ssg-nondebian 0.1.31-5 / usr / share / scap-security-guide / RHEL / 7 / puppet-remediations.xml

<fix-content system="urn:xccdf:fix:script:sh" xmlns="http://checklists.nist.gov/xccdf/1.1">
  <fix-group id="puppet" system="urn:xccdf:fix:script:puppet" xmlns="http://checklists.nist.gov/xccdf/1.1">
    <fix rule="package_ypbind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_ypbind

class remove_ypbind {
  package { 'ypbind':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_samba-common_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_samba-common

class install_samba-common {
  package { 'samba-common':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_telnet_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnet

class remove_telnet {
  package { 'telnet':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_net-snmp

class remove_net-snmp {
  package { 'net-snmp':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_dovecot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_dovecot

class remove_dovecot {
  package { 'dovecot':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_vsftpd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_vsftpd

class install_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_rsh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rsh-server

class remove_rsh-server {
  package { 'rsh-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audit

class install_audit {
  package { 'audit':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_talk_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_talk

class remove_talk {
  package { 'talk':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_httpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_httpd

class remove_httpd {
  package { 'httpd':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_talk-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_talk-server

class remove_talk-server {
  package { 'talk-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_rsh_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rsh

class remove_rsh {
  package { 'rsh':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="file_permissions_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="disable">include ssh_public_key_perms

class ssh_public_key_perms {
  exec { 'sshd_pub_key':
    command =&gt; "chmod 0644 /etc/ssh/*.pub",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
    <fix rule="file_permissions_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="disable">include ssh_private_key_perms

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
    <fix rule="package_tcp_wrappers_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_tcp_wrappers

class install_tcp_wrappers {
  package { 'tcp_wrappers':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_dbus_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_dbus

class remove_dbus {
  package { 'dbus':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_openssh-server

class remove_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_quagga_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_quagga

class remove_quagga {
  package { 'quagga':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_dhcp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_dhcp

class remove_dhcp {
  package { 'dhcp':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_portreserve_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_portreserve

class remove_portreserve {
  package { 'portreserve':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_rhnsd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rhnsd

class remove_rhnsd {
  package { 'rhnsd':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_bluez_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_bluez

class remove_bluez {
  package { 'bluez':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_libreswan

class install_libreswan {
  package { 'libreswan':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_sssd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_sssd

class install_sssd {
  package { 'sssd':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_sysstat_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_sysstat

class remove_sysstat {
  package { 'sysstat':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_nfs-utils

class remove_nfs-utils {
  package { 'nfs-utils':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_libcgroup-tools_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_libcgroup-tools

class remove_libcgroup-tools {
  package { 'libcgroup-tools':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_pam_pkcs11_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_pam_pkcs11

class install_pam_pkcs11 {
  package { 'pam_pkcs11':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_qpid-cpp-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_qpid-cpp-server

class remove_qpid-cpp-server {
  package { 'qpid-cpp-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_policycoreutils

class install_policycoreutils {
  package { 'policycoreutils':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_kernel-tools_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_kernel-tools

class remove_kernel-tools {
  package { 'kernel-tools':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_tftp-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_tftp-server

class remove_tftp-server {
  package { 'tftp-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_irqbalance_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_irqbalance

class install_irqbalance {
  package { 'irqbalance':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_esc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_esc

class install_esc {
  package { 'esc':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_acpid_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_acpid

class remove_acpid {
  package { 'acpid':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_cyrus-sasl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_cyrus-sasl

class remove_cyrus-sasl {
  package { 'cyrus-sasl':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openssh-server

class install_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_oddjob_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_oddjob

class remove_oddjob {
  package { 'oddjob':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_certmonger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_certmonger

class remove_certmonger {
  package { 'certmonger':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_ypserv_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_ypserv

class remove_ypserv {
  package { 'ypserv':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_telnet-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnet-server

class remove_telnet-server {
  package { 'telnet-server':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_xinetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_xinetd

class remove_xinetd {
  package { 'xinetd':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rsyslog

class install_rsyslog {
  package { 'rsyslog':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_quota-nld_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_quota-nld

class remove_quota-nld {
  package { 'quota-nld':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_kexec-tools_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_kexec-tools

class remove_kexec-tools {
  package { 'kexec-tools':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_cronie_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_cronie

class install_cronie {
  package { 'cronie':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_postfix_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_postfix

class install_postfix {
  package { 'postfix':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_squid_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_squid

class remove_squid {
  package { 'squid':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_screen_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_screen

class install_screen {
  package { 'screen':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_smartmontools_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_smartmontools

class remove_smartmontools {
  package { 'smartmontools':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_samba_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_samba

class remove_samba {
  package { 'samba':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_psacct_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_psacct

class install_psacct {
  package { 'psacct':
    ensure =&gt; 'installed',
  }
}
</fix>
    <fix rule="package_avahi_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_avahi

class remove_avahi {
  package { 'avahi':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_libcgroup_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_libcgroup

class remove_libcgroup {
  package { 'libcgroup':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_subscription-manager_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_subscription-manager

class remove_subscription-manager {
  package { 'subscription-manager':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_cups_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_cups

class remove_cups {
  package { 'cups':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_bind

class remove_bind {
  package { 'bind':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_at_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_at

class remove_at {
  package { 'at':
    ensure =&gt; 'purged',
  }
}
</fix>
    <fix rule="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_vsftpd

class remove_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'purged',
  }
}
</fix>
  </fix-group>
</fix-content>