ssg-nondebian 0.1.31-5 / usr / share / scap-security-guide / RHEL / 6 / puppet-remediations.xml

<fix-content system="urn:xccdf:fix:script:sh" xmlns="http://checklists.nist.gov/xccdf/1.1">
  <fix-group id="puppet" system="urn:xccdf:fix:script:puppet" xmlns="http://checklists.nist.gov/xccdf/1.1">
    <fix rule="package_ypbind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_ypbind

class remove_ypbind {
  package { 'ypbind':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_samba-common_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_samba-common

class install_samba-common {
  package { 'samba-common':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_telnet_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnet

class remove_telnet {
  package { 'telnet':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_net-snmp

class remove_net-snmp {
  package { 'net-snmp':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_dovecot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_dovecot

class remove_dovecot {
  package { 'dovecot':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_vsftpd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_vsftpd

class install_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_rsh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rsh-server

class remove_rsh-server {
  package { 'rsh-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audit

class install_audit {
  package { 'audit':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_talk_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_talk

class remove_talk {
  package { 'talk':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_httpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_httpd

class remove_httpd {
  package { 'httpd':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_talk-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_talk-server

class remove_talk-server {
  package { 'talk-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_rsh_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rsh

class remove_rsh {
  package { 'rsh':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="file_permissions_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="disable">include ssh_public_key_perms

class ssh_public_key_perms {
  exec { 'sshd_pub_key':
    command =&gt; "chmod 0644 /etc/ssh/*.pub",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
    <fix rule="file_permissions_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="disable">include ssh_private_key_perms

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
    <fix rule="package_iptables-ipv6_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_iptables-ipv6

class install_iptables-ipv6 {
  package { 'iptables-ipv6':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_policycoreutils

class install_policycoreutils {
  package { 'policycoreutils':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_irqbalance_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_irqbalance

class install_irqbalance {
  package { 'irqbalance':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_GConf2_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_GConf2

class install_GConf2 {
  package { 'GConf2':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_ypserv_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_ypserv

class remove_ypserv {
  package { 'ypserv':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_telnet-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnet-server

class remove_telnet-server {
  package { 'telnet-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_xinetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_xinetd

class remove_xinetd {
  package { 'xinetd':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_gdm_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_gdm

class install_gdm {
  package { 'gdm':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rsyslog

class install_rsyslog {
  package { 'rsyslog':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_cronie_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_cronie

class install_cronie {
  package { 'cronie':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_iptables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_iptables

class install_iptables {
  package { 'iptables':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_postfix_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_postfix

class install_postfix {
  package { 'postfix':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_screen_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_screen

class install_screen {
  package { 'screen':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_samba_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_samba

class remove_samba {
  package { 'samba':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_psacct_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_psacct

class install_psacct {
  package { 'psacct':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_openswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openswan

class install_openswan {
  package { 'openswan':
    ensure =&gt; 'installed',
  }
}
</fix>
  </fix-group>
</fix-content>