form for this binary
                expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid&gt;=${min_auid} -F auid!=4294967295 -k privileged"

                # Require execute access type to be set for existing audit rule
                exec_access='x'

                # Search current audit rules file's content for presence of rule pattern for this sbinary
                if [[ $base_search ]]
                then

                        # Current audit rules file already contains rule for this binary =&gt;
                        # Store the exact form of found rule for this binary for further processing
                        concrete_rule=$base_search

                        # Select all other SUID/SGID binaries possibly also present in the found rule
                        IFS=$'\n' handled_sbinaries=($(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; $concrete_rule))
                        IFS=$' ' handled_sbinaries=(${handled_sbinaries[@]//-F path=/})

                        # Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
                        sbinaries_to_skip=($(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo $i; done | sort -du))

                        # Separate concrete_rule into three sections using hash '#'
                        # sign as a delimiter around rule's permission section borders
                        concrete_rule=$(echo $concrete_rule | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\)\+/\1#\2#/p")

                        # Split concrete_rule into head, perm, and tail sections using hash '#' delimiter
                        IFS=$'#' read rule_head rule_perm rule_tail &lt;&lt;&lt;  "$concrete_rule"

                        # Extract already present exact access type [r|w|x|a] from rule's permission section
                        access_type=${rule_perm//-F perm=/}

                        # Verify current permission access type(s) for rule contain 'x' (execute) permission
                        if ! grep -q "$exec_access" &lt;&lt;&lt; "$access_type"
                        then

                                # If not, append the 'x' (execute) permission to the existing access type bits
                                access_type="$access_type$exec_access"
                                # Reconstruct the permissions section for the rule
                                new_rule_perm="-F perm=$access_type"
                                # Update existing rule in current audit rules file with the new permission section
                                sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${new_rule_perm}${rule_tail}#" $afile

                        fi

                # If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
                #
                # * in the "auditctl" mode of operation insert particular rule each time
                #   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
                #
                # * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
                #   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
                #   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
                #
                elif [ "$tool" == "auditctl" ] || [[ "$tool" == "augenrules" &amp;&amp; $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
                then

                        # Current audit rules file's content doesn't contain expected rule for this
                        # SUID/SGID binary yet =&gt; append it
                        echo $expected_rule &gt;&gt; $output_audit_file
                fi

        done

done

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_populate" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to populate environment variables needed for unit testing</title>
      <description xml:lang="en-US">The populate function isn't directly used by SSG at the moment but it can
ba used for testing purposes (to verify proper work of the remediation script directly
from the shell).</description>
      <value>
function populate {
# Code to populate environment variables needed (for unit testing)
if [ -z "${!1}" ]; then
	echo "$1 is not defined. Exiting."
	exit
fi
}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_rhel6_perform_audit_adjtimex_settimeofday_stime_remediation" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function for the 'adjtimex', 'settimeofday', and 'stime'
audit system calls on Red Hat Enterprise Linux 6</title>
      <description xml:lang="en-US">Perform the remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on Red Hat Enterprise Linux 6 OS</description>
      <value>
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
        echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
        echo "Aborting."
        exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
        echo "Unknown audit rules loading tool: $1. Aborting."
        echo "Use either 'auditctl' or 'augenrules'!"
        exit 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
        files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
        # Extract audit $key from audit rule so we can use it later
        key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)')
        # Check if particular audit rule is already defined
        IFS=$'\n' matches=($(sed -s -n -e "/${pattern}/!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules))
        # Reset IFS back to default
        unset $IFS
        for match in "${matches[@]}"
        do
                files_to_inspect=("${files_to_inspect[@]}" "${match}")
        done
        # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
        if [ ${#files_to_inspect[@]} -eq "0" ]
        then
                files_to_inspect="/etc/audit/rules.d/$key.rules"
                if [ ! -e "$files_to_inspect" ]
                then
                        touch "$files_to_inspect"
                        chmod 0640 "$files_to_inspect"
                fi
        fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do

        # Filter existing $audit_file rules' definitions to select those that:
        # * follow the rule pattern, and
        # * meet the hardware architecture requirement, and
        # * are current syscall group specific
        IFS=$'\n' existing_rules=($(sed -e "/${pattern}/!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file"))
        # Reset IFS back to default
        unset $IFS

        # Process rules found case-by-case
        for rule in "${existing_rules[@]}"
        do
                # Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
                if [ "${rule}" != "${full_rule}" ]
                then
                        # If so, isolate just '(-S \w)+' substring of that rule
                        rule_syscalls=$(echo $rule | grep -o -P '(-S \w+ )+')
                        # Check if list of '-S syscall' arguments of that rule is subset
                        # of '-S syscall' list of expected $full_rule
                        if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
                        then
                                # Rule is covered (i.e. the list of -S syscalls for this rule is
                                # subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
                                # Thus delete the rule from audit.rules &amp; our array
                                sed -i -e "/$rule/d" "$audit_file"
                                existing_rules=("${existing_rules[@]//$rule/}")
                        else
                                # Rule isn't covered by $full_rule - it besides -S syscall arguments
                                # for this group contains also -S syscall arguments for other syscall
                                # group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
                                # since 'lchown' &amp; 'fchownat' share 'chown' substring
                                # Therefore:
                                # * 1) delete the original rule from audit.rules
                                # (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
                                # * 2) delete the -S syscall arguments for this syscall group, but
                                # keep those not belonging to this syscall group
                                # (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
                                # * 3) append the modified (filtered) rule again into audit.rules
                                # if the same rule not already present
                                #
                                # 1) Delete the original rule
                                sed -i -e "/$rule/d" "$audit_file"
                                # 2) Delete syscalls for this group, but keep those from other groups
                                # Convert current rule syscall's string into array splitting by '-S' delimiter
                                IFS=$'-S' read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
                                # Reset IFS back to default
                                unset $IFS
                                # Declare new empty string to hold '-S syscall' arguments from other groups
                                new_syscalls_for_rule=''
                                # Walk through existing '-S syscall' arguments
                                for syscall_arg in "${rule_syscalls_as_array[@]}"
                                do
                                        # Skip empty $syscall_arg values
                                        if [ "$syscall_arg" == '' ]
                                        then
                                                continue
                                        fi
                                        # If the '-S syscall' doesn't belong to current group add it to the new list
                                        # (together with adding '-S' delimiter back for each of such item found)
                                        if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
                                        then
                                                new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
                                        fi
                                done
                                # Replace original '-S syscall' list with the new one for this rule
                                updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
                                # Squeeze repeated whitespace characters in rule definition (if any) into one
                                updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
                                # 3) Append the modified / filtered rule again into audit.rules
                                #    (but only in case it's not present yet to prevent duplicate definitions)
                                if ! grep -q -- "$updated_rule" "$audit_file"
                                then
                                        echo "$updated_rule" &gt;&gt; "$audit_file"
                                fi
                        fi
                else
                        # $audit_file already contains the expected rule form for this
                        # architecture &amp; key =&gt; don't insert it second time
                        append_expected_rule=1
                fi
        done

        # We deleted all rules that were subset of the expected one for this arch &amp; key.
        # Also isolated rules containing system calls not from this system calls group.
        # Now append the expected rule if it's not present in $audit_file yet
        if [[ ${append_expected_rule} -eq "0" ]]
        then
                echo "$full_rule" &gt;&gt; "$audit_file"
        fi
done

}

function rhel6_perform_audit_adjtimex_settimeofday_stime_remediation {

# Perform the remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on Red Hat Enterprise Linux 6 OS
#
# Retrieve hardware architecture of the underlying system
[ $(getconf LONG_BIT) = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
        PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
        # Create expected audit group and audit rule form for particular system call &amp; architecture
        if [ ${ARCH} = "b32" ]
        then
                # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
                # so append it to the list of time group system calls to be audited
                GROUP="\(adjtimex\|settimeofday\|stime\)"
                FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
        elif [ ${ARCH} = "b64" ]
        then
                # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
                # therefore don't add it to the list of time group system calls to be audited
                GROUP="\(adjtimex\|settimeofday\)"
                FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
        fi
        # Perform the remediation itself
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_rhel7_fedora_perform_audit_adjtimex_settimeofday_stime_remediation" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function for the 'adjtimex', 'settimeofday', and 'stime'
audit system calls on Red Hat Enterprise Linux 7 or Fedora</title>
      <description xml:lang="en-US">Perform the remediation for the 'adjtimex', 'settimeofday', and
'stime' audit system calls on Red Hat Enterprise Linux 7 or Fedora OSes</description>
      <value>
function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local pattern="$2"
local group="$3"
local arch="$4"
local full_rule="$5"

# Check sanity of the input
if [ $# -ne "5" ]
then
        echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'"
        echo "Aborting."
        exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] &amp;&amp; [ "$tool" != 'augenrules' ]
then
        echo "Unknown audit rules loading tool: $1. Aborting."
        echo "Use either 'auditctl' or 'augenrules'!"
        exit 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
        files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
        # Extract audit $key from audit rule so we can use it later
        key=$(expr "$full_rule" : '.*-k[[:space:]]\([^[:space:]]\+\)')
        # Check if particular audit rule is already defined
        IFS=$'\n' matches=($(sed -s -n -e "/${pattern}/!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/*.rules))
        # Reset IFS back to default
        unset $IFS
        for match in "${matches[@]}"
        do
                files_to_inspect=("${files_to_inspect[@]}" "${match}")
        done
        # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
        if [ ${#files_to_inspect[@]} -eq "0" ]
        then
                files_to_inspect="/etc/audit/rules.d/$key.rules"
                if [ ! -e "$files_to_inspect" ]
                then
                        touch "$files_to_inspect"
                        chmod 0640 "$files_to_inspect"
                fi
        fi
fi

#
# Indicator that we want to append $full_rule into $audit_file by default
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do

        # Filter existing $audit_file rules' definitions to select those that:
        # * follow the rule pattern, and
        # * meet the hardware architecture requirement, and
        # * are current syscall group specific
        IFS=$'\n' existing_rules=($(sed -e "/${pattern}/!d" -e "/${arch}/!d" -e "/${group}/!d"  "$audit_file"))
        # Reset IFS back to default
        unset $IFS

        # Process rules found case-by-case
        for rule in "${existing_rules[@]}"
        do
                # Found rule is for same arch &amp; key, but differs (e.g. in count of -S arguments)
                if [ "${rule}" != "${full_rule}" ]
                then
                        # If so, isolate just '(-S \w)+' substring of that rule
                        rule_syscalls=$(echo $rule | grep -o -P '(-S \w+ )+')
                        # Check if list of '-S syscall' arguments of that rule is subset
                        # of '-S syscall' list of expected $full_rule
                        if grep -q -- "$rule_syscalls" &lt;&lt;&lt; "$full_rule"
                        then
                                # Rule is covered (i.e. the list of -S syscalls for this rule is
                                # subset of -S syscalls of $full_rule =&gt; existing rule can be deleted
                                # Thus delete the rule from audit.rules &amp; our array
                                sed -i -e "/$rule/d" "$audit_file"
                                existing_rules=("${existing_rules[@]//$rule/}")
                        else
                                # Rule isn't covered by $full_rule - it besides -S syscall arguments
                                # for this group contains also -S syscall arguments for other syscall
                                # group. Example: '-S lchown -S fchmod -S fchownat' =&gt; group='chown'
                                # since 'lchown' &amp; 'fchownat' share 'chown' substring
                                # Therefore:
                                # * 1) delete the original rule from audit.rules
                                # (original '-S lchown -S fchmod -S fchownat' rule would be deleted)
                                # * 2) delete the -S syscall arguments for this syscall group, but
                                # keep those not belonging to this syscall group
                                # (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod'
                                # * 3) append the modified (filtered) rule again into audit.rules
                                # if the same rule not already present
                                #
                                # 1) Delete the original rule
                                sed -i -e "/$rule/d" "$audit_file"
                                # 2) Delete syscalls for this group, but keep those from other groups
                                # Convert current rule syscall's string into array splitting by '-S' delimiter
                                IFS=$'-S' read -a rule_syscalls_as_array &lt;&lt;&lt; "$rule_syscalls"
                                # Reset IFS back to default
                                unset $IFS
                                # Declare new empty string to hold '-S syscall' arguments from other groups
                                new_syscalls_for_rule=''
                                # Walk through existing '-S syscall' arguments
                                for syscall_arg in "${rule_syscalls_as_array[@]}"
                                do
                                        # Skip empty $syscall_arg values
                                        if [ "$syscall_arg" == '' ]
                                        then
                                                continue
                                        fi
                                        # If the '-S syscall' doesn't belong to current group add it to the new list
                                        # (together with adding '-S' delimiter back for each of such item found)
                                        if grep -q -v -- "$group" &lt;&lt;&lt; "$syscall_arg"
                                        then
                                                new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg"
                                        fi
                                done
                                # Replace original '-S syscall' list with the new one for this rule
                                updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule}
                                # Squeeze repeated whitespace characters in rule definition (if any) into one
                                updated_rule=$(echo "$updated_rule" | tr -s '[:space:]')
                                # 3) Append the modified / filtered rule again into audit.rules
                                #    (but only in case it's not present yet to prevent duplicate definitions)
                                if ! grep -q -- "$updated_rule" "$audit_file"
                                then
                                        echo "$updated_rule" &gt;&gt; "$audit_file"
                                fi
                        fi
                else
                        # $audit_file already contains the expected rule form for this
                        # architecture &amp; key =&gt; don't insert it second time
                        append_expected_rule=1
                fi
        done

        # We deleted all rules that were subset of the expected one for this arch &amp; key.
        # Also isolated rules containing system calls not from this system calls group.
        # Now append the expected rule if it's not present in $audit_file yet
        if [[ ${append_expected_rule} -eq "0" ]]
        then
                echo "$full_rule" &gt;&gt; "$audit_file"
        fi
done

}

function rhel7_fedora_perform_audit_adjtimex_settimeofday_stime_remediation {

# Perform the remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on Red Hat Enterprise Linux 7 or Fedora OSes
#
# Retrieve hardware architecture of the underlying system
[ $(getconf LONG_BIT) = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

        PATTERN="-a always,exit -F arch=${ARCH} -S .* -k *"
        # Create expected audit group and audit rule form for particular system call &amp; architecture
        if [ ${ARCH} = "b32" ]
        then
                # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
                # so append it to the list of time group system calls to be audited
                GROUP="\(adjtimex\|settimeofday\|stime\)"
                FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -S stime -k audit_time_rules"
        elif [ ${ARCH} = "b64" ]
        then
                # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
                # therefore don't add it to the list of time group system calls to be audited
                GROUP="\(adjtimex\|settimeofday\)"
                FULL_RULE="-a always,exit -F arch=${ARCH} -S adjtimex -S settimeofday -k audit_time_rules"
        fi
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
        fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
        fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE"
done

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_replace_or_append" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to replace configuration setting in config file or
add the configuration setting if it does not exist yet</title>
      <description xml:lang="en-US">Function to replace configuration setting in config file or add
the configuration setting if it does not exist.

Expects four arguments:

  config_file:		Configuration file that will be modified
  key:			Configuration option to change
  value:		Value of the configuration option to change
  cce:			The CCE identifier or '$CCENUM' if no CCE identifier exists

Optional arguments:

  format:		Optional argument to specify the format of how key/value should be
			modified/appended in the configuration file. The default is key = value.

Example Call(s):

  With default format of 'key = value':
  replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '$CCENUM'

  With custom key/value format:
  replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '$CCENUM' '%s=%s'

  With a variable:
  replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '$CCENUM' '%s=%s'
</description>
      <value>
function replace_or_append {
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  # Check sanity of the input
  if [ $# -lt "3" ]
  then
        echo "Usage: replace_or_append 'config_file_location' 'key_to_search' 'new_value'"
        echo
        echo "If symlinks need to be taken into account, add yes/no to the last argument"
        echo "to allow to 'follow_symlinks'."
        echo "Aborting."
        exit 1
  fi

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  if test -L $config_file; then
    sed_command="sed -i --follow-symlinks"
  else
    sed_command="sed -i"
  fi

  # Test that the cce arg is not empty or does not equal $CCENUM.
  # If $CCENUM exists, it means that there is no CCE assigned.
  if ! [ "x$cce" = x ] &amp;&amp; [ "$cce" != '$CCENUM' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed "s/[\^=\$,;+]*//g" &lt;&lt;&lt; $key)

  # If there is no print format specified in the last arg, use the default format.
  if ! [ "x$format" = x ] ; then
    printf -v formatted_output "$format" $stripped_key $value
  else
    formatted_output="$stripped_key = $value"
  fi

  # If the key exists, change it. Otherwise, add it to the config_file.
  if `grep -qi $key $config_file` ; then
    $sed_command "s/$key.*/$formatted_output/g" $config_file
  else
    echo -ne "\n# Per $cce: Set $formatted_output in $config_file" &gt;&gt; $config_file
    echo -ne "\n$formatted_output" &gt;&gt; $config_file
  fi

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_firefox_js_setting" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to replace configuration setting(s) in the Firefox
preferences JavaScript file or add the preference if it does not exist yet</title>
      <description xml:lang="en-US">Function to replace configuration setting(s) in the Firefox
preferences JavaScript file or add the preference if it does not exist.

Expects three arguments:

  config_file:          Configuration file that will be modified
  key:                  Configuration option to change
  value:                Value of the configuration option to change


Example Call(s):

  Without string or variable:
  firefox_js_setting "stig_settings.js" "general.config.obscure_value" "0"

  With string:
  firefox_js_setting "stig_settings.js" "general.config.filename" "\"stig.cfg\""

  With a string variable:
  firefox_js_setting "stig_settings.js" "general.config.filename" "\"$var_config_file_name\""
</description>
      <value>
function firefox_js_setting {
  local firefox_js=$1
  local key=$2
  local value=$3
  local firefox_dirs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
  local firefox_pref="/defaults/pref"
  local firefox_preferences="/defaults/preferences"

  # Check sanity of input
  if [ $# -lt "3" ]
  then
        echo "Usage: firefox_js_setting 'config_javascript_file' 'key_to_search' 'new_value'"
        echo
        echo "Aborting."
        exit 1
  fi

  # Check the possible Firefox install directories
  for firefox_dir in ${firefox_dirs}; do
    # If the Firefox directory exists, then Firefox is installed
    if [ -d "${firefox_dir}" ]; then
      # Different versions of Firefox have different preferences directories, check for them and set the right one
      if [ -d "${firefox_dir}/${firefox_pref}" ] ; then
        local firefox_pref_dir="${firefox_dir}/${firefox_pref}"
      elif [ -d "${firefox_dir}/${firefox_preferences}" ] ; then
        local firefox_pref_dir="${firefox_dir}/${firefox_preferences}"
      else
        mkdir -m 755 -p "${firefox_dir}/${firefox_preferences}"
        local firefox_pref_dir="${firefox_dir}/${firefox_preferences}"
      fi

      # Make sure the Firefox .js file exists and has the appropriate permissions
      if ! [ -f "${firefox_pref_dir}/${firefox_js}" ] ; then
        touch "${firefox_pref_dir}/${firefox_js}"
        chmod 644 "${firefox_pref_dir}/${firefox_js}"
      fi

      # If the key exists, change it. Otherwise, add it to the config_file.
      if `grep -q "^pref(\"${key}\", " "${firefox_pref_dir}/${firefox_js}"` ; then
        sed -i "s/pref(\"${key}\".*/pref(\"${key}\", ${value});/g" "${firefox_pref_dir}/${firefox_js}"
      else
        echo "pref(\"${key}\", ${value});" &gt;&gt; "${firefox_pref_dir}/${firefox_js}"
      fi
    fi
  done

}
</value>
    </Value>
    <Value id="xccdf_org.ssgproject.content_value_function_firefox_cfg_setting" hidden="true" prohibitChanges="true" operator="equals" type="string">
      <title xml:lang="en-US">Remediation function to replace configuration setting(s) in the Firefox
preferences configuration (.cfg) file or add the preference if it does not exist yet</title>
      <description xml:lang="en-US">Function to replace configuration setting(s) in the Firefox
preferences configuration (.cfg) file or add the preference if it does not exist.

Expects three arguments:

  config_file:          Configuration file that will be modified
  key:                  Configuration option to change
  value:                Value of the configuration option to change


Example Call(s):

  Without string or variable:
  firefox_cfg_setting "stig.cfg" "extensions.update.enabled" "false"

  With string:
  firefox_cfg_setting "stig.cfg" "security.default_personal_cert" "\"Ask Every Time\""

  With a string variable:
  firefox_cfg_setting "stig.cfg" "browser.startup.homepage\" "\"${var_default_home_page}\""
</description>
      <value>
function firefox_cfg_setting {
  local firefox_cfg=$1
  local key=$2
  local value=$3
  local firefox_dirs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"

  # Check sanity of input
  if [ $# -lt "3" ]
  then
        echo "Usage: firefox_cfg_setting 'config_cfg_file' 'key_to_search' 'new_value'"
        echo
        echo "Aborting."
        exit 1
  fi

  # Check the possible Firefox install directories
  for firefox_dir in ${firefox_dirs}; do
    # If the Firefox directory exists, then Firefox is installed
    if [ -d "${firefox_dir}" ]; then
      # Make sure the Firefox .cfg file exists and has the appropriate permissions
      if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
        touch "${firefox_dir}/${firefox_cfg}"
        chmod 644 "${firefox_dir}/${firefox_cfg}"
      fi

      # If the key exists, change it. Otherwise, add it to the config_file.
      if `grep -q "^lockPref(\"${key}\", " "${firefox_dir}/${firefox_cfg}"` ; then
        sed -i "s/lockPref(\"${key}\".*/lockPref(\"${key}\", ${value});/g" "${firefox_dir}/${firefox_cfg}"
      else
        echo "lockPref(\"${key}\", ${value});" &gt;&gt; "${firefox_dir}/${firefox_cfg}"
      fi
    fi
  done
}
</value>
    </Value>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_intro">
    <title xml:lang="en-US">Introduction</title>
    <description xml:lang="en-US">
The purpose of this guidance is to provide security configuration
recommendations and baselines for the Debian 8 operating
system. Recommended settings for the basic operating system are provided,
as well as for many network services that the system can provide to other systems.
The guide is intended for system administrators. Readers are assumed to
possess basic system administration skills for Unix-like systems, as well
as some familiarity with the product's documentation and administration
conventions. Some instructions within this guide are complex.
All directions should be followed completely and with understanding of
their effects in order to avoid serious adverse effects on the system
and its security.
</description>
    <Group id="xccdf_org.ssgproject.content_group_general-principles">
      <title xml:lang="en-US">General Principles</title>
      <description xml:lang="en-US">
The following general principles motivate much of the advice in this
guide and should also influence any configuration decisions that are
not explicitly covered.
</description>
      <Group id="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data">
        <title xml:lang="en-US">Encrypt Transmitted Data Whenever Possible</title>
        <description xml:lang="en-US">
Data transmitted over a network, whether wired or wireless, is susceptible
to passive monitoring. Whenever practical solutions for encrypting
such data exist, they should be applied. Even if data is expected to
be transmitted only over a local network, it should still be encrypted.
Encrypting authentication data, such as passwords, is particularly
important. Networks of Debian 8 machines can and should be configured
so that no unencrypted authentication data is ever transmitted between
machines.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-minimize-software">
        <title xml:lang="en-US">Minimize Software to Minimize Vulnerability</title>
        <description xml:lang="en-US">
The simplest way to avoid vulnerabilities in software is to avoid
installing that software. On Debian 8,

the Package Manager (originally
<html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.debian.org/doc/manuals/debian-faq/ch-pkgtools.en.html">apt</html:a>)
allows for careful management of
the set of software packages installed on a system. Installed software
contributes to system vulnerability in several ways. Packages that
include setuid programs may provide local attackers a potential path to
privilege escalation. Packages that include network services may give
this opportunity to network-based attackers. Packages that include
programs which are predictably executed by local users (e.g. after
graphical login) may provide opportunities for trojan horses or other
attack code to be run undetected. The number of software packages
installed on a system can almost always be significantly pruned to include
only the software for which there is an environmental or operational need.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-separate-servers">
        <title xml:lang="en-US">Run Different Network Services on Separate Systems</title>
        <description xml:lang="en-US">
Whenever possible, a server should be dedicated to serving exactly one
network service. This limits the number of other services that can
be compromised in the event that an attacker is able to successfully
exploit a software flaw in one network service.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-use-security-tools">
        <title xml:lang="en-US">Configure Security Tools to Improve System Robustness</title>
        <description xml:lang="en-US">
Several tools exist which can be effectively used to improve a system's
resistance to and detection of unknown attacks. These tools can improve
robustness against attack at the cost of relatively little configuration
effort. In particular, this guide recommends and discusses the use of
host-based firewalling, SELinux for protection against
vulnerable services, and a logging and auditing infrastructure for
detection of problems.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_principle-least-privilege">
        <title xml:lang="en-US">Least Privilege</title>
        <description xml:lang="en-US">
Grant the least privilege necessary for user accounts and software to perform tasks.
For example, <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> can be implemented to limit authorization to super user
accounts on the system only to designated personnel. Another example is to limit
logins on server systems to only those administrators who need to log into them in
order to perform administration tasks. Using SELinux also follows the principle of
least privilege: SELinux policy can confine software to perform only actions on the
system that are specifically allowed. This can be far more restrictive than the
actions permissible by the traditional Unix permissions model.
</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_how-to-use">
      <title xml:lang="en-US">How to Use This Guide</title>
      <description xml:lang="en-US">
Readers should heed the following points when using the guide.
</description>
      <Group id="xccdf_org.ssgproject.content_group_intro-read-sections-completely">
        <title xml:lang="en-US">Read Sections Completely and in Order</title>
        <description xml:lang="en-US">
Each section may build on information and recommendations discussed in
prior sections. Each section should be read and understood completely;
instructions should never be blindly applied. Relevant discussion may
occur after instructions for an action. 
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-test-non-production">
        <title xml:lang="en-US">Test in Non-Production Environment</title>
        <description xml:lang="en-US">
This guidance should always be tested in a non-production environment
before deployment. This test environment should simulate the setup in
which the system will be deployed as closely as possible.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-root-shell-assumed">
        <title xml:lang="en-US">Root Shell Environment Assumed</title>
        <description xml:lang="en-US">
Most of the actions listed in this document are written with the
assumption that they will be executed by the root user running the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/bash</html:code> shell. Commands preceded with a hash mark (#)
assume that the administrator will execute the commands as root, i.e.
apply the command via <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> whenever possible, or use
<html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> to gain root privileges if <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> cannot be
used. Commands which can be executed as a non-root user are are preceded
by a dollar sign ($) prompt.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-formatting-conventions">
        <title xml:lang="en-US">Formatting Conventions</title>
        <description xml:lang="en-US">
Commands intended for shell execution, as well as configuration file text,
are featured in a <html:code xmlns:html="http://www.w3.org/1999/xhtml">monospace font</html:code>. <html:i xmlns:html="http://www.w3.org/1999/xhtml">Italics</html:i> are used
to indicate instances where the system administrator must substitute
the appropriate information into a command or configuration file.
</description>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_intro-reboot-required">
        <title xml:lang="en-US">Reboot Required</title>
        <description xml:lang="en-US">
A system reboot is implicitly required after some actions in order to
complete the reconfiguration of the system. In many cases, the changes
will not take effect until a reboot is performed. In order to ensure
that changes are applied properly and to test functionality, always
reboot the system after applying a set of recommendations from this guide.
</description>
      </Group>
    </Group>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_system">
    <title xml:lang="en-US">System Settings</title>
    <description xml:lang="en-US">Contains rules that check correct system settings.</description>
    <Group id="xccdf_org.ssgproject.content_group_software">
      <title xml:lang="en-US">Installing and Maintaining Software</title>
      <description xml:lang="en-US">The following sections contain information on
security-relevant choices during the initial operating system
installation process and the setup of software
updates.</description>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_permissions">
      <title xml:lang="en-US">File Permissions and Masks</title>
      <description xml:lang="en-US">Traditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access. 
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Several of the commands in this section search filesystems
for files or directories with certain characteristics, and are
intended to be run on every local partition on a given system.
When the variable <html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i> appears in one of the commands below,
it means that the command is intended to be run repeatedly, with the
name of each local partition substituted for <html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i> in turn.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following command prints a list of all xfs partitions on the local
system, which is the default filesystem for Red Hat Enterprise Linux
7 installations:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ mount -t xfs | awk '{print $3}'</html:pre>
For any systems that use a different
local filesystem type, modify this command as appropriate.
</description>
      <Group id="xccdf_org.ssgproject.content_group_files">
        <title xml:lang="en-US">Verify Permissions on Important Files and
Directories</title>
        <description xml:lang="en-US">Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</description>
        <Group id="xccdf_org.ssgproject.content_group_permission_important_state_files">
          <title xml:lang="en-US">Verify permissions on files containing sensitive informations about the system</title>
          <description xml:lang="en-US">Various files contains sensitive informations that can leads to specific weaknesses or
give structural informations for local exploits.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" selected="false" severity="low">
            <title xml:lang="en-US">Verify that local System.map file (if exists) is readable only by root</title>
            <description xml:lang="en-US">Files containing sensitive informations should be protected by restrictive
  permissions. Most of the time, there is no need that these files need to be read by any non-root user
    
    To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/System.map-*</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chmod 0600 /boot/System.map-*</html:pre>
    
    To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/System.map-*</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chown root /boot/System.map-* </html:pre>
  </description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R13)</reference>
            <rationale xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">System.map</html:code> file contains information about kernel symbols and
  can give some hints to generate local exploitation.
  </rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_systemmap:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_permissions_important_account_files">
          <title xml:lang="en-US">Verify Permissions on Files with Local Account Information and Credentials</title>
          <description xml:lang="en-US">The default restrictive permissions for files which act as
important security databases such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">shadow</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">group</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">gshadow</html:code> files must be maintained.  Many utilities
need read access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code> file in order to function properly, but
read access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">shadow</html:code> file allows malicious attacks against system
passwords, and should never be enabled.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="false" severity="medium">
            <title xml:lang="en-US">Verify Permissions and ownership on shadow File</title>
            <description xml:lang="en-US">
              
    To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chmod 0640 /etc/shadow</html:pre>
              
    To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chown root /etc/shadow </html:pre>
              
    To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chgrp shadow /etc/shadow </html:pre>
            </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R36)</reference>
            <rationale xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
            <fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">chmod 0640 /etc/shadow
</fix>
            <fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure permission 0640 on /etc/shadow
  file:
    path="{{item}}"
    mode=0640
  with_items:
    - /etc/shadow
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="false" severity="medium">
            <title xml:lang="en-US">Verify Permissions and ownership on gshadow File</title>
            <description xml:lang="en-US">
              
    To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chmod 0640 /etc/gshadow</html:pre>
              
    To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chown root /etc/gshadow </html:pre>
              
    To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chgrp shadow /etc/gshadow </html:pre>
            </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R36)</reference>
            <rationale xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">chmod 0640 /etc/gshadow
</fix>
            <fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure permission 0640 on /etc/gshadow
  file:
    path="{{item}}"
    mode=0640
  with_items:
    - /etc/gshadow
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_gshadow:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="false" severity="medium">
            <title xml:lang="en-US">Verify Permissions and ownership on passwd File</title>
            <description xml:lang="en-US">
              
    To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chmod 0644 /etc/passwd</html:pre>
              
    To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chown root /etc/passwd </html:pre>
              
    To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chgrp root /etc/passwd </html:pre>
            </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
            <rationale xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
            <fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">chmod 0644 /etc/passwd
</fix>
            <fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure permission 0644 on /etc/passwd
  file:
    path="{{item}}"
    mode=0644
  with_items:
    - /etc/passwd
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="false" severity="medium">
            <title xml:lang="en-US">Verify Permissions and ownership on group File</title>
            <description xml:lang="en-US">
              
    To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chmod 0644 /etc/passwd</html:pre>
              
    To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chown root /etc/passwd </html:pre>
              
    To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo chgrp root /etc/passwd </html:pre>
            </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
            <rationale xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains information about the groups that are configured on
the system. Protection of this file is critical for system security.</rationale>
            <fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">chmod 0644 /etc/group
</fix>
            <fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure permission 0644 on /etc/group
  file:
    path="{{item}}"
    mode=0644
  with_items:
    - /etc/group
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_restriction">
        <title xml:lang="en-US">Restrict Programs from Dangerous Execution Patterns</title>
        <description xml:lang="en-US">The recommendations in this section are designed to
ensure that the system's features to protect against potentially
dangerous program execution are activated.
These protections are applied at the system initialization or
kernel level, and defend against certain types of badly-configured
or compromised programs.</description>
        <Group id="xccdf_org.ssgproject.content_group_coredumps">
          <title xml:lang="en-US">Disable Core Dumps</title>
          <description xml:lang="en-US">A core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Once a hard limit is set in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.conf</html:code>, a
user cannot increase that limit within his or her own session. If access
to core dumps is required, consider restricting them to only
certain users or groups. See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">limits.conf</html:code> man page for more
information.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The core dumps of setuid programs are further protected. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> variable <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.suid_dumpable</html:code> controls whether
the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="false" severity="low">
            <title xml:lang="en-US">Disable Core Dumps for SUID programs</title>
            <description xml:lang="en-US">
              
    To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.suid_dumpable</html:code> kernel parameter,
    run the following command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo sysctl -w fs.suid_dumpable=0</html:pre>
    If this is not the system's default value, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.conf</html:code>:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">fs.suid_dumpable = 0</html:pre>
            </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11</reference>
            <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">1.6.1</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R23)</reference>
            <rationale xml:lang="en-US">The core dump of a setuid program is more likely to contain
wve data, as the program itself runs with greater privileges than the
user who initiated execution of the program.  Disabling the ability for any
setuid program to write a core file decreases the risk of unauthorized access
of such data.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_fs_suid_dumpable:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_enable_execshield_settings">
          <title xml:lang="en-US">Enable ExecShield</title>
          <description xml:lang="en-US">ExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default
on 32-bit systems and controlled through <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> variables 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.exec-shield</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space</html:code>. On the latest
64-bit systems, <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.exec-shield</html:code> cannot be enabled or disabled with 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code>.
</description>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="false" severity="medium">
            <title xml:lang="en-US">Enable Randomized Layout of Virtual Address Space</title>
            <description xml:lang="en-US">
              
    To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space</html:code> kernel parameter,
    run the following command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo sysctl -w kernel.randomize_va_space=2</html:pre>
    If this is not the system's default value, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.conf</html:code>:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">kernel.randomize_va_space = 2</html:pre>
            </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</reference>
            <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">1.6.1</reference>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R23)</reference>
            <rationale xml:lang="en-US"> Address space layout randomization (ASLR) makes it more difficult
for an attacker to predict the location of attack code they have introduced
into a process's address space during an attempt at exploitation.  Additionally, ASLR 
makes it more difficult for an attacker to know the location of existing code
in order to re-purpose it using return oriented programming (ROP) techniques.
</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_randomize_va_space:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="false" severity="low">
            <title xml:lang="en-US">Restrict exposed kernel pointers addresses access</title>
            <description xml:lang="en-US">
              
    To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.kptr_restrict</html:code> kernel parameter,
    run the following command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo sysctl -w kernel.kptr_restrict=1</html:pre>
    If this is not the system's default value, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.conf</html:code>:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">kernel.kptr_restrict = 1</html:pre>
            </description>
            <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R23)</reference>
            <rationale xml:lang="en-US">Exposing kernel pointers (through procfs or <html:code xmlns:html="http://www.w3.org/1999/xhtml">seq_printf()</html:code>) exposes
kernel writeable structures that can contain functions pointers. If a write vulnereability occurs
in the kernel allowing a write access to any of this structure, the kernel can be compromise. This
option disallow any program withtout the CAP_SYSLOG capability from getting the kernel pointers addresses,
replacing them with 0.
</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_kptr_restrict:def:1" href="ssg-debian8-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1"/>
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_fs-part">
      <title xml:lang="en-US">Hardening the filesystem</title>
      <description xml:lang="en-US">Hardening the filesystem and its usage is an efficient way to ensure an efficient separation of services,
data and configurations while ensuring a more precise management of filesystem level access rights, enabling deactivation
of some specific rights at the filesystem level. Moreover, the Linux Virtual file system support various hardening mechanisms
that can be set using sysctl.</description>
      <Group id="xccdf_org.ssgproject.content_group_installation-storage-partitioning">
        <title xml:lang="en-US">Partitioning</title>
        <description xml:lang="en-US">
  Separating various locations of the file systems in different partitions allows a more restrictive
  segregation, distinctly from one location to another. Moreover, some native restrictions can be made by
partitioning, such as no hard link between different filesystems, and reduce the corruption impact to the
affected filesystem instead of the entire system. The last gain is to allow a differenciated usage of storage
media, depending on the operational needs (speed, resilience, etc.).
</description>
        <reference href="http://www.pathname.com/fhs/">Filesystem Hierarchy Standard</reference>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="false" severity="low">
          <title xml:lang="en-US">Ensure /tmp Located On Separate Partition</title>
          <description xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM (when non-ephemeral is needed) or use tmpfs if possible.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-32</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R12)</reference>
          <rationale xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_tmp:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-partition_for_tmp_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var" selected="false" severity="low">
          <title xml:lang="en-US">Ensure /var Located On Separate Partition</title>
          <description xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> has its own partition
or logical volume at installation time, or migrate it using LVM.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-32</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R12)</reference>
          <rationale xml:lang="en-US">
Ensuring that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory to contain
world-writable directories installed by other software packages.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-partition_for_var_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false" severity="low">
          <title xml:lang="en-US">Ensure /var/log Located On Separate Partition</title>
          <description xml:lang="en-US">
System logs are stored in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory.
Ensure that it has its own partition or logical
volume at installation time, or migrate it using LVM.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-32</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R12)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R47)</reference>
          <rationale xml:lang="en-US">
Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> in its own partition
enables better separation between log files
and other files in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/</html:code>.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_log:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-partition_for_var_log_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false" severity="low">
          <title xml:lang="en-US">Ensure /var/log/audit Located On Separate Partition</title>
          <description xml:lang="en-US">
Audit logs are stored in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> directory.  Ensure that it
has its own partition or logical volume at installation time, or migrate it
later using LVM. Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-32</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
          <rationale xml:lang="en-US">
Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_log_audit:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_home" selected="false" severity="low">
          <title xml:lang="en-US">Ensure /home Located On Separate Partition</title>
          <description xml:lang="en-US">
If user home directories will be stored locally, create a separate partition
for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> at installation time (or migrate it later using LVM). If
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-32</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1208</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R12)</reference>
          <rationale xml:lang="en-US">
Ensuring that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_home:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-partition_for_home_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_srv" selected="false" severity="low">
          <title xml:lang="en-US">Ensure /srv Located On Separate Partition</title>
          <description xml:lang="en-US">
If a file server (FTP, TFTP...) is hosted locally, create a separate partition
for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> at installation time (or migrate it later using LVM). If
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.
</description>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R12)</reference>
          <rationale xml:lang="en-US">
Srv deserves files for local network file server such as FTP. Ensuring
that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/srv</html:code> is mounted on its own partition enables the setting of
more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_srv:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-partition_for_srv_ocil:questionnaire:1"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_fs-restrict">
        <title xml:lang="en-US">filesystem rights management</title>
        <description xml:lang="en-US">Adding filesystem specific hardening seriously limits various exploitation vectors based on
  filesystem invalid usage, such as invalid file types in invalid places (devices or setuid root files in external
media, executable file in insecure filesystems, etc.). Some of these hardening require an efficient system
partitioning.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="false" severity="low">
          <title xml:lang="en-US">Disallow creating symlinks to a file you not own</title>
          <description xml:lang="en-US">
            
    To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.protected_symlinks</html:code> kernel parameter,
    run the following command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo sysctl -w fs.protected_symlinks=1</html:pre>
    If this is not the system's default value, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.conf</html:code>:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">fs.protected_symlinks = 1</html:pre>
          </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11</reference>
          <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">1.6.1</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R23)</reference>
          <rationale xml:lang="en-US">Disallowing such symlink mitigate vulnerabilities based on insecure file system
accessed by privilegied programs, avoiding an exploitation vector exploiting unsafe use of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">open()</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">creat()</html:code>.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_fs_protected_symlinks:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="false" severity="low">
          <title xml:lang="en-US">Disallow creating symlinks to a file you not own</title>
          <description xml:lang="en-US">
            
    To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.protected_hardlinks</html:code> kernel parameter,
    run the following command:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">$ sudo sysctl -w fs.protected_hardlinks=1</html:pre>
    If this is not the system's default value, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.conf</html:code>:
    <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xml:space="preserve">fs.protected_hardlinks = 1</html:pre>
          </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11</reference>
          <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">1.6.1</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R23)</reference>
          <rationale xml:lang="en-US">Disallowing such hardlink mitigate vulnerabilities based on insecure file system
accessed by privilegied programs, avoiding an exploitation vector exploiting unsafe use of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">open()</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">creat()</html:code>.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_fs_protected_hardlinks:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_accounts">
      <title xml:lang="en-US">Account and Access Control</title>
      <description xml:lang="en-US">In traditional Unix security, if an attacker gains
shell access to a certain login account, they can perform any action
or access any file to which that account has access. Therefore,
making it more difficult for unauthorized people to gain shell
access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
Debian 8.</description>
      <Group id="xccdf_org.ssgproject.content_group_accounts-restrictions">
        <title xml:lang="en-US">Protect Accounts by Restricting Password-Based Login</title>
        <description xml:lang="en-US">Conventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> files. Password-based login is vulnerable to
guessing of weak passwords, and to sniffing and man-in-the-middle
attacks against passwords entered over a network or at an insecure
console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</description>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_logging">
      <title xml:lang="en-US">Configure Syslog</title>
      <description xml:lang="en-US">The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In Debian Jessie, rsyslog has replaced syslog as the syslog daemon of choice,
and it includes some additional security features such as reliable,
connection-oriented (i.e. TCP) transmission of logs, the option to log to
database formats, and the encryption of log data en route to
a central logging server. This section discusses how to configure rsyslog for
best effect, and how to use tools provided with the system to maintain and
monitor logs.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="false" severity="medium">
        <title xml:lang="en-US">Ensure rsyslog is Installed</title>
        <description xml:lang="en-US">
Rsyslog is installed by default. 

        The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> package can be installed with the following command:
        <html:pre xmlns:html="http://www.w3.org/1999/xhtml"># apt-get install rsyslog</html:pre>
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(2)</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1311</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1312</reference>
        <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">5.1.1</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</reference>
        <rationale xml:lang="en-US">
The rsyslog package provides the rsyslog daemon, which provides
system logging services.
</rationale>
        <fix system="urn:xccdf:fix:script:sh" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="disable"># Include source function library.

apt-get install rsyslog
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure rsyslog is installed
  package:
    name="{{item}}"
    state=present
  with_items:
    - rsyslog
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_rsyslog_installed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="false" severity="medium">
        <title xml:lang="en-US">Enable rsyslog Service</title>
        <description xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> service provides syslog-style logging by default on Debian 8.

        The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> service can be enabled with the following command:
        <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chkconfig --level 2345 rsyslog on</html:pre>
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1311</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1312</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1557</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1851</reference>
        <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">5.1.2</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</reference>
        <rationale xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> service must be running in order to provide
logging services, which are essential to system administration.
</rationale>
        <fix system="urn:xccdf:fix:script:ansible" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service rsyslog
  service:
    name="{{item}}"
    enabled="yes"
    state="started"
  with_items:
    - rsyslog

</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_rsyslog_enabled:def:1" href="ssg-debian8-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration">
        <title xml:lang="en-US">Ensure Proper Configuration of Log Files</title>
        <description xml:lang="en-US">
The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> controls where log message are written.
These are controlled by lines called <html:i xmlns:html="http://www.w3.org/1999/xhtml">rules</html:i>, which consist of a
<html:i xmlns:html="http://www.w3.org/1999/xhtml">selector</html:i> and an <html:i xmlns:html="http://www.w3.org/1999/xhtml">action</html:i>.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Debian 8 are:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice
</html:pre>
See the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog.conf(5)</html:code> for more information.
<html:i xmlns:html="http://www.w3.org/1999/xhtml">Note that the <html:code>rsyslog</html:code> daemon is configured to use traditional timestamping
to be understood by any log processing program. For high precision timestamping,
comment the following line in <html:code>/etc/rsyslog.conf</html:code>:
<html:pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</html:pre>
</html:i>
</description>
        <Value id="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" operator="equals" type="string">
          <title xml:lang="en-US">User who owns log files</title>
          <description xml:lang="en-US">Specify user owner of all logfiles specified in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>.</description>
          <value selector="root">root</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" operator="equals" type="string">
          <title xml:lang="en-US">group who owns log files</title>
          <description xml:lang="en-US">Specify group owner of all logfiles specified in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf.</html:code></description>
          <value selector="adm">adm</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="false" severity="medium">
          <title xml:lang="en-US">Ensure Log Files Are Owned By Appropriate User</title>
          <description xml:lang="en-US">The owner of all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be root.
These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's owner:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>, run the following command to
correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root <html:i>LOGFILE</html:i></html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1314</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</reference>
          <rationale xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_ownership:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="false" severity="medium">
          <title xml:lang="en-US">Ensure Log Files Are Owned By Appropriate Group</title>
          <description xml:lang="en-US">The group-owner of all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be root.
These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's group owner:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code xmlns:html="http://www.w3.org/1999/xhtml">adm</html:code>, run the following command to
correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp adm <html:i>LOGFILE</html:i></html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1314</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</reference>
          <rationale xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_groupownership:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="false" severity="medium">
          <title xml:lang="en-US">Ensure System Log Files Have Correct Permissions</title>
          <description xml:lang="en-US">The file permissions for all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be set to 640, or more restrictive.
These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>. 
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's permissions:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the permissions are not 640 or more restrictive,
run the following command to correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 <html:i>LOGFILE</html:i></html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1314</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</reference>
          <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">5.1.4</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R36)</reference>
          <rationale xml:lang="en-US">Log files can contain valuable information regarding system
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_permissions:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_rsyslog_sending_messages">
        <title xml:lang="en-US">Rsyslog Logs Sent To Remote Host</title>
        <description xml:lang="en-US">
If system logs are to be useful in detecting malicious
activities, it is necessary to send logs to a remote server. An
intruder who has compromised the root account on a machine may
delete the log entries which indicate that the system was attacked
before they are seen by an administrator.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
However, it is recommended that logs be stored on the local
host in addition to being sent to the loghost, especially if
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> has been configured to use the UDP protocol to send
messages over a network. UDP does not guarantee reliable delivery,
and moderately busy sites will lose log messages occasionally,
especially in periods of high traffic which may be the result of an
attack. In addition, remote <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> messages are not
authenticated in any way by default, so it is easy for an attacker to
introduce spurious messages to the central log server. Also, some
problems cause loss of network connectivity, which will prevent the
sending of messages to the central server. For all of these reasons, it is
better to store log messages both centrally and on each host, so
that they can be correlated if necessary.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false" severity="low">
          <title xml:lang="en-US">Ensure Logs Sent To Remote Host</title>
          <description xml:lang="en-US">
To configure rsyslog to send logs to a remote log server,
open <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and read and understand the last section of the file,
which describes the multiple directives necessary to activate remote
logging.
Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>loghost.example.com</html:i></html:code> appropriately.
The choice of protocol depends on the environment of the system; 
although TCP and RELP provide more reliable message delivery, 
they may not be supported in all environments.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use UDP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*.* @<html:i>loghost.example.com</html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use TCP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*.* @@<html:i>loghost.example.com</html:i></html:pre>
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use RELP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*.* :omrelp:<html:i>loghost.example.com</html:i></html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1348</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">136</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1851</reference>
          <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">5.1.5</reference>
          <rationale xml:lang="en-US">A log server (loghost) receives syslog messages from one or more
systems. This data can be used as an additional log source in the event a
system is compromised and its local logs are suspect. Forwarding log messages
to a remote loghost also provides system administrators with a centralized
place to view the status of multiple hosts within the enterprise.
</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_remote_loghost:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages">
        <title xml:lang="en-US">Configure rsyslogd to Accept Remote Messages If Acting as a Log Server</title>
        <description xml:lang="en-US">
By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> does not listen over the network
for log messages. If needed, modules can be enabled to allow
the rsyslog daemon to receive messages from other systems and for the system
thus to act as a log server.
If the machine is not a log server, then lines concerning these modules
should remain commented out.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
</description>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp" selected="false" severity="low">
          <title xml:lang="en-US">Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</title>
          <description xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> to enable reception of messages over TCP:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ModLoad imtcp
$InputTCPServerRun 514</html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">5.1.6</reference>
          <rationale xml:lang="en-US">
If the system needs to act as a log server, this ensures that it can receive
messages over a reliable TCP connection.
</rationale>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp" selected="false" severity="low">
          <title xml:lang="en-US">Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</title>
          <description xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> to enable reception of messages over UDP:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ModLoad imudp
$UDPServerRun 514</html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf">5.1.6</reference>
          <rationale xml:lang="en-US">
Many devices, such as switches, routers, and other Unix-like systems, may only support
the traditional syslog transmission over UDP. If the system must act as a log server,
this enables it to receive their messages as well.
</rationale>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_log_rotation">
        <title xml:lang="en-US">Ensure All Logs are Rotated by logrotate</title>
        <description xml:lang="en-US">Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.d/rsyslog</html:code>. Find the first
line, which should look like this (wrapped for clarity):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
  /var/log/boot.log /var/log/cron {</html:pre>
Edit this line so that it contains a one-space-separated
listing of each log file referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
All logs in use on a system must be rotated regularly, or the
log files will consume disk space over time, eventually interfering
with system operation. The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.d/syslog</html:code> is the
configuration file used by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">logrotate</html:code> program to maintain all
log files written by <html:code xmlns:html="http://www.w3.org/1999/xhtml">syslog</html:code>. By default, it rotates logs weekly and
stores four archival copies of each log. These settings can be
modified by editing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.conf</html:code>, but the defaults are
sufficient for purposes of this guide.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Note that <html:code xmlns:html="http://www.w3.org/1999/xhtml">logrotate</html:code> is run nightly by the cron job
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.daily/logrotate</html:code>. If particularly active logs need to be
rotated more often than once a day, some other mechanism must be
used.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="false" severity="low">
          <title xml:lang="en-US">Ensure Logrotate Runs Periodically</title>
          <description xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">logrotate</html:code> utility allows for the automatic rotation of 
log files.  The frequency of rotation is specified in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.conf</html:code>, 
which triggers a cron task.  To configure logrotate to run daily, add or correct 
the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/logrotate.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># rotate log files <html:i>frequency</html:i>
daily</html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
          <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">366</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</reference>
          <rationale xml:lang="en-US">Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_logrotate_activated:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1"/>
          </check>
        </Rule>
      </Group>
    </Group>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_services">
    <title xml:lang="en-US">Services</title>
    <description xml:lang="en-US">
The best protection against vulnerable software is running less software. This section describes how to review
the software which Debian 8 installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Debian 8 system and provides guidance about which
ones can be safely disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Debian 8 provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Debian 8 systems, it is highly recommended to select the minimal packages and then build up
the system from there.
</description>
    <Group id="xccdf_org.ssgproject.content_group_deprecated">
      <title xml:lang="en-US">Deprecated services</title>
      <description xml:lang="en-US">
Some deprecated software services impact the overall system security due to their behavior (leak of
confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc.
</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_telnetd_removed" selected="false" severity="high">
        <title xml:lang="en-US">Uninstall the telnet server</title>
        <description xml:lang="en-US">
The telnet daemon should be uninstalled.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(8)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R03)</reference>
        <rationale xml:lang="en-US">
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made. 
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># CAUTION: This remediation script will remove telnetd
#	   from the system, and may remove any packages
#	   that depend on telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

apt-get remove --purge telnetd
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnetd is removed
  package:
    name="{{item}}"
    state=absent
  with_items:
    - telnetd
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_telnetd_removed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" selected="false" severity="high">
        <title xml:lang="en-US">Uninstall the inet-based telnet server</title>
        <description xml:lang="en-US">
The inet-based telnet daemon should be uninstalled.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(8)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx"/>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R03)</reference>
        <rationale xml:lang="en-US">
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made. 
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># CAUTION: This remediation script will remove inetutils-telnetd
#	   from the system, and may remove any packages
#	   that depend on inetutils-telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

apt-get remove --purge inetutils-telnetd
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure inetutils-telnetd is removed
  package:
    name="{{item}}"
    state=absent
  with_items:
    - inetutils-telnetd
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_inetutils-telnetd_removed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" selected="false" severity="high">
        <title xml:lang="en-US">Uninstall the ssl compliant telnet server</title>
        <description xml:lang="en-US">
The telnet daemon, even with ssl support, should be uninstalled.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(8)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R02)</reference>
        <rationale xml:lang="en-US">
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># CAUTION: This remediation script will remove telnetd-ssl
#	   from the system, and may remove any packages
#	   that depend on telnetd-ssl. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

apt-get remove --purge telnetd-ssl
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnetd-ssl is removed
  package:
    name="{{item}}"
    state=absent
  with_items:
    - telnetd-ssl
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_telnetd-ssl_removed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_nis_removed" selected="false" severity="low">
        <title xml:lang="en-US">Uninstall the nis package</title>
        <description xml:lang="en-US">
The support for Yellowpages should not be installed unless it is required.
</description>
        <rationale xml:lang="en-US">
NIS is the historical SUN service for central account management, more and more replaced by LDAP.
NIS does not support efficiently security constraints, ACL, etc. and should not be used.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># CAUTION: This remediation script will remove nis
#	   from the system, and may remove any packages
#	   that depend on nis. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

apt-get remove --purge nis
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure nis is removed
  package:
    name="{{item}}"
    state=absent
  with_items:
    - nis
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_nis_removed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" selected="false" severity="low">
        <title xml:lang="en-US">Uninstall the ntpdate package</title>
        <description xml:lang="en-US">
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
</description>
        <rationale xml:lang="en-US">
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_ntpdate_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># CAUTION: This remediation script will remove ntpdate
#	   from the system, and may remove any packages
#	   that depend on ntpdate. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

apt-get remove --purge ntpdate
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_ntpdate_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure ntpdate is removed
  package:
    name="{{item}}"
    state=absent
  with_items:
    - ntpdate
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_ntpdate_removed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_basics">
      <title xml:lang="en-US">Generic required services</title>
      <description xml:lang="en-US">
Some services need to be deployed in order to ensure basic verifications and reporting on GNU/Linux operating systems.
Each of these service take part in the administrability of the system.
</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_auditd_installed" selected="false" severity="medium">
        <title xml:lang="en-US">install the auditd service</title>
        <description xml:lang="en-US">
The auditd service should be installed.
</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R50)</reference>
        <rationale xml:lang="en-US">
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparision with potential local access control policy such as SELinux policy.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_auditd_installed" complexity="low" disruption="low" reboot="false" strategy="disable"># Include source function library.

apt-get install auditd
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_auditd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure auditd is installed
  package:
    name="{{item}}"
    state=present
  with_items:
    - auditd
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_auditd_installed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="false" severity="medium">
        <title xml:lang="en-US">Enable the auditd service</title>
        <description xml:lang="en-US">
The auditd service should be enabled.
</description>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R50)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-1(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IR-5</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">347</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">157</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">172</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">880</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1353</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1462</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1487</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1115</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1454</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">067</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">158</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">831</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1190</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1312</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1263</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">130</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">120</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">1589</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10</reference>
        <rationale xml:lang="en-US">
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparision with potential local access control policy such as SELinux policy.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:ansible" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service auditd
  service:
    name="{{item}}"
    enabled="yes"
    state="started"
  with_items:
    - auditd

</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_auditd_enabled:def:1" href="ssg-debian8-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_cron_installed" selected="false" severity="medium">
        <title xml:lang="en-US">Install the cron service</title>
        <description xml:lang="en-US">
The Cron service should be installed.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R50)</reference>
        <rationale xml:lang="en-US">
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="disable"># Include source function library.

apt-get install cron
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure cron is installed
  package:
    name="{{item}}"
    state=present
  with_items:
    - cron
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_cron_installed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_cron_enabled" selected="false" severity="medium">
        <title xml:lang="en-US">Enable the cron service</title>
        <description xml:lang="en-US">
The Cron service should be enabled.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</reference>
        <rationale xml:lang="en-US">
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:ansible" id="service_cron_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service cron
  service:
    name="{{item}}"
    enabled="yes"
    state="started"
  with_items:
    - cron

</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_cron_enabled:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_ntp_installed" selected="false" severity="high">
        <title xml:lang="en-US">Install the ntp service</title>
        <description xml:lang="en-US">
The ntpd service should be installed.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">160</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT012(R03)</reference>
        <rationale xml:lang="en-US">
Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:sh" id="package_ntp_installed" complexity="low" disruption="low" reboot="false" strategy="disable"># Include source function library.

apt-get install ntp
</fix>
        <fix system="urn:xccdf:fix:script:ansible" id="package_ntp_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure ntp is installed
  package:
    name="{{item}}"
    state=present
  with_items:
    - ntp
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_ntp_installed:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" selected="false" severity="high">
        <title xml:lang="en-US">Enable the ntpd service</title>
        <description xml:lang="en-US">
The ntpd service should be enabled.
</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)</reference>
        <reference href="http://iase.disa.mil/stigs/cci/Pages/index.aspx">160</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</reference>
        <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT012(R03)</reference>
        <rationale xml:lang="en-US">
Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.
</rationale>
        <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
        <fix system="urn:xccdf:fix:script:ansible" id="service_ntpd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service ntpd
  service:
    name="{{item}}"
    enabled="yes"
    state="started"
  with_items:
    - ntpd

</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_ntpd_enabled:def:1" href="ssg-debian8-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ssh">
      <title xml:lang="en-US">SSH Server</title>
      <description xml:lang="en-US">The SSH protocol is recommended for remote access (remote login and secure remote file transfer).
SSH provides both confidentiality and integrity for exchanged data but needs to be configured properly in term of:<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Cryptography usage, according to the current CVEs associated to the various cryptographic modes<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Authentication and autorization, depending on your needs but requiring some specific initial generic security<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
consideration in the OpenSSH configuration writing
More detailed information is available from the OpenSSH project's website <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.openssh.org">http://www.openssh.org</html:a>. The Debian package for
server side implementation is called <html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code>.
</description>
      <Value id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" operator="equals" type="number">
        <title xml:lang="en-US">SSH session Idle time</title>
        <description xml:lang="en-US">Specify duration of allowed idle time.</description>
        <value>300</value>
        <value selector="5_minutes">300</value>
        <value selector="10_minutes">600</value>
        <value selector="15_minutes">900</value>
        <value selector="60_minutes">3600</value>
        <value selector="120_minutes">7200</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_service_sshd_disabled" selected="false" severity="low">
        <title xml:lang="en-US">Disable SSH Server if possible (unusual cases)</title>
        <description xml:lang="en-US">Most of the time, the SSH server is needed. However, it can be disabled, do so.

        The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ssh</html:code> service can be disabled with the following command:
        <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chkconfig ssh off</html:pre>
This is unusual, as SSH is a common method for encrypted and authenticated
remote access.
</description>
        <fix system="urn:xccdf:fix:script:ansible" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service sshd
  service:
    name="{{item}}"
    enabled="no"
    state="stopped"
  with_items:
    - sshd

</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_sshd_disabled:def:1" href="ssg-debian8-oval.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_ssh_server">
        <title xml:lang="en-US">Configure OpenSSH Server if deployed</title>
        <description xml:lang="en-US">If the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>. The following recommendations can be
applied to this file. See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">sshd_config(5)</html:code> man page for more
detailed information.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="false" severity="high">
          <title xml:lang="en-US">Allow Only SSH Protocol 2</title>
          <description xml:lang="en-US">Only SSH protocol version 2 connections should be
permitted. The default setting in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> is correct, and can be
verified by ensuring that the following
line appears:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Protocol 2</html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(7)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R1)</reference>
          <rationale xml:lang="en-US">
SSH protocol version 1 suffers from design flaws that
result in security vulnerabilities and
should not be used.
</rationale>
          <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sshd_allow_only_protocol2:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="false" severity="low">
          <title xml:lang="en-US">Set SSH Idle Timeout Interval</title>
          <description xml:lang="en-US">SSH allows administrators to set an idle timeout interval.
After this interval has passed, the idle user will be automatically logged out.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To set an idle timeout interval, edit the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as
follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval <html:b>interval</html:b></html:pre>
The timeout <html:b xmlns:html="http://www.w3.org/1999/xhtml">interval</html:b> is given in seconds. To have a timeout
of 15 minutes, set <html:b xmlns:html="http://www.w3.org/1999/xhtml">interval</html:b> to 900.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If a shorter timeout has already been set for the login
shell, that value will preempt any SSH
setting made here. Keep in mind that some processes may stop SSH
from correctly detecting that the user is idle.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-8</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</reference>
          <rationale xml:lang="en-US">
Causing idle users to be automatically logged out
guards against compromises one system leading trivially
to compromises on another.
</rationale>
          <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
            <check-content-ref name="oval:ssg-sshd_set_idle_timeout:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="false" severity="low">
          <title xml:lang="en-US">Set SSH Client Alive Count</title>
          <description xml:lang="en-US">To ensure the SSH idle timeout occurs precisely when the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> is set,
edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as
follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax 0</html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-8</reference>
          <rationale xml:lang="en-US">
This ensures a user login will be terminated as soon as the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code>
is reached.
</rationale>
          <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sshd_set_keepalive:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="false" severity="medium">
          <title xml:lang="en-US">Disable SSH Root Login</title>
          <description xml:lang="en-US">The root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitRootLogin no</html:pre>
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R21)</reference>
          <rationale xml:lang="en-US">
Permitting direct root login reduces auditable information about who ran
privileged commands on the system
and also allows direct attack attempts on root's password.
</rationale>
          <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sshd_disable_root_login:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="false" severity="high">
          <title xml:lang="en-US">Disable SSH Access via Empty Passwords</title>
          <description xml:lang="en-US">To explicitly disallow remote login from accounts with
empty passwords, add or correct the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitEmptyPasswords no</html:pre>
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords.
</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R17)</reference>
          <rationale xml:lang="en-US">
Configuring this setting for the SSH daemon provides additional assurance that
remote login via SSH will require a password,
even in the event of misconfiguration elsewhere.
</rationale>
          <ident system="https://nvd.nist.gov/cce/index.cfm">CCE-</ident>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sshd_disable_empty_passwords:def:1" href="ssg-debian8-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref href="ssg-debian8-ocil.xml" name="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1"/>
          </check>
        </Rule>
      </Group>
    </Group>
  </Group>
</Benchmark>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_output--ssg-debian8-cpe-oval.xml" timestamp="2017-08-11T21:23:21">
    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
  <generator>
    <oval:product_name>python</oval:product_name>
    <oval:product_version>2.7.13+</oval:product_version>
    <oval:schema_version>5.11</oval:schema_version>
    <oval:timestamp>2017-08-11T21:23:21</oval:timestamp>
  </generator>
  <definitions><definition class="inventory" id="oval:ssg-installed_OS_is_debian8:def:1" version="3">
      <metadata>
        <title>Debian 8</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <reference ref_id="cpe:/o:debian:debian_linux:8" source="CPE"/>
        <description>The operating system installed on the system is Debian 8</description>
      </metadata>
      <criteria comment="current Debian version is Debian jessie" operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
        <criterion comment="Debian8 is installed" test_ref="oval:ssg-test_debian_8:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
      <metadata>
        <title>CentOS 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 6</description>
      </metadata>
      <criteria>
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
      <metadata>
        <title>CentOS 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 7</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
      <metadata>
        <title>Installed operating system is Fedora</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:fedoraproject:fedora:22" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:23" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:24" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:25" source="CPE"/>
        <description>The operating system installed on the system is Fedora</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="fedora-release RPM package is installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
        <criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
      <metadata>
        <title>Installed operating system is part of the Unix family</title>
        <affected family="unix">
        </affected>
        <description>The operating system installed on the system is part of the Unix OS family</description>
      </metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel6:def:1" version="2">
      <metadata>
        <title>Red Hat Enterprise Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 6</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 6 Workstation is installed" test_ref="oval:ssg-test_rhel_workstation:tst:1"/>
          <criterion comment="RHEL 6 Server is installed" test_ref="oval:ssg-test_rhel_server:tst:1"/>
          <criterion comment="RHEL 6 Compute Node is installed" test_ref="oval:ssg-test_rhel_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
      <metadata>
        <title>Red Hat Enterprise Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
      </metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
          <criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
          <criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
      <metadata>
        <title>Scientific Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 6</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
      <metadata>
        <title>Scientific Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 7</description>
      </metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux:def:1" version="1">
      <metadata>
        <title>WRLinux</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
        <description>The operating system installed on the system is
      Wind River Linux</description>
      </metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux:tst:1"/>
        <criterion comment="WRLinux is installed" test_ref="oval:ssg-test_wrlinux:tst:1"/>
      </criteria>
    </definition>
    </definitions><tests><unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
      <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_8:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_debian_8:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="fedora-release RPM package is installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
      <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 6" id="oval:ssg-test_rhel_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 6" id="oval:ssg-test_rhel_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 6" id="oval:ssg-test_rhel_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_computenode:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_unix_wrlinux:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_wrlinux:ste:1"/>
    </ind:family_test>
    <unix:file_test check_existence="at_least_one_exists" version="1" id="oval:ssg-test_wrlinux:tst:1" check="all" comment="Test presence of /etc/wrlinux-release.">
      <unix:object object_ref="oval:ssg-obj_test_wrlinux:obj:1"/>
    </unix:file_test>
    </tests><objects><unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
      <unix:filepath>/etc/debian_version</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_debian_8:obj:1" version="1" comment="Check Debian version">
      <ind:filepath>/etc/debian_version</ind:filepath>
      <ind:pattern operation="pattern match">^8.[0-9]+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
      <linux:name>fedora-release</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
      <ind:filepath>/etc/system-release-cpe</ind:filepath>
      <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_unix_wrlinux:obj:1" version="1"/>
    <unix:file_object version="1" id="oval:ssg-obj_test_wrlinux:obj:1">
      <unix:filepath>/etc/wrlinux-release</unix:filepath>
    </unix:file_object>
    </objects><states><linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_server:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_wrlinux:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    </states></oval_definitions>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_output--ssg-debian8-cpe-dictionary.xml" timestamp="2017-08-11T21:23:21">
    <cpe-list xmlns="http://cpe.mitre.org/dictionary/2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
      <cpe-item name="cpe:/o:debianproject:debian:8">
            <title xml:lang="en-us">Debian release 8 (Jessie)</title>
            <!-- the check references an OVAL file that contains an inventory definition -->
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-debian8-cpe-oval.xml">oval:ssg-installed_OS_is_debian8:def:1</check>
      </cpe-item>
</cpe-list>
  </ds:component>
<ds:component id="scap_org.open-scap_comp_output--ssg-debian8-oval.xml" timestamp="2017-08-11T21:23:22"><oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
  <generator>
    <oval:product_name>python</oval:product_name>
    <oval:product_version>2.7.13+</oval:product_version>
    <oval:schema_version>5.11</oval:schema_version>
    <oval:timestamp>2017-08-11T21:23:21</oval:timestamp>
  </generator>
  <definitions>
    <definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate group.</description>
      <reference ref_id="rsyslog_files_groupownership" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>File permissions for all syslog log files should be set correctly.</description>
      <reference ref_id="rsyslog_files_permissions" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="1">
      <metadata>
        <title>Verify /etc/group Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/group is owned by 0, group owned by 0, and has mode 0644. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_group" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/gshadow Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 42, and has mode 0640. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_gshadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="1">
      <metadata>
        <title>Verify /etc/passwd Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_passwd" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/shadow Permissions</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>This test makes sure that /etc/shadow is owned by 0, group owned by 42, and has mode 0640. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_shadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_shadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_auditd_installed:def:1" version="1">
      <metadata>
        <title>Package auditd Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package auditd should be installed.</description>
      <reference ref_id="package_auditd_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package auditd is installed" test_ref="oval:ssg-test_package_auditd_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cron_installed:def:1" version="1">
      <metadata>
        <title>Package cron Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package cron should be installed.</description>
      <reference ref_id="package_cron_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package cron is installed" test_ref="oval:ssg-test_package_cron_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1">
      <metadata>
        <title>Package inetutils-telnetd Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package inetutils-telnetd should be removed.</description>
      <reference ref_id="package_inetutils-telnetd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_nis_removed:def:1" version="1">
      <metadata>
        <title>Package nis Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package nis should be removed.</description>
      <reference ref_id="package_nis_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">
      <metadata>
        <title>Package ntp Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package ntp should be installed.</description>
      <reference ref_id="package_ntp_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">
      <metadata>
        <title>Package ntpdate Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package ntpdate should be removed.</description>
      <reference ref_id="package_ntpdate_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">
      <metadata>
        <title>Package openssh-server Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package openssh-server should be removed.</description>
      <reference ref_id="package_openssh-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">
      <metadata>
        <title>Package rsyslog Installed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package rsyslog should be installed.</description>
      <reference ref_id="package_rsyslog_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1">
      <metadata>
        <title>Package telnetd-ssl Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package telnetd-ssl should be removed.</description>
      <reference ref_id="package_telnetd-ssl_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnetd_removed:def:1" version="1">
      <metadata>
        <title>Package telnetd Removed</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The DEB package telnetd should be removed.</description>
      <reference ref_id="package_telnetd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">
      <metadata>
        <title>Service auditd Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The auditd service should be enabled if possible.</description>
      <reference ref_id="service_auditd_enabled" source="ssg"/></metadata>
      <criteria comment="package auditd installed and service auditd is configured to start" operator="AND">
        <extend_definition comment="auditd installed" definition_ref="oval:ssg-package_auditd_installed:def:1"/>
        <criteria operator="OR" comment="service auditd is configured to start">
          <criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cron_enabled:def:1" version="1">
      <metadata>
        <title>Service cron Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The cron service should be enabled if possible.</description>
      <reference ref_id="service_cron_enabled" source="ssg"/></metadata>
      <criteria comment="package cron installed and service cron is configured to start" operator="AND">
        <extend_definition comment="cron installed" definition_ref="oval:ssg-package_cron_installed:def:1"/>
        <criteria operator="OR" comment="service cron is configured to start">
          <criterion comment="multi-user.target wants cron" test_ref="oval:ssg-test_multi_user_wants_cron:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">
      <metadata>
        <title>Service ntpd Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The ntpd service should be enabled if possible.</description>
      <reference ref_id="service_ntpd_enabled" source="ssg"/></metadata>
      <criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
        <extend_definition comment="ntp installed" definition_ref="oval:ssg-package_ntp_installed:def:1"/>
        <criteria operator="OR" comment="service ntpd is configured to start">
          <criterion comment="multi-user.target wants ntpd" test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">
      <metadata>
        <title>Service rsyslog Enabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The rsyslog service should be enabled if possible.</description>
      <reference ref_id="service_rsyslog_enabled" source="ssg"/></metadata>
      <criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
        <extend_definition comment="rsyslog installed" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>
        <criteria operator="OR" comment="service rsyslog is configured to start">
          <criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">
      <metadata>
        <title>Service sshd Disabled</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The sshd service should be disabled if possible.</description>
      <reference ref_id="service_sshd_disabled" source="ssg"/></metadata>
      <criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
        <extend_definition comment="openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criteria operator="OR" comment="service sshd is not configured to start">
          <criterion comment="sshd not wanted by multi-user.target" test_ref="oval:ssg-test_sshd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_hardlinks" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "fs.protected_hardlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1"/>
        <extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_symlinks" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "fs.protected_symlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1"/>
        <extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "fs.suid_dumpable" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>
        <extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.dmesg_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>
        <extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.kptr_restrict" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.kptr_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1"/>
        <extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.perf_cpu_time_max_percent" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1"/>
        <extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.perf_event_max_sample_rate" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1"/>
        <extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_paranoid" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.perf_event_paranoid" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1"/>
        <extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.pid_max" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.pid_max" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_pid_max" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1"/>
        <extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.randomize_va_space" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>
        <extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.sysrq" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "kernel.sysrq" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_sysrq" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1"/>
        <extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "net.ipv4.ip_forward" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>
        <extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_hardlinks" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_protected_hardlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_hardlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_symlinks" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_symlinks" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_protected_symlinks" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_symlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_dmesg_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.kptr_restrict" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_kptr_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.kptr_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_kptr_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_max_sample_rate" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_paranoid" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_perf_event_paranoid" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_paranoid:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.pid_max" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.pid_max" parameter should be set to "65536" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_pid_max" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_runtime_sysctl_kernel_pid_max:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.sysrq" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.sysrq" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_sysrq" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_runtime_sysctl_kernel_sysrq:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3">
      <metadata>
        <title>Kernel "vm.mmap_min_addr" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "vm.mmap_min_addr" parameter should be set to "65536" in system runtime.</description>
      <reference ref_id="sysctl_runtime_vm_mmap_min_addr" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_runtime_sysctl_vm_mmap_min_addr:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_hardlinks" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_protected_hardlinks" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3">
      <metadata>
        <title>Kernel "fs.protected_symlinks" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.protected_symlinks" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_protected_symlinks" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1"/>
        <criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.kptr_restrict" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_kptr_restrict" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1"/>
        <criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_perf_cpu_time_max_percent" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_perf_event_max_sample_rate" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.perf_event_paranoid" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_perf_event_paranoid" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1"/>
        <criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.pid_max" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.pid_max" parameter should be set to "65536" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_pid_max" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1"/>
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1"/>
        <criterion comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1"/>
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1"/>
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.sysrq" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "kernel.sysrq" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_sysrq" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1"/>
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1"/>
        <criterion comment="kernel static parameter kernel.sysrq set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3">
      <metadata>
        <title>Kernel "vm.mmap_min_addr" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The kernel "vm.mmap_min_addr" parameter should be set to "65536" in the system configuration.</description>
      <reference ref_id="sysctl_static_vm_mmap_min_addr" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1"/>
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1"/>
        <criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3">
      <metadata>
        <title>Kernel "vm.mmap_min_addr" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The "vm.mmap_min_addr" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_vm_mmap_min_addr" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="vm.mmap_min_addr configuration setting check" definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1"/>
        <extend_definition comment="vm.mmap_min_addr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate user.</description>
      <reference ref_id="rsyslog_files_ownership" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_systemmap:def:1" version="1">
      <metadata>
        <title>Verify that System.map files are readable only by root</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>
        Checks that /boot/System.map-* are only readable by root.
      </description>
      <reference ref_id="file_permissions_systemmap" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_debian8:def:1" version="3">
      <metadata>
        <title>Debian 8</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <reference ref_id="cpe:/o:debian:debian_linux:8" source="CPE"/>
        <description>The operating system installed on the system is Debian 8</description>
      <reference ref_id="installed_OS_is_debian8" source="ssg"/></metadata>
      <criteria comment="current Debian version is Debian jessie" operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
        <criterion comment="Debian8 is installed" test_ref="oval:ssg-test_debian_8:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">
      <metadata>
        <title>Ensure /home Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>If user home directories will be stored locally, create a
      separate partition for /home. If /home will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
      <reference ref_id="partition_for_home" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_home_partition:tst:1" comment="/home on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_srv:def:1" version="1">
      <metadata>
        <title>Ensure /srv Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>If a file server (FTP, TFTP...) is hosted locally, create a separate partition
      for /srv at installation time (or migrate it later using LVM). If
      /srv will be mounted from another system such as an NFS server, then
      creating a separate partition is not necessary at installation time, and the
      mountpoint can instead be configured later.</description>
      <reference ref_id="partition_for_srv" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_srv_partition:tst:1" comment="/srv on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">
      <metadata>
        <title>Ensure /tmp Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>The /tmp directory is a world-writable directory used for
      temporary file storage. Verify that it has its own partition or logical
      volume.</description>
      <reference ref_id="partition_for_tmp" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_tmp_partition:tst:1" comment="/tmp on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">
      <metadata>
        <title>Ensure /var Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>Ensuring that /var is mounted on its own partition enables
      the setting of more restrictive mount options, which is used as temporary
      storage by many program, particularly system services such as daemons. It
      is not uncommon for the /var directory to contain world-writable
      directories, installed by other software packages.</description>
      <reference ref_id="partition_for_var" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_partition:tst:1" comment="/var on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">
      <metadata>
        <title>Ensure /var/log Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>System logs are stored in the /var/log directory. Ensure
      that it has its own partition or logical volume.</description>
      <reference ref_id="partition_for_var_log" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_partition:tst:1" comment="/var/log on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">
      <metadata>
        <title>Ensure /var/log/audit Located On Separate Partition</title>
        <affected family="unix">
          <platform>Debian 8</platform>
        </affected>
        <description>Audit logs are stored in the /var/log/audit directory.
      Ensure that it has its own partition or logical volume. Make absolutely
      certain that it is large enough to store all audit logs that will be
      created by the auditing daemon.</description>
      <reference ref_id="partition_for_var_log_audit" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-account_unique_name:def:1" version="1">
      <metadata>
        <title>Set All Accounts To Have Unique Names</title>
        <affected family="unix">
        </affected>
        <description>All accounts on the system should have unique names for proper accountability.</description>
      <reference ref_id="account_unique_name" source="ssg"/></metadata>
      <criteria comment="There should not exist duplicate user name entries in /etc/passwd">
        <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The maximum password age policy should meet minimum requirements.</description>
      <reference ref_id="accounts_maximum_age_login_defs" source="ssg"/></metadata>
      <criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The minimum password age policy should be set appropriately.</description>
      <reference ref_id="accounts_minimum_age_login_defs" source="ssg"/></metadata>
      <criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1">
      <metadata>
        <title>UID 0 Belongs Only To Root</title>
        <affected family="unix">
        </affected>
        <description>Only the root account should be assigned a user id of 0.</description>
      <reference ref_id="accounts_no_uid_except_zero" source="ssg"/></metadata>
      <criteria>
        <criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_all_shadowed:def:1" version="1">
      <metadata>
        <title>All Password Hashes Shadowed</title>
        <affected family="unix">
        </affected>
        <description>All password hashes should be shadowed.</description>
      <reference ref_id="accounts_password_all_shadowed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password minimum length should be set appropriately.</description>
      <reference ref_id="accounts_password_minlen_login_defs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password expiration warning age should be set appropriately.</description>
      <reference ref_id="accounts_password_warn_age_login_defs" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="4">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference ref_id="accounts_passwords_pam_faillock_deny" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" comment="pam_faillock.so authfail deny value set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" comment="pam_faillock.so set in account phase of system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" comment="pam_faillock.so authfail deny value set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" comment="pam_faillock.so set in account phase of password-auth"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2">
      <metadata>
        <title>Write permissions are disabled for group and other in all
      directories in Root's Path</title>
        <affected family="unix">
        </affected>
        <description>Check each directory in root's path and make use it does
      not grant write permission to group and other</description>
      <reference ref_id="accounts_root_path_dirs_no_write" source="ssg"/></metadata>
      <criteria comment="Check that write permission to group and other in root's path is denied">
        <criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1">
      <metadata>
        <title>The syslog Plugin Of the Audit Event Multiplexor (audispd) Is Activated</title>
        <affected family="unix">
        </affected>
        <description>active setting in /etc/audisp/plugins.d/syslog.conf is set to 'yes'</description>
      <reference ref_id="auditd_audispd_syslog_plugin_activated" source="ssg"/></metadata>
      <criteria>
        <criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1">
      <metadata>
        <title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</title>
        <affected family="unix">
        </affected>
        <description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</description>
      <reference ref_id="auditd_conf_log_group_not_root" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2">
      <metadata>
        <title>Auditd Email Account to Notify Upon Action</title>
        <affected family="unix">
        </affected>
        <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
      <reference ref_id="auditd_data_retention_action_mail_acct" source="ssg"/></metadata>
      <criteria>
        <criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Disk is Low on Space</title>
        <affected family="unix">
        </affected>
        <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_admin_space_left_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Log File Size</title>
        <affected family="unix">
        </affected>
        <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference ref_id="auditd_data_retention_max_log_file" source="ssg"/></metadata>
      <criteria>
        <criterion comment="max_log_file setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Maximum Log Size Reached</title>
        <affected family="unix">
        </affected>
        <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_max_log_file_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Number of Logs to Retain</title>
        <affected family="unix">
        </affected>
        <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference ref_id="auditd_data_retention_num_logs" source="ssg"/></metadata>
      <criteria>
        <criterion comment="num_logs setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3">
      <metadata>
        <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
        <affected family="unix">
        </affected>
        <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_space_left_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1">
      <metadata>
        <title>Ensure Yum gpgcheck Globally Activated</title>
        <affected family="unix">
        </affected>
        <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
      <reference ref_id="ensure_gpgcheck_globally_activated" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="Fedora installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          <criterion comment="check value of gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1"/>
        </criteria>
        <criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_logrotate_activated:def:1" version="1">
      <metadata>
        <title>Ensure the logrotate utility performs the automatic rotation of log files on daily basis</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </description>
      <reference ref_id="ensure_logrotate_activated" source="ssg"/></metadata>
      <criteria comment="/etc/logrotate.conf contains daily setting or /etc/cron.daily/logrotate file exists" operator="OR">
        <criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
        <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_var_log_audit:def:1" version="3">
      <metadata>
        <title>Verify /var/log/audit Ownership</title>
        <affected family="unix">
        </affected>
        <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
      <reference ref_id="file_ownership_var_log_audit" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="directories are root owned">
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
        </criteria>
        <criteria operator="AND" comment="log_group in auditd.conf is not root">
          <extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_home_dirs:def:1" version="1">
      <metadata>
        <title>Proper Permissions User Home Directories</title>
        <affected family="unix">
        </affected>
        <description>File permissions should be set correctly for the home directories for all user accounts.</description>
      <reference ref_id="file_permissions_home_dirs" source="ssg"/></metadata>
      <criteria>
        <criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_antivirus:def:1" version="1">
      <metadata>
        <title>Package Antivirus Installed</title>
        <affected family="unix">
        </affected>
        <description>Antivirus software should be installed.</description>
      <reference ref_id="install_antivirus" source="ssg"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met">
        <extend_definition comment="McAfee A/V Installed" definition_ref="oval:ssg-install_mcafee_antivirus:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_antivirus:def:1" version="1">
      <metadata>
        <title>Package McAfeeVSEForLinux Installed</title>
        <affected family="unix">
        </affected>
        <description>McAfee Antivirus software should be installed.</description>
      <reference ref_id="install_mcafee_antivirus" source="ssg"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met" operator="AND">
        <extend_definition comment="McAfee Runtime Libraries and Agent" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <criterion comment="Linuxshield AntiVirus package is installed" test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_cma_rt:def:1" version="1">
      <metadata>
        <title>Install the McAfee Runtime Libraries and Linux Agent</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</description>
      <reference ref_id="install_mcafee_cma_rt" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="McAfee runtime library package installed" test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1"/>
        <criterion comment="McAfee management agent package installed" test_ref="oval:ssg-test_mcafee_management_agent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss:def:1" version="1">
      <metadata>
        <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
        <affected family="unix">
        </affected>
        <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</description>
      <reference ref_id="install_mcafee_hbss" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_hips:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1">
      <metadata>
        <title>Install the Asset Configuration Compliance Module (ACCM)</title>
        <affected family="unix">
        </affected>
        <description>Install the Asset Configuration Compliance Module (ACCM).</description>
      <reference ref_id="install_mcafee_hbss_accm" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee ACCM is installed" test_ref="oval:ssg-test_mcafee_accm_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_hips:def:1" version="1">
      <metadata>
        <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is
      absolutely necessary. If SELinux is enabled, do not install or enable this module.</description>
      <reference ref_id="install_mcafee_hbss_hips" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee IPS  is installed" test_ref="oval:ssg-test_mcafee_hbss_hips_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1">
      <metadata>
        <title>Install the Policy Auditor (PA) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the Policy Auditor (PA) Module.</description>
      <reference ref_id="install_mcafee_hbss_pa" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee Policy Auditor is installed" test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
      <metadata>
        <title>CentOS 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 6</description>
      <reference ref_id="installed_OS_is_centos6" source="ssg"/></metadata>
      <criteria>
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
      <metadata>
        <title>CentOS 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 7</description>
      <reference ref_id="installed_OS_is_centos7" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
      <metadata>
        <title>Installed operating system is Fedora</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:fedoraproject:fedora:22" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:23" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:24" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:25" source="CPE"/>
        <description>The operating system installed on the system is Fedora</description>
      <reference ref_id="installed_OS_is_fedora" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="fedora-release RPM package is installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
        <criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
      <metadata>
        <title>Installed operating system is part of the Unix family</title>
        <affected family="unix">
        </affected>
        <description>The operating system installed on the system is part of the Unix OS family</description>
      <reference ref_id="installed_OS_is_part_of_Unix_family" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel6:def:1" version="2">
      <metadata>
        <title>Red Hat Enterprise Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 6</description>
      <reference ref_id="installed_OS_is_rhel6" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 6 Workstation is installed" test_ref="oval:ssg-test_rhel_workstation:tst:1"/>
          <criterion comment="RHEL 6 Server is installed" test_ref="oval:ssg-test_rhel_server:tst:1"/>
          <criterion comment="RHEL 6 Compute Node is installed" test_ref="oval:ssg-test_rhel_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
      <metadata>
        <title>Red Hat Enterprise Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
      <reference ref_id="installed_OS_is_rhel7" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
          <criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
          <criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
      <metadata>
        <title>Scientific Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 6</description>
      <reference ref_id="installed_OS_is_sl6" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
      <metadata>
        <title>Scientific Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 7</description>
      <reference ref_id="installed_OS_is_sl7" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux:def:1" version="1">
      <metadata>
        <title>WRLinux</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
        <description>The operating system installed on the system is
      Wind River Linux</description>
      <reference ref_id="installed_OS_is_wrlinux" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux:tst:1"/>
        <criterion comment="WRLinux is installed" test_ref="oval:ssg-test_wrlinux:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_direct_root_logins:def:1" version="1">
      <metadata>
        <title>Direct root Logins Not Allowed</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</description>
      <reference ref_id="no_direct_root_logins" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_empty_passwords:def:1" version="1">
      <metadata>
        <title>No nullok Option in /etc/pam.d/system-auth</title>
        <affected family="unix">
        </affected>
        <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
      <reference ref_id="no_empty_passwords" source="ssg"/></metadata>
      <criteria>
        <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_insecure_locks_exports:def:1" version="1">
      <metadata>
        <title>Ensure insecure_locks is disabled</title>
        <affected family="unix">
        </affected>
        <description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</description>
      <reference ref_id="no_insecure_locks_exports" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check for insecure NFS locks in /etc/exports" test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_netrc_files:def:1" version="1">
      <metadata>
        <title>Verify No netrc Files Exist</title>
        <affected family="unix">
        </affected>
        <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
      <reference ref_id="no_netrc_files" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2">
      <metadata>
        <title>System Accounts Do Not Run a Shell</title>
        <affected family="unix">
        </affected>
        <description>The root account is the only system account that should have
      a login shell.</description>
      <reference ref_id="no_shelllogin_for_systemaccounts" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- If SYS_UID_MIN and SYS_UID_MAX is not defined in /etc/login.defs
           perform the check that all /etc/passwd entries having shell defined
           have UIDs outside the default <0, UID_MIN -1> range.
           If at least one UID with shell defined exists within that range,
           the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
          <criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
          <criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
        </criteria>
        <!-- If both SYS_UID_MIN and SYS_UID_MAX are defined in /etc/login.defs
           perform both checks:
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for reserved system accounts <0, SYS_UID_MIN> range,
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for dynamically allocated system accounts <SYS_UID_MIN, SYS_UID_MAX>
           If at least one UID with shell defined exists within some of the two
           ranges, the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true"/>
          <criterion comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true"/>
          <criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
          <criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_net-snmp_removed:def:1" version="1">
      <metadata>
        <title>Package net-snmp Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package net-snmp should be removed.</description>
      <reference ref_id="package_net-snmp_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_prelink_removed:def:1" version="1">
      <metadata>
        <title>Package prelink Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package prelink should be removed.</description>
      <reference ref_id="package_prelink_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package prelink is removed" test_ref="oval:ssg-test_package_prelink_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-restrict_serial_port_logins:def:1" version="1">
      <metadata>
        <title>Restrict Serial Port Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
      <reference ref_id="restrict_serial_port_logins" source="ssg"/></metadata>
      <criteria>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_remote_loghost:def:1" version="1">
      <metadata>
        <title>Send Logs to a Remote Loghost</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Syslog logs should be sent to a remote loghost</description>
      <reference ref_id="rsyslog_remote_loghost" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
        <criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-securetty_root_login_console_only:def:1" version="1">
      <metadata>
        <title>Restrict Virtual Console Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
      <reference ref_id="securetty_root_login_console_only" source="ssg"/></metadata>
      <criteria>
        <criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_not_default_password:def:1" version="2">
      <metadata>
        <title>SNMP default communities disabled</title>
        <affected family="unix">
        </affected>
        <description>SNMP default communities must be removed.</description>
      <reference ref_id="snmpd_not_default_password" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP communities" test_ref="oval:ssg-test_snmp_default_communities:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2">
      <metadata>
        <title>SNMP use newer protocols</title>
        <affected family="unix">
        </affected>
        <description>SNMP version 1 and 2c must not be enabled.</description>
      <reference ref_id="snmpd_use_newer_protocol" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1">
      <metadata>
        <title>Ensure Only Protocol 2 Connections Allowed</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The OpenSSH daemon should be running protocol 2.</description>
      <reference ref_id="sshd_allow_only_protocol2" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1">
      <metadata>
        <title>Disable Empty Passwords</title>
        <affected family="unix">
        </affected>
        <description>Remote connections from accounts with empty passwords should
      be disabled (and dependencies are met)</description>
      <reference ref_id="sshd_disable_empty_passwords" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitEmptyPasswords in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitemptypasswords_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for Rhosts RSA Authentication</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</description>
      <reference ref_id="sshd_disable_rhosts_rsa" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_root_login:def:1" version="1">
      <metadata>
        <title>Disable root Login via SSH</title>
        <affected family="unix">
        </affected>
        <description>Root login via SSH should be disabled (and dependencies are
      met)</description>
      <reference ref_id="sshd_disable_root_login" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitrootlogin_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for User Known Hosts</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow system users host-based authentication
to connect to systems if a cache of the remote systems public keys are available.
This should be disabled.</description>
      <reference ref_id="sshd_disable_user_known_hosts" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check IgnoreUserKnownHosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_idle_timeout:def:1" version="1">
      <metadata>
        <title>Set OpenSSH Idle Timeout Interval</title>
        <affected family="unix">
        </affected>
        <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
      <reference ref_id="sshd_set_idle_timeout" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_keepalive:def:1" version="1">
      <metadata>
        <title>Set ClientAliveCountMax for User Logins</title>
        <affected family="unix">
        </affected>
        <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
      <reference ref_id="sshd_set_keepalive" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_64bit:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for 64-bit Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for 64-bit architectures to be used by other tests</description>
      <reference ref_id="system_info_architecture_64bit" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
        <extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for PPC and PPCLE Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for PPC PPC64LE architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_ppc_64" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
        <criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86 architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_x86" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86_64 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86_64 architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_x86_64" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" comment="System log files are owned by root group">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" comment="Permissions of system log files are 0640">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/group mode and ownership" id="oval:ssg-test_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_group_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_group_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_group_state_mode_0644:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="oval:ssg-test_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_gid_42:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_mode_0640:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/passwd mode and ownership" id="oval:ssg-test_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_mode_0644:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/shadow mode and ownership" id="oval:ssg-test_etc_shadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_shadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_gid_42:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_mode_0640:ste:1"/>
    </unix:file_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_auditd_installed:tst:1" version="1" comment="package auditd is installed">
      <linux:object object_ref="oval:ssg-obj_package_auditd_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cron_installed:tst:1" version="1" comment="package cron is installed">
      <linux:object object_ref="oval:ssg-obj_package_cron_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" comment="package inetutils-telnetd is removed">
      <linux:object object_ref="oval:ssg-obj_package_inetutils-telnetd_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nis_removed:tst:1" version="1" comment="package nis is removed">
      <linux:object object_ref="oval:ssg-obj_package_nis_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
      <linux:object object_ref="oval:ssg-obj_package_ntp_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" comment="package ntpdate is removed">
      <linux:object object_ref="oval:ssg-obj_package_ntpdate_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_openssh-server_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
      <linux:object object_ref="oval:ssg-obj_package_rsyslog_installed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" comment="package telnetd-ssl is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnetd-ssl_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:dpkginfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" comment="package telnetd is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnetd_removed:obj:1"/>
    </linux:dpkginfo_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_cron:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_cron_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_sshd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_sshd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_sshd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.protected_hardlinks set to 1" id="oval:ssg-test_runtime_sysctl_fs_protected_hardlinks:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_hardlinks:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_hardlinks:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.protected_symlinks set to 1" id="oval:ssg-test_runtime_sysctl_fs_protected_symlinks:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_symlinks:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_symlinks:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_suid_dumpable:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_suid_dumpable:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="oval:ssg-test_runtime_sysctl_kernel_dmesg_restrict:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_dmesg_restrict:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_dmesg_restrict:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.kptr_restrict set to 1" id="oval:ssg-test_runtime_sysctl_kernel_kptr_restrict:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_kptr_restrict:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_kptr_restrict:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" id="oval:ssg-test_runtime_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" id="oval:ssg-test_runtime_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" id="oval:ssg-test_runtime_sysctl_kernel_perf_event_paranoid:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_event_paranoid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_paranoid:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.pid_max set to 65536" id="oval:ssg-test_runtime_sysctl_kernel_pid_max:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_pid_max:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_pid_max:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_randomize_va_space:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_randomize_va_space:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.sysrq set to 0" id="oval:ssg-test_runtime_sysctl_kernel_sysrq:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_sysrq:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_sysrq:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_ip_forward:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_forward:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter vm.mmap_min_addr set to 65536" id="oval:ssg-test_runtime_sysctl_vm_mmap_min_addr:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_vm_mmap_min_addr:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_vm_mmap_min_addr:ste:1"/>
    </unix:sysctl_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.protected_hardlinks static configuration" id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.protected_symlinks static configuration" id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration" id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.dmesg_restrict static configuration" id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.kptr_restrict static configuration" id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_cpu_time_max_percent static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_event_max_sample_rate static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_event_paranoid static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.pid_max static configuration" id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration" id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.sysrq static configuration" id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="vm.mmap_min_addr static configuration" id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" comment="System log files are owned by root">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="system.map files readable only by root" id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_systemmap_files:obj:1"/>
      <unix:state state_ref="oval:ssg-state_owner_systemmap:ste:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_systemmap:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
      <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_8:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_debian_8:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_home_partition:tst:1" version="1" comment="/home on own partition">
      <linux:object object_ref="oval:ssg-object_mount_home_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_srv_partition:tst:1" version="1" comment="/srv on own partition">
      <linux:object object_ref="oval:ssg-object_mount_srv_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition:tst:1" version="1" comment="/tmp on own partition">
      <linux:object object_ref="oval:ssg-object_own_tmp_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition:tst:1" version="1" comment="/var on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition:tst:1" version="1" comment="/var/log on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition:tst:1" version="1" comment="check for /var/log/audit partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_audit_own_partition:obj:1"/>
    </linux:partition_test>
    <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user name entries in /etc/passwd" version="1">
      <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:password_test check="all" comment="password hashes are shadowed" id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
    </unix:password_test>
    <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="Check if there aren't directories in root's path having write permission set for group or other" id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" comment="audispd syslog plugin activated" id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" check="all" check_existence="none_exist" comment="log_group = root" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="email account for actions" id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="max log file size" id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/yum.conf" id="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the presence of daily setting in /etc/logrotate.conf file" id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_home_dirs_wrong_perm:ste:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" comment="AntiVirus package is installed">
      <linux:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" comment="Runtime Libraries package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" comment="Agent package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee ACCM installed" id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_hbss_hips_installed:tst:1" version="1" comment="McAfee IPS is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee Policy Auditor installed" id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="fedora-release RPM package is installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
      <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 6" id="oval:ssg-test_rhel_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 6" id="oval:ssg-test_rhel_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 6" id="oval:ssg-test_rhel_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_computenode:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_unix_wrlinux:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_wrlinux:ste:1"/>
    </ind:family_test>
    <unix:file_test check_existence="at_least_one_exists" version="1" id="oval:ssg-test_wrlinux:tst:1" check="all" comment="Test presence of /etc/wrlinux-release.">
      <unix:object object_ref="oval:ssg-obj_test_wrlinux:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/securetty file exists" id="oval:ssg-test_etc_securetty_exists:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="no entries in /etc/securetty" id="oval:ssg-test_no_direct_root_logins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="oval:ssg-test_no_empty_passwords:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the insecure locks in /etc/exports" id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="oval:ssg-test_no_netrc_files_home:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
    </unix:file_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_default_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_default_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="SYS_UID_MIN not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="SYS_UID_MAX not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_reserved_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_reserved_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1"/>
    </ind:variable_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" comment="package net-snmp is removed">
      <linux:object object_ref="oval:ssg-obj_package_net-snmp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_prelink_removed:tst:1" version="1" comment="package prelink is removed">
      <linux:object object_ref="oval:ssg-obj_package_prelink_removed:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_default_communities:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_versions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitEmptyPasswords[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitemptypasswords_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitRootLogin[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitrootlogin_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitrootlogin_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the IgnoreUserKnownHosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="32 bit architecture" id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
    </unix:uname_test>
  </tests>
  <objects>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_etc_group:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>group</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_etc_gshadow:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>gshadow</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_etc_passwd:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>passwd</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_etc_shadow:obj:1" version="1">
      <unix:path>/etc</unix:path>
      <unix:filename>shadow</unix:filename>
    </unix:file_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_auditd_installed:obj:1" version="1">
      <linux:name>auditd</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_cron_installed:obj:1" version="1">
      <linux:name>cron</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_inetutils-telnetd_removed:obj:1" version="1">
      <linux:name>inetutils-telnetd</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_nis_removed:obj:1" version="1">
      <linux:name>nis</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_ntp_installed:obj:1" version="1">
      <linux:name>ntp</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_ntpdate_removed:obj:1" version="1">
      <linux:name>ntpdate</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_openssh-server_removed:obj:1" version="1">
      <linux:name>openssh-server</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_rsyslog_installed:obj:1" version="1">
      <linux:name>rsyslog</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_telnetd-ssl_removed:obj:1" version="1">
      <linux:name>telnetd-ssl</linux:name>
    </linux:dpkginfo_object>
    <linux:dpkginfo_object id="oval:ssg-obj_package_telnetd_removed:obj:1" version="1">
      <linux:name>telnetd</linux:name>
    </linux:dpkginfo_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sshd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_hardlinks:obj:1" version="1">
      <unix:name>fs.protected_hardlinks</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_symlinks:obj:1" version="1">
      <unix:name>fs.protected_symlinks</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_suid_dumpable:obj:1" version="1">
      <unix:name>fs.suid_dumpable</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_dmesg_restrict:obj:1" version="1">
      <unix:name>kernel.dmesg_restrict</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_kptr_restrict:obj:1" version="1">
      <unix:name>kernel.kptr_restrict</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <unix:name>kernel.perf_cpu_time_max_percent</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <unix:name>kernel.perf_event_max_sample_rate</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
      <unix:name>kernel.perf_event_paranoid</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_pid_max:obj:1" version="1">
      <unix:name>kernel.pid_max</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <unix:name>kernel.randomize_va_space</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_sysrq:obj:1" version="1">
      <unix:name>kernel.sysrq</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <unix:name>net.ipv4.ip_forward</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_vm_mmap_min_addr:obj:1" version="1">
      <unix:name>vm.mmap_min_addr</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:file_object comment="system.mapfiles" id="oval:ssg-object_file_permissions_systemmap_files:obj:1" version="1">
      <!-- Check that /boot/System.map-* files is readable only by root -->
      <unix:path>/boot</unix:path>
      <unix:filename operation="pattern match">^System\.map.*$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
      <unix:filepath>/etc/debian_version</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_debian_8:obj:1" version="1" comment="Check Debian version">
      <ind:filepath>/etc/debian_version</ind:filepath>
      <ind:pattern operation="pattern match">^8.[0-9]+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_mount_home_own_partition:obj:1" version="1">
      <linux:mount_point>/home</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_srv_own_partition:obj:1" version="1">
      <linux:mount_point>/srv</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_own_tmp_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_own_partition:obj:1" version="1">
      <linux:mount_point>/var</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_audit_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log/audit</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <!-- User names from /etc/passwd (1-th column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MAX_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MAX_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
      <unix:username operation="pattern match">.*</unix:username>
    </unix:password_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_LEN directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_LEN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_WARN_AGE directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_WARN_AGE directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/password-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
      <ind:pid xsi:nil="true" datatype="int"/>
      <ind:name>PATH</ind:name>
    </ind:environmentvariable58_object>
    <unix:file_object comment="root's path directories with wrong group / other write permissions" id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1">
      <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</filter>
      <filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
      <ind:filepath>/etc/audisp/plugins.d/syslog.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" comment="log_group = root" version="1">
      <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/dnf/dnf.conf" version="1">
      <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
      <!-- Read whole /etc/logrotate.conf at once (as single line) -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/logrotate.conf</ind:filepath>
      <!-- From the content extract the text chunk after the last (uncommented)
         occurrence of 'daily' keyword till the EOF (including the 'daily'
         string itself) -->
      <ind:pattern operation="pattern match">(?:daily)*.*(?=[\n][\s]*daily)(.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
      <!-- From the found object exclude that one containing some (uncommented)
         occurrence of (weekly / monthly / yearly) outside the {} block section
         of /etc/logrotate.conf -->
      <filter action="exclude">oval:ssg-state_another_rotate_interval_after_daily:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
      <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s]*/etc/logrotate.conf(?:.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="home directories" id="oval:ssg-object_file_permissions_home_dirs:obj:1" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="exclude">oval:ssg-state_home_dirs_home_itself:ste:1</filter>
      <filter action="include">oval:ssg-state_home_dirs_wrong_perm:ste:1</filter>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
      <linux:name>McAfeeVSEForLinux</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
      <linux:name>MFErt</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
      <linux:name>MFEcma</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/accm/bin</unix:path>
      <unix:filename>accm</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1" version="1">
      <linux:name>MFEhiplsm</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/auditengine/bin</unix:path>
      <unix:filename>auditmanager</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
      <linux:name>fedora-release</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
      <ind:filepath>/etc/system-release-cpe</ind:filepath>
      <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_unix_wrlinux:obj:1" version="1"/>
    <unix:file_object version="1" id="oval:ssg-obj_test_wrlinux:obj:1">
      <unix:filepath>/etc/wrlinux-release</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object comment="/etc/securetty file exists" id="oval:ssg-object_etc_securetty_exists:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="no entries /etc/securetty" id="oval:ssg-object_no_direct_root_logins:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
      <ind:filepath>/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="look for .netrc in /home" id="oval:ssg-object_no_netrc_files_home:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename operation="pattern match">^\.netrc$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance od UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n(?!#|SYS_)(UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MAX directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MAX[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_default_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_default_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_reserved_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_reserved_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_dynalloc_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_net-snmp_removed:obj:1" version="1">
      <linux:name>net-snmp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_prelink_removed:obj:1" version="1">
      <linux:name>prelink</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
      <ind:path>/etc/rsyslog.d</ind:path>
      <ind:filename operation="pattern match">.*</ind:filename>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity|createUser).*(public|private)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitrootlogin_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreUserKnownHosts(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
    <unix:uname_object comment="32 bit architecture" id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1"/>
  </objects>
  <states>
    <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:group_id datatype="int">4</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_group_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_group_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_group_state_mode_0644:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_gid_42:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">42</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_mode_0640:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_mode_0644:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_gid_42:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">42</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_mode_0640:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">auditd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cron_on:ste:1" comment="cron listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">cron.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">ntpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">rsyslog.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sshd_off:ste:1" comment="sshd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">sshd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_hardlinks:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_symlinks:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_suid_dumpable:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_dmesg_restrict:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_kptr_restrict:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_event_paranoid:ste:1" version="1">
      <unix:value datatype="int" operation="equals">2</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_pid_max:ste:1" version="1">
      <unix:value datatype="int" operation="equals">65536</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_randomize_va_space:ste:1" version="1">
      <unix:value datatype="int" operation="equals">2</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_sysrq:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_ip_forward:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_ip_forward_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_vm_mmap_min_addr:ste:1" version="1">
      <unix:value datatype="int" operation="equals">65536</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_ip_forward_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_systemmap:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_systemmap:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
      <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
      <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
      <unix:password>x</unix:password>
    </unix:password_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state comment="group or other has write privilege" id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state comment="symbolic link" id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_max_log_file:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_num_logs:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_another_rotate_interval_after_daily:ste:1" version="1">
      <!-- if some of (weekly / monthly / yearly) uncommented setting is found
         (in the previously selected chunk of text) in one of the following
         parts:
         * before the first '{' character,
         * somewhere after '}' character and before another '{' character,
         * after final '}' character and before end of the chunk
         exclude such object from the found ones (since in that case earlier
         daily setting would be replaced with the found setting) -->
      <ind:subexpression datatype="string" operation="pattern match">}[^{]+[\n][\s]*(weekly|monthly|yearly)|[\n][\s]*(weekly|monthly|yearly)[^}]+{</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_home_itself:ste:1" version="1">
      <!-- Exclude /home directory itself from the check. Check /home/* directories only. -->
      <unix:path operation="equals">/home</unix:path>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_wrong_perm:ste:1" version="1" operator="OR">
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_server:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_wrlinux:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_default_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_reserved_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:textfilecontent54_state comment="upper bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state comment="lower bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
      <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64le</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="32 bit architecture" id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1">
      <unix:processor_type operation="equals">i686</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1">
      <unix:processor_type operation="equals">x86_64</unix:processor_type>
    </unix:uname_state>
  </states>
  <variables>
    <local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfg_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfg_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfp_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfp_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_log_files_paths:obj:1"/>
    </local_variable>
    <external_variable comment="External variable for net.ipv4.ip_forward" datatype="int" id="oval:ssg-sysctl_net_ipv4_ip_forward_value:var:1" version="1"/>
    <local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfo_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfo_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
      <count>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of unique username rows retrieved from /etc/passwd">
      <count>
        <unique>
          <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
        </unique>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Maximum password age" datatype="int" id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Minimum password age in days" datatype="int" id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Password minimum length" datatype="int" id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="password expiration warning age in days" datatype="int" id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1"/>
    <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
    <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1">
      <split delimiter=":">
        <object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
      </split>
    </local_variable>
    <external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1"/>
    <external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1"/>
    <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg-var_auditd_max_log_file:var:1" version="1"/>
    <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1"/>
    <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg-var_auditd_num_logs:var:1" version="1"/>
    <external_variable comment="audit space_left_action setting" datatype="string" id="oval:ssg-var_auditd_space_left_action:var:1" version="2"/>
    <local_variable id="oval:ssg-variable_sys_uids_etc_passwd:var:1" datatype="int" comment="UIDs retrieved from /etc/passwd" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_uid_min_value:var:1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_default_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - (UID_MIN - 1)) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Get (x - (UID_MIN -1)) result -->
        <arithmetic arithmetic_operation="add">
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get -1 * (UID_MIN - 1) result -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <!-- Get (UID_MIN -1) result -->
            <arithmetic arithmetic_operation="add">
              <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
              <variable_component var_ref="oval:ssg-variable_uid_min_value:var:1"/>
              <literal_component datatype="int">-1</literal_component>
            </arithmetic>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_reserved_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - SYS_UID_MIN) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_dynalloc_range_quad_expr:var:1" datatype="int" comment="Construct (x - SYS_UID_MIN) * (x - SYS_UID_MAX) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
        <!-- Construct (x - SYS_UID_MAX) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MAX -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <external_variable comment="timeout value" datatype="int" id="oval:ssg-sshd_idle_timeout_value:var:1" version="1"/>
  </variables>
</oval_definitions></ds:component></ds:data-stream-collection>