ssg-nondebian 0.1.31-5 / usr / share / scap-security-guide / ssg-rhel6-oval.xml

<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
  <generator>
    <oval:product_name>python</oval:product_name>
    <oval:product_version>2.7.13+</oval:product_version>
    <oval:schema_version>5.11</oval:schema_version>
    <oval:timestamp>2017-08-11T21:23:24</oval:timestamp>
  </generator>
  <definitions>
    <definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate group.</description>
      <reference ref_id="rsyslog_files_groupownership" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate user.</description>
      <reference ref_id="rsyslog_files_ownership" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>File permissions for all syslog log files should be set correctly.</description>
      <reference ref_id="rsyslog_files_permissions" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_dcredit:def:1" version="1">
      <metadata>
        <title>Set Password dcredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password dcredit should meet minimum requirements</description>
      <reference ref_id="accounts_password_pam_dcredit" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib dcredit" test_ref="oval:ssg-test_password_pam_cracklib_dcredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_difok:def:1" version="2">
      <metadata>
        <title>Set Password difok Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password difok should meet minimum requirements</description>
      <reference ref_id="accounts_password_pam_difok" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib difok" test_ref="oval:ssg-test_password_pam_cracklib_difok:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_lcredit:def:1" version="2">
      <metadata>
        <title>Set Password lcredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password lcredit should meet minimum requirements</description>
      <reference ref_id="accounts_password_pam_lcredit" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib lcredit" test_ref="oval:ssg-test_password_pam_cracklib_lcredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="1">
      <metadata>
        <title>Set Password maxrepeat Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password maxrepeat should meet minimum
      requirements using pam_pwquality</description>
      <reference ref_id="accounts_password_pam_maxrepeat" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib maxrepeat" test_ref="oval:ssg-test_password_pam_cracklib_maxrepeat:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_minclass:def:1" version="1">
      <metadata>
        <title>Set Password minclass Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password minclass should meet the minimum requirements</description>
      <reference ref_id="accounts_password_pam_minclass" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib minclass" test_ref="oval:ssg-test_password_pam_cracklib_minclass:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_minlen:def:1" version="1">
      <metadata>
        <title>Set Password minlen Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password minlen should meet minimum requirements</description>
      <reference ref_id="accounts_password_pam_minlen" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib" test_ref="oval:ssg-test_password_pam_minlen:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_ocredit:def:1" version="2">
      <metadata>
        <title>Set Password ocredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password ocredit should meet minimum requirements</description>
      <reference ref_id="accounts_password_pam_ocredit" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib ocredit" test_ref="oval:ssg-test_password_pam_cracklib_ocredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_retry:def:1" version="1">
      <metadata>
        <title>Set Password retry Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password retry should meet minimum
      requirements</description>
      <reference ref_id="accounts_password_pam_retry" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib" test_ref="oval:ssg-test_password_pam_cracklib_retry:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_ucredit:def:1" version="2">
      <metadata>
        <title>Set Password ucredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password ucredit should meet minimum requirements</description>
      <reference ref_id="accounts_password_pam_ucredit" source="ssg"/></metadata>
      <criteria>
        <criterion comment="rhel6 pam_cracklib ucredit" test_ref="oval:ssg-test_password_pam_cracklib_ucredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - chmod</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_chmod" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification chmod x32" test_ref="oval:ssg-test_audit_rules_dac_modification_chmod_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification chmod x64" test_ref="oval:ssg-test_audit_rules_dac_modification_chmod_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - chown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_chown" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification chown x32" test_ref="oval:ssg-test_audit_rules_dac_modification_chown_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification chown x64" test_ref="oval:ssg-test_audit_rules_dac_modification_chown_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchmod</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_fchmod" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchmod x32" test_ref="oval:ssg-test_audit_rules_dac_modification_fchmod_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification fchmod x64" test_ref="oval:ssg-test_audit_rules_dac_modification_fchmod_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchmodat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_fchmodat" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchmodat x32" test_ref="oval:ssg-test_audit_rules_dac_modification_fchmodat_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification fchmodat x64" test_ref="oval:ssg-test_audit_rules_dac_modification_fchmodat_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_fchown" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchown x32" test_ref="oval:ssg-test_audit_rules_dac_modification_fchown_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification fchown x64" test_ref="oval:ssg-test_audit_rules_dac_modification_fchown_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchownat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_fchownat" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchownat x32" test_ref="oval:ssg-test_audit_rules_dac_modification_fchownat_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification fchownat x64" test_ref="oval:ssg-test_audit_rules_dac_modification_fchownat_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fremovexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_fremovexattr" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fremovexattr x32" test_ref="oval:ssg-test_audit_rules_dac_modification_fremovexattr_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification fremovexattr x64" test_ref="oval:ssg-test_audit_rules_dac_modification_fremovexattr_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fsetxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_fsetxattr" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fsetxattr x32" test_ref="oval:ssg-test_audit_rules_dac_modification_fsetxattr_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification fsetxattr x64" test_ref="oval:ssg-test_audit_rules_dac_modification_fsetxattr_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lchown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_lchown" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification lchown x32" test_ref="oval:ssg-test_audit_rules_dac_modification_lchown_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification lchown x64" test_ref="oval:ssg-test_audit_rules_dac_modification_lchown_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lremovexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_lremovexattr" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification lremovexattr x32" test_ref="oval:ssg-test_audit_rules_dac_modification_lremovexattr_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification lremovexattr x64" test_ref="oval:ssg-test_audit_rules_dac_modification_lremovexattr_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lsetxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_lsetxattr" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification lsetxattr x32" test_ref="oval:ssg-test_audit_rules_dac_modification_lsetxattr_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification lsetxattr x64" test_ref="oval:ssg-test_audit_rules_dac_modification_lsetxattr_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - removexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_removexattr" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification removexattr x32" test_ref="oval:ssg-test_audit_rules_dac_modification_removexattr_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification removexattr x64" test_ref="oval:ssg-test_audit_rules_dac_modification_removexattr_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - setxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The changing of file permissions and attributes should be 
      audited.</description>
      <reference ref_id="audit_rules_dac_modification_setxattr" source="ssg"/></metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification setxattr x32" test_ref="oval:ssg-test_audit_rules_dac_modification_setxattr_x32:tst:1"/>
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criterion comment="dac modification setxattr x64" test_ref="oval:ssg-test_audit_rules_dac_modification_setxattr_x64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1">
      <metadata>
        <title>Audit File Deletion Events</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit files deletion events.</description>
      <reference ref_id="audit_rules_file_deletion_events" source="ssg"/></metadata>
      <criteria>
        <criterion comment="audit file delete" test_ref="oval:ssg-test_audit_rules_file_deletion_events:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_immutable:def:1" version="1">
      <metadata>
        <title>Make Audit Configuration Immutable</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Force a reboot to change audit rules is
      enabled</description>
      <reference ref_id="audit_rules_immutable" source="ssg"/></metadata>
      <criteria>
        <criterion comment="immutable" test_ref="oval:ssg-test_audit_rules_immutable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="2">
      <metadata>
        <title>Audit Kernel Module Loading and Unloading</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
      <reference ref_id="audit_rules_kernel_module_loading" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="audit insmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_insmod:tst:1"/>
        <criterion comment="audit rmmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_rmmod:tst:1"/>
        <criterion comment="audit rmmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_modprobe:tst:1"/>
        <criterion comment="audit module syscalls" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_syscall:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_login_events:def:1" version="2">
      <metadata>
        <title>Record Attempts to Alter Login and Logout Events</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
      <reference ref_id="audit_rules_login_events" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="tallylog" test_ref="oval:ssg-test_audit_rules_login_events_tallylog:tst:1"/>
        <criterion comment="faillock" test_ref="oval:ssg-test_audit_rules_login_events_faillock:tst:1"/>
        <criterion comment="lastlog" test_ref="oval:ssg-test_audit_rules_login_events_lastlog:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_mac_modification:def:1" version="2">
      <metadata>
        <title>Record Events that Modify the System's Mandatory Access Controls</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</description>
      <reference ref_id="audit_rules_mac_modification" source="ssg"/></metadata>
      <criteria>
        <criterion comment="audit changes selinux" test_ref="oval:ssg-test_audit_rules_mac_modification:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_media_export:def:1" version="1">
      <metadata>
        <title>Audit Information Export To Media</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules that detect the mounting of filesystems should be enabled.</description>
      <reference ref_id="audit_rules_media_export" source="ssg"/></metadata>
      <criteria>
        <criterion comment="audit mount" test_ref="oval:ssg-test_audit_rules_media_export:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="2">
      <metadata>
        <title>Record Events that Modify the System's Network Environment</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
      <reference ref_id="audit_rules_networkconfig_modification" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="network modification syscall" test_ref="oval:ssg-test_audit_rules_networkconfig_modification_syscall:tst:1"/>
        <criterion comment="/etc/issue modification" test_ref="oval:ssg-test_audit_rules_networkconfig_modification_etc_issue:tst:1"/>
        <criterion comment="/etc/issue.net modification" test_ref="oval:ssg-test_audit_rules_networkconfig_modification_etc_issue_net:tst:1"/>
        <criterion comment="/etc/hosts modification" test_ref="oval:ssg-test_audit_rules_networkconfig_modification_etc_hosts:tst:1"/>
        <criterion comment="/etc/sysconfig/network modification" test_ref="oval:ssg-test_audit_rules_networkconfig_modification_etc_sysconfig_network:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_privileged_commands:def:1" version="3">
      <metadata>
        <title>
        Ensure auditd Collects Information on the Use of Privileged Commands
      </title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules about the Information on the Use of Privileged
      Commands are enabled</description>
      <reference ref_id="audit_rules_privileged_commands" source="ssg"/></metadata>
      <criteria>
        <criterion comment="/etc/audit/audit.rules contains -a always,exit       -F path=path_to_binary -F perm=x -F auid&gt;=500 -F auid!=4294967295       -k privileged for each setuid or setgid executable on the system" test_ref="oval:ssg-test_audit_rules_privileged_commands:tst:1"/>
        <criterion comment="check if count of privileged commands on the system       matches the count of defined audit.rules in the expected form" test_ref="oval:ssg-test_sets_dimension_match:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_session_events:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Process and Session Initiation Information</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules should capture information about session initiation.</description>
      <reference ref_id="audit_rules_session_events" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="utmp" test_ref="oval:ssg-test_audit_rules_session_events_utmp:tst:1"/>
        <criterion comment="btmp" test_ref="oval:ssg-test_audit_rules_session_events_btmp:tst:1"/>
        <criterion comment="wtmp" test_ref="oval:ssg-test_audit_rules_session_events_wtmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="2">
      <metadata>
        <title>Audit System Administrator Actions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit actions taken by system administrators on the system.</description>
      <reference ref_id="audit_rules_sysadmin_actions" source="ssg"/></metadata>
      <criteria>
        <criterion comment="audit sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through Adjtimex</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Record attempts to alter time through adjtimex.
      </description>
      <reference ref_id="audit_rules_time_adjtimex" source="ssg"/></metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <criterion comment="32bit line adjtimex and key present" test_ref="oval:ssg-test_audit_rules_time_adjtimex_x86:tst:1"/>
        </criteria>
        <criteria comment="both ..." operator="AND">
          <extend_definition comment="64bit and ..." definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
          <criterion comment="64bit line for adjtimex and key present" test_ref="oval:ssg-test_audit_rules_time_adjtimex_x86_64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2">
      <metadata>
        <title>Record Attempts to Alter Time Through Clock_settime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Record attempts to alter time through clock_settime.
      </description>
      <reference ref_id="audit_rules_time_clock_settime" source="ssg"/></metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <criterion comment="32bit line clock_settime and key present" test_ref="oval:ssg-test_audit_rules_time_clock_settime_x86:tst:1"/>
        </criteria>
        <criteria comment="both ..." operator="AND">
          <extend_definition comment="64bit and ..." definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
          <criterion comment="64bit line for clock_settime and key present" test_ref="oval:ssg-test_audit_rules_time_clock_settime_x86_64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through Settimeofday</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Record attempts to alter time through settimeofday.
      </description>
      <reference ref_id="audit_rules_time_settimeofday" source="ssg"/></metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <criterion comment="32bit line settimeofday and key present" test_ref="oval:ssg-test_audit_rules_time_settimeofday_x86:tst:1"/>
        </criteria>
        <criteria comment="both ..." operator="AND">
          <extend_definition comment="64bit and ..." definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
          <criterion comment="64bit line for settimeofday and key present" test_ref="oval:ssg-test_audit_rules_time_settimeofday_x86_64:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_stime:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through Stime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</description>
      <reference ref_id="audit_rules_time_stime" source="ssg"/></metadata>
      <criteria comment="32-bit or 64-bit system and 32-bit arch stime line and key present" operator="AND">
        <criteria comment="32-bit or 64-bit system" operator="OR">
          <extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
        </criteria>
        <criterion comment="32-bit arch stime line and key present" test_ref="oval:ssg-test_audit_rules_time_stime_x86:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through the Localtime File</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Record attempts to alter time through /etc/localtime
      </description>
      <reference ref_id="audit_rules_time_watch_localtime" source="ssg"/></metadata>
      <criteria comment="Test for localtime file being watched">
        <criterion comment="watch localtime file" test_ref="oval:ssg-test_audit_rules_time_watch_localtime:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="3">
      <metadata>
        <title>Ensure auditd Collects Unauthorized Access Attempts to
      Files (unsuccessful)</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules about the Unauthorized Access Attempts to Files (unsuccessful) are enabled</description>
      <reference ref_id="audit_rules_unsuccessful_file_modification" source="ssg"/></metadata>
      <!-- 32-bit unsuccessful file modifications are monitored -->
      <criteria operator="AND">
        <criterion comment="32-bit audit file eacces" test_ref="oval:ssg-test_32bit_audit_rules_unsuccessful_file_modification_eacces:tst:1"/>
        <criterion comment="32-bit audit file eperm" test_ref="oval:ssg-test_32bit_audit_rules_unsuccessful_file_modification_eperm:tst:1"/>
        <!-- system is not 64-bit or 64-bit unsuccessful file modifications are monitored -->
        <criteria operator="OR">
          <extend_definition comment="64-bit" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
          <criteria operator="AND">
            <criterion comment="64-bit audit file eacces" test_ref="oval:ssg-test_64bit_audit_rules_unsuccessful_file_modification_eacces:tst:1"/>
            <criterion comment="64-bit audit file eperm" test_ref="oval:ssg-test_64bit_audit_rules_unsuccessful_file_modification_eperm:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification:def:1" version="2">
      <metadata>
        <title>Audit User/Group Information</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit rules should detect modification to system files that hold information about users and groups.</description>
      <reference ref_id="audit_rules_usergroup_modification" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group:tst:1"/>
        <criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd:tst:1"/>
        <criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow:tst:1"/>
        <criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow:tst:1"/>
        <criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-avahi_check_ttl:def:1" version="1">
      <metadata>
        <title>Check Avahi Responses' to TTL Field</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Check that Avahi is ignoring packets
      unless the TTL field is 255.
      </description>
      <reference ref_id="avahi_check_ttl" source="ssg"/></metadata>
      <criteria comment="Check Avahi TTL setting" operator="OR">
        <extend_definition comment="avahi package is not installed" definition_ref="oval:ssg-package_avahi_installed:def:1" negate="true"/>
        <criterion comment="Avahi TTL setting is enabled" test_ref="oval:ssg-test_avahi_ttl_setting:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-avahi_disable_publishing:def:1" version="1">
      <metadata>
        <title>Disable Avahi Publishing</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable Avahi from publishing records.</description>
      <reference ref_id="avahi_disable_publishing" source="ssg"/></metadata>
      <criteria comment="Disable Avahi Publishing" operator="OR">
        <extend_definition comment="avahi package is not installed" definition_ref="oval:ssg-package_avahi_installed:def:1" negate="true"/>
        <criterion comment="Avahi publishing is disabled" test_ref="oval:ssg-test_avahi_disable_publishing:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-avahi_ip_only:def:1" version="1">
      <metadata>
        <title>Serve Avahi Only via Required Protocol</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require Avahi to run on IPv4 or IPv6.</description>
      <reference ref_id="avahi_ip_only" source="ssg"/></metadata>
      <criteria comment="Check Avahi IPv4 and IPv6 settings" operator="OR">
        <extend_definition comment="avahi package is not installed" definition_ref="oval:ssg-package_avahi_installed:def:1" negate="true"/>
        <criteria comment="Test that Avahi IPv4 is enabled" operator="AND">
          <criterion comment="Avahi IPv4 setting is enabled" test_ref="oval:ssg-test_avahi_ipv4_setting:tst:1"/>
          <criterion comment="Avahi IPv6 setting is disabled" test_ref="oval:ssg-test_avahi_ipv6_setting:tst:1" negate="true"/>
        </criteria>
        <criteria comment="Test that Avahi IPv6 is enabled" operator="AND">
          <criterion comment="Avahi IPv4 setting is disabled" test_ref="oval:ssg-test_avahi_ipv4_setting:tst:1" negate="true"/>
          <criterion comment="Avahi IPv6 setting is enabled" test_ref="oval:ssg-test_avahi_ipv6_setting:tst:1"/>
        </criteria>
        <criteria comment="Test that Avahi IPv4 and IPv6 are enabled" operator="AND">
          <criterion comment="Avahi IPv4 setting is enabled" test_ref="oval:ssg-test_avahi_ipv4_setting:tst:1"/>
          <criterion comment="Avahi IPv6 setting is enabled" test_ref="oval:ssg-test_avahi_ipv6_setting:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-avahi_prevent_port_sharing:def:1" version="1">
      <metadata>
        <title>Prevent Other Programs from using Avahi's Port</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Ensures that only Avahi is responsible for mDNS
      traffic coming from the port on the system.
      </description>
      <reference ref_id="avahi_prevent_port_sharing" source="ssg"/></metadata>
      <criteria comment="Prevent Avahi Port Sharing" operator="OR">
        <extend_definition comment="avahi package is not installed" definition_ref="oval:ssg-package_avahi_installed:def:1" negate="true"/>
        <criterion comment="Prevent Avahi Port Sharing" test_ref="oval:ssg-test_avahi_port_sharing:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-avahi_restrict_published_information:def:1" version="1">
      <metadata>
        <title>Restrict Information Published by Avahi</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Prevent user applications from using Avahi
      to publish services.
      </description>
      <reference ref_id="avahi_restrict_published_information" source="ssg"/></metadata>
      <criteria comment="Restrict Avahi Publishing" operator="OR">
        <extend_definition comment="avahi package is not installed" definition_ref="oval:ssg-package_avahi_installed:def:1" negate="true"/>
        <criteria comment="Test that Avahi publishing information is disabled" operator="AND">
          <criterion comment="Avahi user publishing information is disabled" test_ref="oval:ssg-test_avahi_restrict_user_publishing:tst:1"/>
          <criterion comment="Avahi Restrict Address Publishing" test_ref="oval:ssg-test_avahi_restrict_address_publishing:tst:1"/>
          <criterion comment="Avahi Restrict HW Publishing" test_ref="oval:ssg-test_avahi_restrict_CPU_publishing:tst:1"/>
          <criterion comment="Avahi Restrict Workstation Publishing" test_ref="oval:ssg-test_avahi_restrict_workstation_publishing:tst:1"/>
          <criterion comment="Avahi Restrict Domain Publishing" test_ref="oval:ssg-test_avahi_restrict_domain_publishing:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_audit_argument:def:1" version="3">
      <metadata>
        <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Look for argument audit=1 in the kernel line in /etc/grub.conf.</description>
      <reference ref_id="bootloader_audit_argument" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_bootloader_audit_argument:tst:1" comment="check for audit=1 in /etc/grub.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_nousb_argument:def:1" version="2">
      <metadata>
        <title>Disable Kernel Support for USB via Bootloader Configuration</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Look for argument "nousb" in the kernel line in /etc/grub.conf</description>
      <reference ref_id="bootloader_nousb_argument" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_bootloader_nousb_argument:tst:1" comment="look for argument 'nousb' in the kernel line in /etc/grub.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_password:def:1" version="1">
      <metadata>
        <title>Set Boot Loader Password</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The grub boot loader should have password protection enabled.</description>
      <reference ref_id="bootloader_password" source="ssg"/></metadata>
      <criteria>
        <criterion comment="make sure a password is defined in /etc/grub.conf" test_ref="oval:ssg-test_bootloader_password:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dhcp_client_restrict_options:def:1" version="1">
      <metadata>
        <title>Minimize DHCP Client Configured Options</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Limit the options that the DHCP gets
      and applies to the DHCP client.</description>
      <reference ref_id="dhcp_client_restrict_options" source="ssg"/></metadata>
      <criteria comment="DHCP is not being used or conditions are met" operator="OR">
        <extend_definition comment="dhcp package is not installed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criteria comment="Minimize DHCP client configured options" operator="AND">
          <criterion comment="Check domain-name in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_domain-named:tst:1"/>
          <criterion comment="Check domain-name-servers in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_domain-name-servers:tst:1"/>
          <criterion comment="Check nis-domain in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_nis-domain:tst:1"/>
          <criterion comment="Check nis-servers in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_nis-servers:tst:1"/>
          <criterion comment="Check ntp-servers in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_ntp-servers:tst:1"/>
          <criterion comment="Check routers in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_routers:tst:1"/>
          <criterion comment="Check time-offset in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_time-offset:tst:1"/>
          <criterion comment="Check subnet-mask in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_subnet-mask:tst:1"/>
          <criterion comment="Check broadcast-address in each dhclient .conf files" test_ref="oval:ssg-test_dhcp_client_broadcast-address:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dhcp_server_configure_logging:def:1" version="1">
      <metadata>
        <title>Configure DHCP Logging</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Configure rsyslog to record
      DHCP daemon errors.</description>
      <reference ref_id="dhcp_server_configure_logging" source="ssg"/></metadata>
      <criteria comment="DHCP is not being used or conditions are met" operator="OR">
        <extend_definition comment="dhcp package is not installed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criterion comment="Check for daemon in /etc/rsyslog.conf" test_ref="oval:ssg-test_dhcp_server_configure_logging:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dhcp_server_deny_bootp:def:1" version="1">
      <metadata>
        <title>Deny BOOTP Requests</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Prevents the DHCP from responding to 
      BOOTP requests.</description>
      <reference ref_id="dhcp_server_deny_bootp" source="ssg"/></metadata>
      <criteria comment="DHCP is not being used or conditions are met" operator="OR">
        <extend_definition comment="dhcp package is not installed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criterion comment="Check bootp /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_server_disable_bootp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dhcp_server_deny_decline:def:1" version="1">
      <metadata>
        <title>Deny Decline Messages</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Prevents the DHCP from responding to the
      DHCPDECLINE messages.</description>
      <reference ref_id="dhcp_server_deny_decline" source="ssg"/></metadata>
      <criteria comment="DHCP is not being used or conditions are met" operator="OR">
        <extend_definition comment="dhcp package is not installed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criterion comment="Check deny declines /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_server_deny_declines:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dhcp_server_disable_ddns:def:1" version="1">
      <metadata>
        <title>Disable Dynamic DNS</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Prevents DHCP from publishing information
      about their clients using Dynamic DNS.</description>
      <reference ref_id="dhcp_server_disable_ddns" source="ssg"/></metadata>
      <criteria comment="DHCP is not being used or conditions are met" operator="OR">
        <extend_definition comment="dhcp package is not installed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criterion comment="Check ddns-update-style in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_server_disable_ddns:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dhcp_server_minimize_served_info:def:1" version="1">
      <metadata>
        <title>Minimize Served DHCP Information</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Limits the amount of information that
      that the DHCP server provides to clients.</description>
      <reference ref_id="dhcp_server_minimize_served_info" source="ssg"/></metadata>
      <criteria comment="DHCP is not being used or conditions are met" operator="OR">
        <extend_definition comment="dhcp package is not installed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criteria comment="Minimize DHCP served info" operator="AND">
          <criterion comment="Check domain-name in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_domain-named_info:tst:1"/>
          <criterion comment="Check domain-name-servers in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_domain-name-servers_info:tst:1"/>
          <criterion comment="Check nis-domain in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_nis-domain_info:tst:1"/>
          <criterion comment="Check nis-servers in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_nis-servers_info:tst:1"/>
          <criterion comment="Check ntp-servers in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_ntp-servers_info:tst:1"/>
          <criterion comment="Check routers in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_routers_info:tst:1"/>
          <criterion comment="Check time-offset in /etc/dhcp/dhcpd.conf" test_ref="oval:ssg-test_dhcp_time-offset_info:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_world_writable_system_owned:def:1" version="1">
      <metadata>
        <title>Find world writable directories not owned by a system account</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All world writable directories should be owned by a system user.</description>
      <reference ref_id="dir_perms_world_writable_system_owned" source="ssg"/></metadata>
      <criteria comment="check for local directories that are world writable and have uid greater than or equal to 500" negate="true">
        <criterion comment="check for local directories that are world writable and have uid greater than or equal to 500" test_ref="oval:ssg-test_dir_world_writable_uid_gt_500:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1">
      <metadata>
        <title>Disable Ctrl-Alt-Del Reboot Activation</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</description>
      <reference ref_id="disable_ctrlaltdel_reboot" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Disable Ctrl-Alt-Del key sequence" test_ref="oval:ssg-test_disable_ctrlaltdel:tst:1"/>
        <criterion comment="Disable Ctrl-Alt-Del key sequence override exists" test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_interactive_boot:def:1" version="3">
      <metadata>
        <title>Disable Interactive Boot</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The ability for users to perform interactive startups should
      be disabled.</description>
      <reference ref_id="disable_interactive_boot" source="ssg"/></metadata>
      <criteria operator="AND">
        <!-- Check if PROMPT option of /etc/sysconfig/init file is set to "no" value -->
        <criterion comment="Check the value of PROMPT option in /etc/sysconfig/init. Fail if other than 'no'." test_ref="oval:ssg-test_interactive_boot_disabled_in_sysconfig_init:tst:1"/>
        <!-- Verify the "confirm" kernel boot argument not present in some of
           kernel lines of /etc/grub.conf -->
        <criterion comment="Check the presence of 'confirm' kernel boot argument in /etc/grub.conf. Fail if found." test_ref="oval:ssg-test_confirm_kernel_boot_argument_not_present:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-display_login_attempts:def:1" version="1">
      <metadata>
        <title>Set Last Login/Access Notification</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Configure the system to notify users of last login/access using pam_lastlog.</description>
      <reference ref_id="display_login_attempts" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Conditions for pam_lastlog are satisfied" test_ref="oval:ssg-test_display_login_attempts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dovecot_disable_plaintext_auth:def:1" version="1">
      <metadata>
        <title>Disable Plaintext Authentication in Dovecot</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Plaintext authentication of mail clients should be disabled.</description>
      <reference ref_id="dovecot_disable_plaintext_auth" source="ssg"/></metadata>
      <criteria comment="Disable Plaintext Authentication in Dovecot" operator="OR">
        <extend_definition comment="dovecot service is disabled" definition_ref="oval:ssg-service_dovecot_disabled:def:1"/>
        <criterion test_ref="oval:ssg-test_dovecot_disable_plaintext_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dovecot_enable_ssl:def:1" version="1">
      <metadata>
        <title>Enable SSL in Dovecot</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>SSL capabilities should be enabled for the mail server.</description>
      <reference ref_id="dovecot_enable_ssl" source="ssg"/></metadata>
      <criteria comment="Enable SSL in Dovecot" operator="OR">
        <extend_definition comment="dovecot service is disabled" definition_ref="oval:ssg-service_dovecot_disabled:def:1"/>
        <criterion test_ref="oval:ssg-test_dovecot_enable_ssl:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-enable_selinux_bootloader:def:1" version="1">
      <metadata>
        <title>Enable SELinux in /etc/grub.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
        Check if selinux=0 OR enforcing=0 within /etc/grub.conf lines, fail if found.
      </description>
      <reference ref_id="enable_selinux_bootloader" source="ssg"/></metadata>
      <criteria>
        <criterion comment="check value selinux|enforcing=0 in /etc/grub.conf, fail if found" test_ref="oval:ssg-test_selinux_grub:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_group_owner_grub_conf:def:1" version="1">
      <metadata>
        <title>File grub.conf Owned By root Group </title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The grub.conf file should be owned by the root group. By default, this file is located at /boot/grub/grub.conf or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>
      <reference ref_id="file_group_owner_grub_conf" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_group_owner_grub_conf:tst:1"/>
        <criterion test_ref="oval:ssg-test_file_group_owner_efi_grub_conf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_grub_conf:def:1" version="2">
      <metadata>
        <title>File /boot/grub/grub.conf Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>File permissions for /boot/grub/grub.conf should be set to 0600 (or stronger).</description>
      <reference ref_id="file_permissions_grub_conf" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_grub_conf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="1">
      <metadata>
        <title>Find setgid files system packages</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All files with setgid should be owned by a base system package</description>
      <reference ref_id="file_permissions_unauthorized_sgid" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check all setgid files" test_ref="oval:ssg-check_setgid_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1">
      <metadata>
        <title>Find setuid files from system packages</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All files with setuid should be owned by a base system package</description>
      <reference ref_id="file_permissions_unauthorized_suid" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check all setuid files" test_ref="oval:ssg-check_setuid_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_user_owner_grub_conf:def:1" version="1">
      <metadata>
        <title>File grub.conf Owned By root User</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The grub.conf file should be owned by the root user. By default, this file is located at /boot/grub/grub.conf or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>
      <reference ref_id="file_user_owner_grub_conf" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_user_owner_grub_conf:tst:1"/>
        <criterion test_ref="oval:ssg-test_file_user_owner_efi_grub_conf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_configure_firewall:def:1" version="1">
      <metadata>
        <title>Configure the Firewall to Protect the FTP Server</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Configure the FTP connection tracking module
      in iptables.</description>
      <reference ref_id="ftp_configure_firewall" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="vsftpd package is not installed" negate="true" definition_ref="oval:ssg-package_vsftpd_installed:def:1"/>
        <criterion comment="Configure FTP firewall" test_ref="oval:ssg-test_ftp_configure_firewall:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_disable_uploads:def:1" version="1">
      <metadata>
        <title>Disable FTP Uploads</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable FTP Uploads.</description>
      <reference ref_id="ftp_disable_uploads" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="vsftpd package is not installed" negate="true" definition_ref="oval:ssg-package_vsftpd_installed:def:1"/>
        <criterion comment="Disable uploads" test_ref="oval:ssg-test_ftp_disable_uploads:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_limit_users:def:1" version="1">
      <metadata>
        <title>Limit Users Allowed to Access FTP</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Only authorized users should be able to access FTP.</description>
      <reference ref_id="ftp_limit_users" source="ssg"/></metadata>
      <criteria comment="FTP is not being used or the conditions are met" operator="OR">
        <extend_definition comment="vsftp package is not installed" definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true"/>
        <criteria comment="FTP configuration conditions are not set or are met" operator="AND">
          <criterion comment="Enable ftp user list" test_ref="oval:ssg-test_ftp_user_list_enable:tst:1"/>
          <criterion comment="Set ftp user list file" test_ref="oval:ssg-test_ftp_user_list_file:tst:1"/>
          <criterion comment="Use ftp user list" test_ref="oval:ssg-test_ftp_user_list_deny:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_restrict_to_anon:def:1" version="1">
      <metadata>
        <title>Restrict Anonymous Users</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable anonymous access to FTP.</description>
      <reference ref_id="ftp_restrict_to_anon" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="vsftpd package is not installed" negate="true" definition_ref="oval:ssg-package_vsftpd_installed:def:1"/>
        <criterion comment="Disable anonymous access" test_ref="oval:ssg-test_ftp_restrict_to_anon:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gdm_disable_user_list:def:1" version="1">
      <metadata>
        <title>Disable the User List</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable the GUI listing of all known users on the login screen.</description>
      <reference ref_id="gconf_gdm_disable_user_list" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="check etc settings tree" test_ref="oval:ssg-test_tree_gconf_gdm_disable_user_list:tst:1"/>
        <criterion comment="check etc settings without tree" test_ref="oval:ssg-test_no_tree_gconf_gdm_disable_user_list:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gdm_enable_warning_gui_banner:def:1" version="1">
      <metadata>
        <title>Enable GUI Warning Banner</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Enable the GUI warning banner.</description>
      <reference ref_id="gconf_gdm_enable_warning_gui_banner" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="check var settings" test_ref="oval:ssg-test_gconf_gdm_enable_warning_gui_banner:tst:1"/>
        <criterion comment="check etc settings tree" test_ref="oval:ssg-test_tree_gconf_gdm_enable_warning_gui_banner:tst:1"/>
        <criterion comment="check etc settings without tree" test_ref="oval:ssg-test_no_tree_gconf_gdm_enable_warning_gui_banner:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gdm_set_login_banner_text:def:1" version="1">
      <metadata>
        <title>Set GUI Warning Banner Text</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The text to be displayed in the GUI warning banner should be set correctly.</description>
      <reference ref_id="gconf_gdm_set_login_banner_text" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="check var settings" test_ref="oval:ssg-test_gconf_gdm_set_login_banner_text:tst:1"/>
        <criterion comment="check etc settings with tree" test_ref="oval:ssg-test_no_tree_gconf_gdm_set_login_banner_text:tst:1"/>
        <criterion comment="check etc settings without tree" test_ref="oval:ssg-test_tree_gconf_gdm_set_login_banner_text:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_automount:def:1" version="1">
      <metadata>
        <title>Disable GNOME Automounting</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The system's default desktop environment, GNOME, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount and autorun
      within GNOME.</description>
      <reference ref_id="gconf_gnome_disable_automount" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="Disable automount in GNOME" test_ref="oval:ssg-test_gconf_gnome_disable_automount:tst:1"/>
        <criterion comment="Disable automount in GNOME" test_ref="oval:ssg-test_gconf_tree_gnome_disable_automount:tst:1"/>
        <criterion comment="Disable autorun in GNOME" test_ref="oval:ssg-test_gconf_gnome_disable_automount_autorun:tst:1"/>
        <criterion comment="Disable autorun in GNOME" test_ref="oval:ssg-test_gconf_tree_gnome_disable_automount_autorun:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_clock_temperature:def:1" version="1">
      <metadata>
        <title>Disable the GNOME Clock Temperature Feature</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The GNOME clock temperature feature should be disabled.</description>
      <reference ref_id="gconf_gnome_disable_clock_temperature" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="temperature is disabled" test_ref="oval:ssg-test_disable_clock_temperature:tst:1"/>
        <criterion comment="temperature is disabled" test_ref="oval:ssg-test_gconf_tree_disable_clock_temperature:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_clock_weather:def:1" version="1">
      <metadata>
        <title>Disable the GNOME Clock Weather Feature</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The GNOME clock weather feature should be disabled.</description>
      <reference ref_id="gconf_gnome_disable_clock_weather" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="weather is disabled" test_ref="oval:ssg-test_disable_clock_weather:tst:1"/>
        <criterion comment="weather is disabled" test_ref="oval:ssg-test_gconf_tree_disable_clock_weather:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1">
      <metadata>
        <title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The Ctrl-Alt-Del reboot key sequence should be set to nothing.</description>
      <reference ref_id="gconf_gnome_disable_ctrlaltdel_reboot" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="set Ctrl-Alt-Del key sequence to nothing" test_ref="oval:ssg-test_gnome_disable_ctrlaltdel_reboot:tst:1"/>
        <criterion comment="set Ctrl-Alt-Del key sequence to nothing" test_ref="oval:ssg-test_gconf_tree_gnome_disable_ctrlaltdel_reboot:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_restart_shutdown:def:1" version="1">
      <metadata>
        <title>Disable the GNOME Login Restart and Shutdown Buttons</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable GNOME Login restart and shutdown buttons to prevent
      users from restarting or powering off the system from the login screen.</description>
      <reference ref_id="gconf_gnome_disable_restart_shutdown" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="disable restart/shutdown buttons" test_ref="oval:ssg-test_disable_restart_shutdown:tst:1"/>
        <criterion comment="disable restart/shutdown buttons" test_ref="oval:ssg-test_gconf_tree_disable_restart_shutdown:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_thumbnailers:def:1" version="1">
      <metadata>
        <title>Disable All GNOME Thumbnailers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The system's default desktop environment, GNOME, uses a
      number of different thumbnailer programs to generate thumbnails for any
      new or modified content in an opened folder. Disable the execution of
      these thumbnail applications within GNOME.</description>
      <reference ref_id="gconf_gnome_disable_thumbnailers" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="Disable thumbnailers in GNOME" test_ref="oval:ssg-test_gconf_gnome_disable_thumbnailers:tst:1"/>
        <criterion comment="Disable thumbnailers in GNOME" test_ref="oval:ssg-test_gconf_tree_gnome_disable_thumbnailers:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_wifi_create:def:1" version="1">
      <metadata>
        <title>&gt;Disable WIFI Network Connection Creation in GNOME</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable GNOME's ability to create a wifi connection.</description>
      <reference ref_id="gconf_gnome_disable_wifi_create" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="wifi creation is disabled" test_ref="oval:ssg-test_disable_wifi_create:tst:1"/>
        <criterion comment="wifi creation is disabled" test_ref="oval:ssg-test_gconf_tree_disable_wifi_create:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_wifi_disconnect:def:1" version="1">
      <metadata>
        <title>Disable WIFI Network Disconnect Notification in GNOME</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable GNOME's ability to notify users when disconnecting
      from a wifi network.</description>
      <reference ref_id="gconf_gnome_disable_wifi_disconnect" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="disable wifi disconnect" test_ref="oval:ssg-test_disable_wifi_disconnect:tst:1"/>
        <criterion comment="disable wifi disconnect" test_ref="oval:ssg-test_gconf_tree_disable_wifi_disconnect:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_disable_wifi_notification:def:1" version="1">
      <metadata>
        <title>Disable WIFI Network Connection Notification in GNOME</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable GNOME's ability to notify users when connecting
      to a wifi network.</description>
      <reference ref_id="gconf_gnome_disable_wifi_notification" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="wifi connection notification is disabled" test_ref="oval:ssg-test_disable_wifi_notification:tst:1"/>
        <criterion comment="wifi connection notification is disabled" test_ref="oval:ssg-test_gconf_tree_disable_wifi_notification:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_screensaver_idle_activation_enabled:def:1" version="1">
      <metadata>
        <title>Implement idle activation of screen saver</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Idle activation of the screen saver should be
      enabled.</description>
      <reference ref_id="gconf_gnome_screensaver_idle_activation_enabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="gnome screensaver is activated on idle" test_ref="oval:ssg-test_gnome_screensaver_idle_activated:tst:1"/>
        <criterion comment="gnome screensaver is activated on idle" test_ref="oval:ssg-test_gconf_tree_gnome_screensaver_idle_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_screensaver_idle_delay:def:1" version="2">
      <metadata>
        <title>Configure GUI Screen Locking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The allowed period of inactivity before the screensaver is
      activated.</description>
      <reference ref_id="gconf_gnome_screensaver_idle_delay" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="check value of idle_delay in GCONF" test_ref="oval:ssg-test_gnome_screensaver_idle_delay:tst:1"/>
        <criterion comment="check value of idle_delay in GCONF" test_ref="oval:ssg-test_gconf_tree_gnome_screensaver_idle_delay:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_screensaver_lock_enabled:def:1" version="1">
      <metadata>
        <title>Implement idle activation of screen lock</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Idle activation of the screen lock should be
      enabled.</description>
      <reference ref_id="gconf_gnome_screensaver_lock_enabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="screensaver lock is enabled" test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1"/>
        <criterion comment="screensaver lock is enabled" test_ref="oval:ssg-test_gconf_tree_screensaver_lock_enabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_screensaver_max_idle_action:def:1" version="1">
      <metadata>
        <title>Set GNOME Login Maximum Allowed Inactivity Action</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Idle GNOME users should be logged off after a defined
      period of time.</description>
      <reference ref_id="gconf_gnome_screensaver_max_idle_action" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="Force log off users" test_ref="oval:ssg-test_gnome_screensaver_max_idle_action:tst:1"/>
        <criterion comment="Force log off users" test_ref="oval:ssg-test_gconf_tree_gnome_screensaver_max_idle_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_screensaver_max_idle_time:def:1" version="2">
      <metadata>
        <title>Set GNOME Login Maximum Allowed Inactivity</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The allowed period of inactivity before a user is logged
      off the system.</description>
      <reference ref_id="gconf_gnome_screensaver_max_idle_time" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="check value of max_idle_time in GCONF" test_ref="oval:ssg-test_gnome_screensaver_max_idle_time:tst:1"/>
        <criterion comment="check value of max_idle_time in GCONF" test_ref="oval:ssg-test_gconf_tree_gnome_screensaver_max_idle_time:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gconf_gnome_screensaver_mode_blank:def:1" version="1">
      <metadata>
        <title>Implement blank screen saver</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The screen saver should be blank.</description>
      <reference ref_id="gconf_gnome_screensaver_mode_blank" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:ssg-package_GConf2_installed:def:1" negate="true"/>
        <criterion comment="gnome screensaver set to blank screen" test_ref="oval:ssg-test_gnome_screensaver_mode:tst:1"/>
        <criterion comment="gnome screensaver set to blank screen" test_ref="oval:ssg-test_gconf_tree_gnome_screensaver_mode:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-grub_enable_fips_mode:def:1" version="1">
      <metadata>
        <title>Enable FIPS Mode in GRUB</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Look for argument fips=1 in the kernel line in /etc/grub.conf.</description>
      <reference ref_id="grub_enable_fips_mode" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is RHEL6" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
        <extend_definition comment="prelink disabled" definition_ref="oval:ssg-disable_prelink:def:1"/>
        <extend_definition comment="package dracut-fips installed" definition_ref="oval:ssg-package_dracut-fips_installed:def:1"/>
        <criterion test_ref="oval:ssg-test_grub_enable_fips_mode:tst:1" comment="check for fips=1 in /etc/grub.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-iptables_sshd_disabled:def:1" version="1">
      <metadata>
        <title>Disallow inbound firewall access to the SSH Server port.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>If inbound SSH access is not needed, the firewall should disallow or reject access to
      the SSH port (22).</description>
      <reference ref_id="iptables_sshd_disabled" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Test ipv4 port 22 Deny" test_ref="oval:ssg-test_iptables_sshd_disabled_ipv4:tst:1"/>
        <criterion comment="Test ipv6 port 22 Deny" test_ref="oval:ssg-test_iptables_sshd_disabled_ipv6:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_disable_entropy_contribution_for_solid_state_drives:def:1" version="1">
      <metadata>
        <title>Configure solid-state drives (SSDs) not to contribute to random-number entropy pool</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The add_random sysfs variable should be set correctly for each SSD drive on the system.</description>
      <reference ref_id="kernel_disable_entropy_contribution_for_solid_state_drives" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check add_random sysfs variable set to '0' for each SSD drive. Fail if not" test_ref="oval:ssg-test_kernel_disable_entropy_contribution_for_solid_state_drives:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1">
      <metadata>
        <title>Disable bluetooth Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module bluetooth should be disabled.</description>
      <reference ref_id="kernel_module_bluetooth_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable cramfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module cramfs should be disabled.</description>
      <reference ref_id="kernel_module_cramfs_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1">
      <metadata>
        <title>Disable dccp Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module dccp should be disabled.</description>
      <reference ref_id="kernel_module_dccp_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" comment="kernel module dccp disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" comment="kernel module dccp disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_freevxfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable freevxfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module freevxfs should be disabled.</description>
      <reference ref_id="kernel_module_freevxfs_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_hfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable hfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module hfs should be disabled.</description>
      <reference ref_id="kernel_module_hfs_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" comment="kernel module hfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" comment="kernel module hfs disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_hfsplus_disabled:def:1" version="1">
      <metadata>
        <title>Disable hfsplus Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module hfsplus should be disabled.</description>
      <reference ref_id="kernel_module_hfsplus_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" version="1">
      <metadata>
        <title>Disable IPv6 Kernel Module Functionality via Disable Option</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</description>
      <reference ref_id="kernel_module_ipv6_option_disabled" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" comment="ipv6 disabled any modprobe conf file"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_jffs2_disabled:def:1" version="1">
      <metadata>
        <title>Disable jffs2 Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module jffs2 should be disabled.</description>
      <reference ref_id="kernel_module_jffs2_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_rds_disabled:def:1" version="1">
      <metadata>
        <title>Disable rds Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module rds should be disabled.</description>
      <reference ref_id="kernel_module_rds_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" comment="kernel module rds disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" comment="kernel module rds disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_sctp_disabled:def:1" version="1">
      <metadata>
        <title>Disable sctp Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module sctp should be disabled.</description>
      <reference ref_id="kernel_module_sctp_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_sctp_disabled:tst:1" comment="kernel module sctp disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_sctp_modprobeconf:tst:1" comment="kernel module sctp disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable squashfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module squashfs should be disabled.</description>
      <reference ref_id="kernel_module_squashfs_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_tipc_disabled:def:1" version="1">
      <metadata>
        <title>Disable tipc Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module tipc should be disabled.</description>
      <reference ref_id="kernel_module_tipc_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" comment="kernel module tipc disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" comment="kernel module tipc disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_udf_disabled:def:1" version="1">
      <metadata>
        <title>Disable udf Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module udf should be disabled.</description>
      <reference ref_id="kernel_module_udf_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" comment="kernel module udf disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" comment="kernel module udf disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1">
      <metadata>
        <title>Disable usb-storage Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel module usb-storage should be disabled.</description>
      <reference ref_id="kernel_module_usb-storage_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ldap_client_start_tls:def:1" version="1">
      <metadata>
        <title>Configure LDAP to Use TLS for All Transactions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require the use of TLS for ldap clients.</description>
      <reference ref_id="ldap_client_start_tls" source="ssg"/></metadata>
      <criteria comment="package pam_ldap is not present" operator="OR">
        <extend_definition comment="pam_ldap not present or not in use" definition_ref="oval:ssg-package_pam_ldap_removed:def:1"/>
        <criterion comment="look for ssl start_tls in /etc/pam_ldap.conf" test_ref="oval:ssg-test_ldap_client_start_tls_ssl:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ldap_client_tls_cacertpath:def:1" version="1">
      <metadata>
        <title>Configure LDAP CA Certificate Path</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require the use of TLS for ldap clients.</description>
      <reference ref_id="ldap_client_tls_cacertpath" source="ssg"/></metadata>
      <criteria comment="package pam_ldap is not present" operator="OR">
        <extend_definition comment="pam_ldap not present or in use" definition_ref="oval:ssg-package_pam_ldap_removed:def:1"/>
        <criterion comment="look for tls_cacertdir in /etc/pam_ldap.conf" test_ref="oval:ssg-test_ldap_client_tls_cacertdir:tst:1"/>
        <criterion comment="look for tls_cacertfile in /etc/pam_ldap.conf" test_ref="oval:ssg-test_ldap_client_tls_cacertfile:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_default_gateway:def:1" version="1">
      <metadata>
        <title>Manually Assign IPv6 Router Address</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Define default gateways for IPv6 traffic</description>
      <reference ref_id="network_ipv6_default_gateway" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criterion comment="Define default gateways" test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_privacy_extensions:def:1" version="1">
      <metadata>
        <title>Enable Privacy Extensions for IPv6</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Enable privacy extensions for IPv6</description>
      <reference ref_id="network_ipv6_privacy_extensions" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criterion comment="Enable privacy extensions per interface" test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_static_address:def:1" version="1">
      <metadata>
        <title>Manually Assign Global IPv6 Address</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Manually configure addresses for IPv6</description>
      <reference ref_id="network_ipv6_static_address" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criterion comment="Set static IPv6 address on each interface" test_ref="oval:ssg-test_network_ipv6_static_address:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2">
      <metadata>
        <title>Specify Multiple Remote ntpd NTP Server for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Multiple ntpd NTP Servers for time synchronization should be specified.</description>
      <reference ref_id="ntpd_specify_multiple_servers" source="ssg"/></metadata>
      <criteria comment="ntp.conf conditions are met">
        <criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ntpd_specify_remote_server:def:1" version="2">
      <metadata>
        <title>Specify a Remote ntpd NTP Server for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>A remote ntpd NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
      <reference ref_id="ntpd_specify_remote_server" source="ssg"/></metadata>
      <criteria comment="ntp.conf conditions are met">
        <criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_GConf2_installed:def:1" version="1">
      <metadata>
        <title>Package GConf2 Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package GConf2 should be installed.</description>
      <reference ref_id="package_GConf2_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package GConf2 is installed" test_ref="oval:ssg-test_package_GConf2_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_abrt_removed:def:1" version="1">
      <metadata>
        <title>Package abrt Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package abrt should be removed.</description>
      <reference ref_id="package_abrt_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package abrt is removed" test_ref="oval:ssg-test_package_abrt_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_at_removed:def:1" version="1">
      <metadata>
        <title>Package at Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package at should be removed.</description>
      <reference ref_id="package_at_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package at is removed" test_ref="oval:ssg-test_package_at_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_autofs_removed:def:1" version="1">
      <metadata>
        <title>Package autofs Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package autofs should be removed.</description>
      <reference ref_id="package_autofs_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package autofs is removed" test_ref="oval:ssg-test_package_autofs_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_avahi_installed:def:1" version="1">
      <metadata>
        <title>Package avahi Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package avahi should be installed.</description>
      <reference ref_id="package_avahi_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package avahi is installed" test_ref="oval:ssg-test_package_avahi_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_bluez_removed:def:1" version="1">
      <metadata>
        <title>Package bluez Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package bluez should be removed.</description>
      <reference ref_id="package_bluez_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package bluez is removed" test_ref="oval:ssg-test_package_bluez_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cpuspeed_removed:def:1" version="1">
      <metadata>
        <title>Package cpuspeed Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cpuspeed should be removed.</description>
      <reference ref_id="package_cpuspeed_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package cpuspeed is removed" test_ref="oval:ssg-test_package_cpuspeed_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cronie_installed:def:1" version="1">
      <metadata>
        <title>Package cronie Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cronie should be installed.</description>
      <reference ref_id="package_cronie_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package cronie is installed" test_ref="oval:ssg-test_package_cronie_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cups_removed:def:1" version="1">
      <metadata>
        <title>Package cups Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cups should be removed.</description>
      <reference ref_id="package_cups_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package cups is removed" test_ref="oval:ssg-test_package_cups_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cyrus-sasl_removed:def:1" version="1">
      <metadata>
        <title>Package cyrus-sasl Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cyrus-sasl should be removed.</description>
      <reference ref_id="package_cyrus-sasl_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package cyrus-sasl is removed" test_ref="oval:ssg-test_package_cyrus-sasl_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dbus_removed:def:1" version="1">
      <metadata>
        <title>Package dbus Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package dbus should be removed.</description>
      <reference ref_id="package_dbus_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package dbus is removed" test_ref="oval:ssg-test_package_dbus_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_esc_installed:def:1" version="1">
      <metadata>
        <title>Package esc Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package esc should be installed.</description>
      <reference ref_id="package_esc_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package esc is installed" test_ref="oval:ssg-test_package_esc_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_gdm_installed:def:1" version="1">
      <metadata>
        <title>Package gdm Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package gdm should be installed.</description>
      <reference ref_id="package_gdm_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package gdm is installed" test_ref="oval:ssg-test_package_gdm_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_hal_removed:def:1" version="1">
      <metadata>
        <title>Package hal Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package hal should be removed.</description>
      <reference ref_id="package_hal_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package hal is removed" test_ref="oval:ssg-test_package_hal_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_iptables-ipv6_installed:def:1" version="1">
      <metadata>
        <title>Package iptables-ipv6 Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package iptables-ipv6 should be installed.</description>
      <reference ref_id="package_iptables-ipv6_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package iptables-ipv6 is installed" test_ref="oval:ssg-test_package_iptables-ipv6_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_iptables_installed:def:1" version="1">
      <metadata>
        <title>Package iptables Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package iptables should be installed.</description>
      <reference ref_id="package_iptables_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package iptables is installed" test_ref="oval:ssg-test_package_iptables_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_iputils_removed:def:1" version="1">
      <metadata>
        <title>Package iputils Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package iputils should be removed.</description>
      <reference ref_id="package_iputils_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package iputils is removed" test_ref="oval:ssg-test_package_iputils_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_irqbalance_installed:def:1" version="1">
      <metadata>
        <title>Package irqbalance Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package irqbalance should be installed.</description>
      <reference ref_id="package_irqbalance_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package irqbalance is installed" test_ref="oval:ssg-test_package_irqbalance_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_kexec-tools_removed:def:1" version="1">
      <metadata>
        <title>Package kexec-tools Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package kexec-tools should be removed.</description>
      <reference ref_id="package_kexec-tools_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package kexec-tools is removed" test_ref="oval:ssg-test_package_kexec-tools_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_libcgroup_removed:def:1" version="1">
      <metadata>
        <title>Package libcgroup Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package libcgroup should be removed.</description>
      <reference ref_id="package_libcgroup_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package libcgroup is removed" test_ref="oval:ssg-test_package_libcgroup_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_mdadm_removed:def:1" version="1">
      <metadata>
        <title>Package mdadm Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package mdadm should be removed.</description>
      <reference ref_id="package_mdadm_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package mdadm is removed" test_ref="oval:ssg-test_package_mdadm_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_nfs-utils_removed:def:1" version="1">
      <metadata>
        <title>Package nfs-utils Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package nfs-utils should be removed.</description>
      <reference ref_id="package_nfs-utils_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package nfs-utils is removed" test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">
      <metadata>
        <title>Package ntpdate Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ntpdate should be removed.</description>
      <reference ref_id="package_ntpdate_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_oddjob_removed:def:1" version="1">
      <metadata>
        <title>Package oddjob Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package oddjob should be removed.</description>
      <reference ref_id="package_oddjob_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package oddjob is removed" test_ref="oval:ssg-test_package_oddjob_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openswan_installed:def:1" version="2">
      <metadata>
        <title>Package openswan / libreswan Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package openswan / libreswan should be installed.</description>
      <reference ref_id="package_openswan_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package openswan is installed" test_ref="oval:ssg-test_package_openswan_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_pam_ldap_removed:def:1" version="1">
      <metadata>
        <title>Package pam_ldap Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package pam_ldap should be removed.</description>
      <reference ref_id="package_pam_ldap_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package pam_ldap is removed" test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_pam_pkcs11_installed:def:1" version="1">
      <metadata>
        <title>Package pam_pkcs11 Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package pam_pkcs11 should be installed.</description>
      <reference ref_id="package_pam_pkcs11_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package pam_pkcs11 is installed" test_ref="oval:ssg-test_package_pam_pkcs11_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_pcsc-lite_installed:def:1" version="1">
      <metadata>
        <title>Package pcsc-lite Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package pcsc-lite should be installed.</description>
      <reference ref_id="package_pcsc-lite_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package pcsc-lite is installed" test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_policycoreutils_installed:def:1" version="1">
      <metadata>
        <title>Package policycoreutils Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package policycoreutils should be installed.</description>
      <reference ref_id="package_policycoreutils_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package policycoreutils is installed" test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_portreserve_removed:def:1" version="1">
      <metadata>
        <title>Package portreserve Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package portreserve should be removed.</description>
      <reference ref_id="package_portreserve_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package portreserve is removed" test_ref="oval:ssg-test_package_portreserve_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_postfix_installed:def:1" version="1">
      <metadata>
        <title>Package postfix Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package postfix should be installed.</description>
      <reference ref_id="package_postfix_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package postfix is installed" test_ref="oval:ssg-test_package_postfix_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_psacct_installed:def:1" version="1">
      <metadata>
        <title>Package psacct Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package psacct should be installed.</description>
      <reference ref_id="package_psacct_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package psacct is installed" test_ref="oval:ssg-test_package_psacct_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_qpid-cpp-server_removed:def:1" version="1">
      <metadata>
        <title>Package qpid-cpp-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package qpid-cpp-server should be removed.</description>
      <reference ref_id="package_qpid-cpp-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package qpid-cpp-server is removed" test_ref="oval:ssg-test_package_qpid-cpp-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_quota_removed:def:1" version="1">
      <metadata>
        <title>Package quota Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package quota should be removed.</description>
      <reference ref_id="package_quota_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package quota is removed" test_ref="oval:ssg-test_package_quota_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rhnsd_removed:def:1" version="1">
      <metadata>
        <title>Package rhnsd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rhnsd should be removed.</description>
      <reference ref_id="package_rhnsd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rhnsd is removed" test_ref="oval:ssg-test_package_rhnsd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rpcbind_removed:def:1" version="1">
      <metadata>
        <title>Package rpcbind Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rpcbind should be removed.</description>
      <reference ref_id="package_rpcbind_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rpcbind is removed" test_ref="oval:ssg-test_package_rpcbind_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_samba_removed:def:1" version="1">
      <metadata>
        <title>Package samba Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba should be removed.</description>
      <reference ref_id="package_samba_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package samba is removed" test_ref="oval:ssg-test_package_samba_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_smartmontools_removed:def:1" version="1">
      <metadata>
        <title>Package smartmontools Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package smartmontools should be removed.</description>
      <reference ref_id="package_smartmontools_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package smartmontools is removed" test_ref="oval:ssg-test_package_smartmontools_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_subscription-manager_removed:def:1" version="1">
      <metadata>
        <title>Package subscription-manager Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package subscription-manager should be removed.</description>
      <reference ref_id="package_subscription-manager_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package subscription-manager is removed" test_ref="oval:ssg-test_package_subscription-manager_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_sysstat_removed:def:1" version="1">
      <metadata>
        <title>Package sysstat Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package sysstat should be removed.</description>
      <reference ref_id="package_sysstat_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package sysstat is removed" test_ref="oval:ssg-test_package_sysstat_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="1">
      <metadata>
        <title>Package xorg-x11-server-common Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package xorg-x11-server-common should be removed.</description>
      <reference ref_id="package_xorg-x11-server-common_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package xorg-x11-server-common is removed" test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-postfix_network_listening_disabled:def:1" version="2">
      <metadata>
        <title>Postfix network listening should be disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Postfix network listening should be disabled</description>
      <reference ref_id="postfix_network_listening_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- postfix package not installed or postfix service not configured to start -->
        <extend_definition comment="Postfix installed and configured to start" negate="true" definition_ref="oval:ssg-service_postfix_enabled:def:1"/>
        <!-- postfix network listening disabled -->
        <criterion comment="Check inet_interfaces in /etc/postfix/main.cf" test_ref="oval:ssg-test_postfix_network_listening_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-require_singleuser_auth:def:1" version="1">
      <metadata>
        <title>Require Authentication for Single-User Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The requirement for a password to boot into single-user mode
      should be configured correctly.</description>
      <reference ref_id="require_singleuser_auth" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_singleuser_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_abrtd_disabled:def:1" version="1">
      <metadata>
        <title>Service abrtd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The abrtd service should be disabled if possible.</description>
      <reference ref_id="service_abrtd_disabled" source="ssg"/></metadata>
      <criteria comment="package abrt removed or service abrtd is not configured to start" operator="OR">
        <extend_definition comment="abrt removed" definition_ref="oval:ssg-package_abrt_removed:def:1"/>
        <criteria operator="AND" comment="service abrtd is not configured to start">
          <criterion comment="abrtd runlevel 0" test_ref="oval:ssg-test_runlevel0_abrtd:tst:1"/>
          <criterion comment="abrtd runlevel 1" test_ref="oval:ssg-test_runlevel1_abrtd:tst:1"/>
          <criterion comment="abrtd runlevel 2" test_ref="oval:ssg-test_runlevel2_abrtd:tst:1"/>
          <criterion comment="abrtd runlevel 3" test_ref="oval:ssg-test_runlevel3_abrtd:tst:1"/>
          <criterion comment="abrtd runlevel 4" test_ref="oval:ssg-test_runlevel4_abrtd:tst:1"/>
          <criterion comment="abrtd runlevel 5" test_ref="oval:ssg-test_runlevel5_abrtd:tst:1"/>
          <criterion comment="abrtd runlevel 6" test_ref="oval:ssg-test_runlevel6_abrtd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_acpid_disabled:def:1" version="1">
      <metadata>
        <title>Service acpid Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The acpid service should be disabled if possible.</description>
      <reference ref_id="service_acpid_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service acpid is not configured to start">
        <criterion comment="acpid runlevel 0" test_ref="oval:ssg-test_runlevel0_acpid:tst:1"/>
        <criterion comment="acpid runlevel 1" test_ref="oval:ssg-test_runlevel1_acpid:tst:1"/>
        <criterion comment="acpid runlevel 2" test_ref="oval:ssg-test_runlevel2_acpid:tst:1"/>
        <criterion comment="acpid runlevel 3" test_ref="oval:ssg-test_runlevel3_acpid:tst:1"/>
        <criterion comment="acpid runlevel 4" test_ref="oval:ssg-test_runlevel4_acpid:tst:1"/>
        <criterion comment="acpid runlevel 5" test_ref="oval:ssg-test_runlevel5_acpid:tst:1"/>
        <criterion comment="acpid runlevel 6" test_ref="oval:ssg-test_runlevel6_acpid:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_atd_disabled:def:1" version="1">
      <metadata>
        <title>Service atd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The atd service should be disabled if possible.</description>
      <reference ref_id="service_atd_disabled" source="ssg"/></metadata>
      <criteria comment="package at removed or service atd is not configured to start" operator="OR">
        <extend_definition comment="at removed" definition_ref="oval:ssg-package_at_removed:def:1"/>
        <criteria operator="AND" comment="service atd is not configured to start">
          <criterion comment="atd runlevel 0" test_ref="oval:ssg-test_runlevel0_atd:tst:1"/>
          <criterion comment="atd runlevel 1" test_ref="oval:ssg-test_runlevel1_atd:tst:1"/>
          <criterion comment="atd runlevel 2" test_ref="oval:ssg-test_runlevel2_atd:tst:1"/>
          <criterion comment="atd runlevel 3" test_ref="oval:ssg-test_runlevel3_atd:tst:1"/>
          <criterion comment="atd runlevel 4" test_ref="oval:ssg-test_runlevel4_atd:tst:1"/>
          <criterion comment="atd runlevel 5" test_ref="oval:ssg-test_runlevel5_atd:tst:1"/>
          <criterion comment="atd runlevel 6" test_ref="oval:ssg-test_runlevel6_atd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">
      <metadata>
        <title>Service auditd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The auditd service should be enabled if possible.</description>
      <reference ref_id="service_auditd_enabled" source="ssg"/></metadata>
      <criteria comment="package audit installed and service auditd is configured to start" operator="AND">
        <extend_definition comment="audit installed" definition_ref="oval:ssg-package_audit_installed:def:1"/>
        <criteria operator="OR" comment="service auditd is configured to start">
          <criterion comment="auditd runlevel 0" test_ref="oval:ssg-test_runlevel0_auditd:tst:1"/>
          <criterion comment="auditd runlevel 1" test_ref="oval:ssg-test_runlevel1_auditd:tst:1"/>
          <criterion comment="auditd runlevel 2" test_ref="oval:ssg-test_runlevel2_auditd:tst:1"/>
          <criterion comment="auditd runlevel 3" test_ref="oval:ssg-test_runlevel3_auditd:tst:1"/>
          <criterion comment="auditd runlevel 4" test_ref="oval:ssg-test_runlevel4_auditd:tst:1"/>
          <criterion comment="auditd runlevel 5" test_ref="oval:ssg-test_runlevel5_auditd:tst:1"/>
          <criterion comment="auditd runlevel 6" test_ref="oval:ssg-test_runlevel6_auditd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_autofs_disabled:def:1" version="1">
      <metadata>
        <title>Service autofs Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The autofs service should be disabled if possible.</description>
      <reference ref_id="service_autofs_disabled" source="ssg"/></metadata>
      <criteria comment="package autofs removed or service autofs is not configured to start" operator="OR">
        <extend_definition comment="autofs removed" definition_ref="oval:ssg-package_autofs_removed:def:1"/>
        <criteria operator="AND" comment="service autofs is not configured to start">
          <criterion comment="autofs runlevel 0" test_ref="oval:ssg-test_runlevel0_autofs:tst:1"/>
          <criterion comment="autofs runlevel 1" test_ref="oval:ssg-test_runlevel1_autofs:tst:1"/>
          <criterion comment="autofs runlevel 2" test_ref="oval:ssg-test_runlevel2_autofs:tst:1"/>
          <criterion comment="autofs runlevel 3" test_ref="oval:ssg-test_runlevel3_autofs:tst:1"/>
          <criterion comment="autofs runlevel 4" test_ref="oval:ssg-test_runlevel4_autofs:tst:1"/>
          <criterion comment="autofs runlevel 5" test_ref="oval:ssg-test_runlevel5_autofs:tst:1"/>
          <criterion comment="autofs runlevel 6" test_ref="oval:ssg-test_runlevel6_autofs:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_avahi-daemon_disabled:def:1" version="1">
      <metadata>
        <title>Service avahi-daemon Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The avahi-daemon service should be disabled if possible.</description>
      <reference ref_id="service_avahi-daemon_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service avahi-daemon is not configured to start">
        <criterion comment="avahi-daemon runlevel 0" test_ref="oval:ssg-test_runlevel0_avahi-daemon:tst:1"/>
        <criterion comment="avahi-daemon runlevel 1" test_ref="oval:ssg-test_runlevel1_avahi-daemon:tst:1"/>
        <criterion comment="avahi-daemon runlevel 2" test_ref="oval:ssg-test_runlevel2_avahi-daemon:tst:1"/>
        <criterion comment="avahi-daemon runlevel 3" test_ref="oval:ssg-test_runlevel3_avahi-daemon:tst:1"/>
        <criterion comment="avahi-daemon runlevel 4" test_ref="oval:ssg-test_runlevel4_avahi-daemon:tst:1"/>
        <criterion comment="avahi-daemon runlevel 5" test_ref="oval:ssg-test_runlevel5_avahi-daemon:tst:1"/>
        <criterion comment="avahi-daemon runlevel 6" test_ref="oval:ssg-test_runlevel6_avahi-daemon:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_bluetooth_disabled:def:1" version="1">
      <metadata>
        <title>Service bluetooth Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The bluetooth service should be disabled if possible.</description>
      <reference ref_id="service_bluetooth_disabled" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="rpm package bluez removed" definition_ref="oval:ssg-package_bluez_removed:def:1"/>
        <criteria operator="AND" comment="service bluetooth is not configured to start">
          <criterion comment="bluetooth runlevel 0" test_ref="oval:ssg-test_runlevel0_bluetooth:tst:1"/>
          <criterion comment="bluetooth runlevel 1" test_ref="oval:ssg-test_runlevel1_bluetooth:tst:1"/>
          <criterion comment="bluetooth runlevel 2" test_ref="oval:ssg-test_runlevel2_bluetooth:tst:1"/>
          <criterion comment="bluetooth runlevel 3" test_ref="oval:ssg-test_runlevel3_bluetooth:tst:1"/>
          <criterion comment="bluetooth runlevel 4" test_ref="oval:ssg-test_runlevel4_bluetooth:tst:1"/>
          <criterion comment="bluetooth runlevel 5" test_ref="oval:ssg-test_runlevel5_bluetooth:tst:1"/>
          <criterion comment="bluetooth runlevel 6" test_ref="oval:ssg-test_runlevel6_bluetooth:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_certmonger_disabled:def:1" version="1">
      <metadata>
        <title>Service certmonger Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The certmonger service should be disabled if possible.</description>
      <reference ref_id="service_certmonger_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service certmonger is not configured to start">
        <criterion comment="certmonger runlevel 0" test_ref="oval:ssg-test_runlevel0_certmonger:tst:1"/>
        <criterion comment="certmonger runlevel 1" test_ref="oval:ssg-test_runlevel1_certmonger:tst:1"/>
        <criterion comment="certmonger runlevel 2" test_ref="oval:ssg-test_runlevel2_certmonger:tst:1"/>
        <criterion comment="certmonger runlevel 3" test_ref="oval:ssg-test_runlevel3_certmonger:tst:1"/>
        <criterion comment="certmonger runlevel 4" test_ref="oval:ssg-test_runlevel4_certmonger:tst:1"/>
        <criterion comment="certmonger runlevel 5" test_ref="oval:ssg-test_runlevel5_certmonger:tst:1"/>
        <criterion comment="certmonger runlevel 6" test_ref="oval:ssg-test_runlevel6_certmonger:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cgconfig_disabled:def:1" version="1">
      <metadata>
        <title>Service cgconfig Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The cgconfig service should be disabled if possible.</description>
      <reference ref_id="service_cgconfig_disabled" source="ssg"/></metadata>
      <criteria comment="package libcgroup removed or service cgconfig is not configured to start" operator="OR">
        <extend_definition comment="libcgroup removed" definition_ref="oval:ssg-package_libcgroup_removed:def:1"/>
        <criteria operator="AND" comment="service cgconfig is not configured to start">
          <criterion comment="cgconfig runlevel 0" test_ref="oval:ssg-test_runlevel0_cgconfig:tst:1"/>
          <criterion comment="cgconfig runlevel 1" test_ref="oval:ssg-test_runlevel1_cgconfig:tst:1"/>
          <criterion comment="cgconfig runlevel 2" test_ref="oval:ssg-test_runlevel2_cgconfig:tst:1"/>
          <criterion comment="cgconfig runlevel 3" test_ref="oval:ssg-test_runlevel3_cgconfig:tst:1"/>
          <criterion comment="cgconfig runlevel 4" test_ref="oval:ssg-test_runlevel4_cgconfig:tst:1"/>
          <criterion comment="cgconfig runlevel 5" test_ref="oval:ssg-test_runlevel5_cgconfig:tst:1"/>
          <criterion comment="cgconfig runlevel 6" test_ref="oval:ssg-test_runlevel6_cgconfig:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cgred_disabled:def:1" version="1">
      <metadata>
        <title>Service cgred Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The cgred service should be disabled if possible.</description>
      <reference ref_id="service_cgred_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service cgred is not configured to start">
        <criterion comment="cgred runlevel 0" test_ref="oval:ssg-test_runlevel0_cgred:tst:1"/>
        <criterion comment="cgred runlevel 1" test_ref="oval:ssg-test_runlevel1_cgred:tst:1"/>
        <criterion comment="cgred runlevel 2" test_ref="oval:ssg-test_runlevel2_cgred:tst:1"/>
        <criterion comment="cgred runlevel 3" test_ref="oval:ssg-test_runlevel3_cgred:tst:1"/>
        <criterion comment="cgred runlevel 4" test_ref="oval:ssg-test_runlevel4_cgred:tst:1"/>
        <criterion comment="cgred runlevel 5" test_ref="oval:ssg-test_runlevel5_cgred:tst:1"/>
        <criterion comment="cgred runlevel 6" test_ref="oval:ssg-test_runlevel6_cgred:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cpuspeed_disabled:def:1" version="1">
      <metadata>
        <title>Service cpuspeed Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The cpuspeed service should be disabled if possible.</description>
      <reference ref_id="service_cpuspeed_disabled" source="ssg"/></metadata>
      <criteria comment="package cpuspeed removed or service cpuspeed is not configured to start" operator="OR">
        <extend_definition comment="cpuspeed removed" definition_ref="oval:ssg-package_cpuspeed_removed:def:1"/>
        <criteria operator="AND" comment="service cpuspeed is not configured to start">
          <criterion comment="cpuspeed runlevel 0" test_ref="oval:ssg-test_runlevel0_cpuspeed:tst:1"/>
          <criterion comment="cpuspeed runlevel 1" test_ref="oval:ssg-test_runlevel1_cpuspeed:tst:1"/>
          <criterion comment="cpuspeed runlevel 2" test_ref="oval:ssg-test_runlevel2_cpuspeed:tst:1"/>
          <criterion comment="cpuspeed runlevel 3" test_ref="oval:ssg-test_runlevel3_cpuspeed:tst:1"/>
          <criterion comment="cpuspeed runlevel 4" test_ref="oval:ssg-test_runlevel4_cpuspeed:tst:1"/>
          <criterion comment="cpuspeed runlevel 5" test_ref="oval:ssg-test_runlevel5_cpuspeed:tst:1"/>
          <criterion comment="cpuspeed runlevel 6" test_ref="oval:ssg-test_runlevel6_cpuspeed:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_crond_enabled:def:1" version="1">
      <metadata>
        <title>Service crond Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The crond service should be enabled if possible.</description>
      <reference ref_id="service_crond_enabled" source="ssg"/></metadata>
      <criteria comment="package cronie installed and service crond is configured to start" operator="AND">
        <extend_definition comment="cronie installed" definition_ref="oval:ssg-package_cronie_installed:def:1"/>
        <criteria operator="OR" comment="service crond is configured to start">
          <criterion comment="crond runlevel 0" test_ref="oval:ssg-test_runlevel0_crond:tst:1"/>
          <criterion comment="crond runlevel 1" test_ref="oval:ssg-test_runlevel1_crond:tst:1"/>
          <criterion comment="crond runlevel 2" test_ref="oval:ssg-test_runlevel2_crond:tst:1"/>
          <criterion comment="crond runlevel 3" test_ref="oval:ssg-test_runlevel3_crond:tst:1"/>
          <criterion comment="crond runlevel 4" test_ref="oval:ssg-test_runlevel4_crond:tst:1"/>
          <criterion comment="crond runlevel 5" test_ref="oval:ssg-test_runlevel5_crond:tst:1"/>
          <criterion comment="crond runlevel 6" test_ref="oval:ssg-test_runlevel6_crond:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cups_disabled:def:1" version="1">
      <metadata>
        <title>Service cups Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The cups service should be disabled if possible.</description>
      <reference ref_id="service_cups_disabled" source="ssg"/></metadata>
      <criteria comment="package cups removed or service cups is not configured to start" operator="OR">
        <extend_definition comment="cups removed" definition_ref="oval:ssg-package_cups_removed:def:1"/>
        <criteria operator="AND" comment="service cups is not configured to start">
          <criterion comment="cups runlevel 0" test_ref="oval:ssg-test_runlevel0_cups:tst:1"/>
          <criterion comment="cups runlevel 1" test_ref="oval:ssg-test_runlevel1_cups:tst:1"/>
          <criterion comment="cups runlevel 2" test_ref="oval:ssg-test_runlevel2_cups:tst:1"/>
          <criterion comment="cups runlevel 3" test_ref="oval:ssg-test_runlevel3_cups:tst:1"/>
          <criterion comment="cups runlevel 4" test_ref="oval:ssg-test_runlevel4_cups:tst:1"/>
          <criterion comment="cups runlevel 5" test_ref="oval:ssg-test_runlevel5_cups:tst:1"/>
          <criterion comment="cups runlevel 6" test_ref="oval:ssg-test_runlevel6_cups:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_dhcpd_disabled:def:1" version="1">
      <metadata>
        <title>Service dhcpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The dhcpd service should be disabled if possible.</description>
      <reference ref_id="service_dhcpd_disabled" source="ssg"/></metadata>
      <criteria comment="package dhcp removed or service dhcpd is not configured to start" operator="OR">
        <extend_definition comment="dhcp removed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criteria operator="AND" comment="service dhcpd is not configured to start">
          <criterion comment="dhcpd runlevel 0" test_ref="oval:ssg-test_runlevel0_dhcpd:tst:1"/>
          <criterion comment="dhcpd runlevel 1" test_ref="oval:ssg-test_runlevel1_dhcpd:tst:1"/>
          <criterion comment="dhcpd runlevel 2" test_ref="oval:ssg-test_runlevel2_dhcpd:tst:1"/>
          <criterion comment="dhcpd runlevel 3" test_ref="oval:ssg-test_runlevel3_dhcpd:tst:1"/>
          <criterion comment="dhcpd runlevel 4" test_ref="oval:ssg-test_runlevel4_dhcpd:tst:1"/>
          <criterion comment="dhcpd runlevel 5" test_ref="oval:ssg-test_runlevel5_dhcpd:tst:1"/>
          <criterion comment="dhcpd runlevel 6" test_ref="oval:ssg-test_runlevel6_dhcpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_dovecot_disabled:def:1" version="1">
      <metadata>
        <title>Service dovecot Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The dovecot service should be disabled if possible.</description>
      <reference ref_id="service_dovecot_disabled" source="ssg"/></metadata>
      <criteria comment="package dovecot removed or service dovecot is not configured to start" operator="OR">
        <extend_definition comment="dovecot removed" definition_ref="oval:ssg-package_dovecot_removed:def:1"/>
        <criteria operator="AND" comment="service dovecot is not configured to start">
          <criterion comment="dovecot runlevel 0" test_ref="oval:ssg-test_runlevel0_dovecot:tst:1"/>
          <criterion comment="dovecot runlevel 1" test_ref="oval:ssg-test_runlevel1_dovecot:tst:1"/>
          <criterion comment="dovecot runlevel 2" test_ref="oval:ssg-test_runlevel2_dovecot:tst:1"/>
          <criterion comment="dovecot runlevel 3" test_ref="oval:ssg-test_runlevel3_dovecot:tst:1"/>
          <criterion comment="dovecot runlevel 4" test_ref="oval:ssg-test_runlevel4_dovecot:tst:1"/>
          <criterion comment="dovecot runlevel 5" test_ref="oval:ssg-test_runlevel5_dovecot:tst:1"/>
          <criterion comment="dovecot runlevel 6" test_ref="oval:ssg-test_runlevel6_dovecot:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_haldaemon_disabled:def:1" version="1">
      <metadata>
        <title>Service haldaemon Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The haldaemon service should be disabled if possible.</description>
      <reference ref_id="service_haldaemon_disabled" source="ssg"/></metadata>
      <criteria comment="package hal removed or service haldaemon is not configured to start" operator="OR">
        <extend_definition comment="hal removed" definition_ref="oval:ssg-package_hal_removed:def:1"/>
        <criteria operator="AND" comment="service haldaemon is not configured to start">
          <criterion comment="haldaemon runlevel 0" test_ref="oval:ssg-test_runlevel0_haldaemon:tst:1"/>
          <criterion comment="haldaemon runlevel 1" test_ref="oval:ssg-test_runlevel1_haldaemon:tst:1"/>
          <criterion comment="haldaemon runlevel 2" test_ref="oval:ssg-test_runlevel2_haldaemon:tst:1"/>
          <criterion comment="haldaemon runlevel 3" test_ref="oval:ssg-test_runlevel3_haldaemon:tst:1"/>
          <criterion comment="haldaemon runlevel 4" test_ref="oval:ssg-test_runlevel4_haldaemon:tst:1"/>
          <criterion comment="haldaemon runlevel 5" test_ref="oval:ssg-test_runlevel5_haldaemon:tst:1"/>
          <criterion comment="haldaemon runlevel 6" test_ref="oval:ssg-test_runlevel6_haldaemon:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_httpd_disabled:def:1" version="1">
      <metadata>
        <title>Service httpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The httpd service should be disabled if possible.</description>
      <reference ref_id="service_httpd_disabled" source="ssg"/></metadata>
      <criteria comment="package httpd removed or service httpd is not configured to start" operator="OR">
        <extend_definition comment="httpd removed" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criteria operator="AND" comment="service httpd is not configured to start">
          <criterion comment="httpd runlevel 0" test_ref="oval:ssg-test_runlevel0_httpd:tst:1"/>
          <criterion comment="httpd runlevel 1" test_ref="oval:ssg-test_runlevel1_httpd:tst:1"/>
          <criterion comment="httpd runlevel 2" test_ref="oval:ssg-test_runlevel2_httpd:tst:1"/>
          <criterion comment="httpd runlevel 3" test_ref="oval:ssg-test_runlevel3_httpd:tst:1"/>
          <criterion comment="httpd runlevel 4" test_ref="oval:ssg-test_runlevel4_httpd:tst:1"/>
          <criterion comment="httpd runlevel 5" test_ref="oval:ssg-test_runlevel5_httpd:tst:1"/>
          <criterion comment="httpd runlevel 6" test_ref="oval:ssg-test_runlevel6_httpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ip6tables_enabled:def:1" version="1">
      <metadata>
        <title>Service ip6tables Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The ip6tables service should be enabled if possible.</description>
      <reference ref_id="service_ip6tables_enabled" source="ssg"/></metadata>
      <criteria comment="package iptables-ipv6 installed and service ip6tables is configured to start" operator="AND">
        <extend_definition comment="iptables-ipv6 installed" definition_ref="oval:ssg-package_iptables-ipv6_installed:def:1"/>
        <criteria operator="OR" comment="service ip6tables is configured to start">
          <criterion comment="ip6tables runlevel 0" test_ref="oval:ssg-test_runlevel0_ip6tables:tst:1"/>
          <criterion comment="ip6tables runlevel 1" test_ref="oval:ssg-test_runlevel1_ip6tables:tst:1"/>
          <criterion comment="ip6tables runlevel 2" test_ref="oval:ssg-test_runlevel2_ip6tables:tst:1"/>
          <criterion comment="ip6tables runlevel 3" test_ref="oval:ssg-test_runlevel3_ip6tables:tst:1"/>
          <criterion comment="ip6tables runlevel 4" test_ref="oval:ssg-test_runlevel4_ip6tables:tst:1"/>
          <criterion comment="ip6tables runlevel 5" test_ref="oval:ssg-test_runlevel5_ip6tables:tst:1"/>
          <criterion comment="ip6tables runlevel 6" test_ref="oval:ssg-test_runlevel6_ip6tables:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_iptables_enabled:def:1" version="1">
      <metadata>
        <title>Service iptables Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The iptables service should be enabled if possible.</description>
      <reference ref_id="service_iptables_enabled" source="ssg"/></metadata>
      <criteria comment="package iptables installed and service iptables is configured to start" operator="AND">
        <extend_definition comment="iptables installed" definition_ref="oval:ssg-package_iptables_installed:def:1"/>
        <criteria operator="OR" comment="service iptables is configured to start">
          <criterion comment="iptables runlevel 0" test_ref="oval:ssg-test_runlevel0_iptables:tst:1"/>
          <criterion comment="iptables runlevel 1" test_ref="oval:ssg-test_runlevel1_iptables:tst:1"/>
          <criterion comment="iptables runlevel 2" test_ref="oval:ssg-test_runlevel2_iptables:tst:1"/>
          <criterion comment="iptables runlevel 3" test_ref="oval:ssg-test_runlevel3_iptables:tst:1"/>
          <criterion comment="iptables runlevel 4" test_ref="oval:ssg-test_runlevel4_iptables:tst:1"/>
          <criterion comment="iptables runlevel 5" test_ref="oval:ssg-test_runlevel5_iptables:tst:1"/>
          <criterion comment="iptables runlevel 6" test_ref="oval:ssg-test_runlevel6_iptables:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_irqbalance_enabled:def:1" version="1">
      <metadata>
        <title>Service irqbalance Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The irqbalance service should be enabled if possible.</description>
      <reference ref_id="service_irqbalance_enabled" source="ssg"/></metadata>
      <criteria comment="package irqbalance installed and service irqbalance is configured to start" operator="AND">
        <extend_definition comment="irqbalance installed" definition_ref="oval:ssg-package_irqbalance_installed:def:1"/>
        <criteria operator="OR" comment="service irqbalance is configured to start">
          <criterion comment="irqbalance runlevel 0" test_ref="oval:ssg-test_runlevel0_irqbalance:tst:1"/>
          <criterion comment="irqbalance runlevel 1" test_ref="oval:ssg-test_runlevel1_irqbalance:tst:1"/>
          <criterion comment="irqbalance runlevel 2" test_ref="oval:ssg-test_runlevel2_irqbalance:tst:1"/>
          <criterion comment="irqbalance runlevel 3" test_ref="oval:ssg-test_runlevel3_irqbalance:tst:1"/>
          <criterion comment="irqbalance runlevel 4" test_ref="oval:ssg-test_runlevel4_irqbalance:tst:1"/>
          <criterion comment="irqbalance runlevel 5" test_ref="oval:ssg-test_runlevel5_irqbalance:tst:1"/>
          <criterion comment="irqbalance runlevel 6" test_ref="oval:ssg-test_runlevel6_irqbalance:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_kdump_disabled:def:1" version="1">
      <metadata>
        <title>Service kdump Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kdump service should be disabled if possible.</description>
      <reference ref_id="service_kdump_disabled" source="ssg"/></metadata>
      <criteria comment="package kexec-tools removed or service kdump is not configured to start" operator="OR">
        <extend_definition comment="kexec-tools removed" definition_ref="oval:ssg-package_kexec-tools_removed:def:1"/>
        <criteria operator="AND" comment="service kdump is not configured to start">
          <criterion comment="kdump runlevel 0" test_ref="oval:ssg-test_runlevel0_kdump:tst:1"/>
          <criterion comment="kdump runlevel 1" test_ref="oval:ssg-test_runlevel1_kdump:tst:1"/>
          <criterion comment="kdump runlevel 2" test_ref="oval:ssg-test_runlevel2_kdump:tst:1"/>
          <criterion comment="kdump runlevel 3" test_ref="oval:ssg-test_runlevel3_kdump:tst:1"/>
          <criterion comment="kdump runlevel 4" test_ref="oval:ssg-test_runlevel4_kdump:tst:1"/>
          <criterion comment="kdump runlevel 5" test_ref="oval:ssg-test_runlevel5_kdump:tst:1"/>
          <criterion comment="kdump runlevel 6" test_ref="oval:ssg-test_runlevel6_kdump:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_mdmonitor_disabled:def:1" version="1">
      <metadata>
        <title>Service mdmonitor Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The mdmonitor service should be disabled if possible.</description>
      <reference ref_id="service_mdmonitor_disabled" source="ssg"/></metadata>
      <criteria comment="package mdadm removed or service mdmonitor is not configured to start" operator="OR">
        <extend_definition comment="mdadm removed" definition_ref="oval:ssg-package_mdadm_removed:def:1"/>
        <criteria operator="AND" comment="service mdmonitor is not configured to start">
          <criterion comment="mdmonitor runlevel 0" test_ref="oval:ssg-test_runlevel0_mdmonitor:tst:1"/>
          <criterion comment="mdmonitor runlevel 1" test_ref="oval:ssg-test_runlevel1_mdmonitor:tst:1"/>
          <criterion comment="mdmonitor runlevel 2" test_ref="oval:ssg-test_runlevel2_mdmonitor:tst:1"/>
          <criterion comment="mdmonitor runlevel 3" test_ref="oval:ssg-test_runlevel3_mdmonitor:tst:1"/>
          <criterion comment="mdmonitor runlevel 4" test_ref="oval:ssg-test_runlevel4_mdmonitor:tst:1"/>
          <criterion comment="mdmonitor runlevel 5" test_ref="oval:ssg-test_runlevel5_mdmonitor:tst:1"/>
          <criterion comment="mdmonitor runlevel 6" test_ref="oval:ssg-test_runlevel6_mdmonitor:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_messagebus_disabled:def:1" version="1">
      <metadata>
        <title>Service messagebus Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The messagebus service should be disabled if possible.</description>
      <reference ref_id="service_messagebus_disabled" source="ssg"/></metadata>
      <criteria comment="package dbus removed or service messagebus is not configured to start" operator="OR">
        <extend_definition comment="dbus removed" definition_ref="oval:ssg-package_dbus_removed:def:1"/>
        <criteria operator="AND" comment="service messagebus is not configured to start">
          <criterion comment="messagebus runlevel 0" test_ref="oval:ssg-test_runlevel0_messagebus:tst:1"/>
          <criterion comment="messagebus runlevel 1" test_ref="oval:ssg-test_runlevel1_messagebus:tst:1"/>
          <criterion comment="messagebus runlevel 2" test_ref="oval:ssg-test_runlevel2_messagebus:tst:1"/>
          <criterion comment="messagebus runlevel 3" test_ref="oval:ssg-test_runlevel3_messagebus:tst:1"/>
          <criterion comment="messagebus runlevel 4" test_ref="oval:ssg-test_runlevel4_messagebus:tst:1"/>
          <criterion comment="messagebus runlevel 5" test_ref="oval:ssg-test_runlevel5_messagebus:tst:1"/>
          <criterion comment="messagebus runlevel 6" test_ref="oval:ssg-test_runlevel6_messagebus:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_named_disabled:def:1" version="1">
      <metadata>
        <title>Service named Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The named service should be disabled if possible.</description>
      <reference ref_id="service_named_disabled" source="ssg"/></metadata>
      <criteria comment="package bind removed or service named is not configured to start" operator="OR">
        <extend_definition comment="bind removed" definition_ref="oval:ssg-package_bind_removed:def:1"/>
        <criteria operator="AND" comment="service named is not configured to start">
          <criterion comment="named runlevel 0" test_ref="oval:ssg-test_runlevel0_named:tst:1"/>
          <criterion comment="named runlevel 1" test_ref="oval:ssg-test_runlevel1_named:tst:1"/>
          <criterion comment="named runlevel 2" test_ref="oval:ssg-test_runlevel2_named:tst:1"/>
          <criterion comment="named runlevel 3" test_ref="oval:ssg-test_runlevel3_named:tst:1"/>
          <criterion comment="named runlevel 4" test_ref="oval:ssg-test_runlevel4_named:tst:1"/>
          <criterion comment="named runlevel 5" test_ref="oval:ssg-test_runlevel5_named:tst:1"/>
          <criterion comment="named runlevel 6" test_ref="oval:ssg-test_runlevel6_named:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_netconsole_disabled:def:1" version="1">
      <metadata>
        <title>Service netconsole Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The netconsole service should be disabled if possible.</description>
      <reference ref_id="service_netconsole_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service netconsole is not configured to start">
        <criterion comment="netconsole runlevel 0" test_ref="oval:ssg-test_runlevel0_netconsole:tst:1"/>
        <criterion comment="netconsole runlevel 1" test_ref="oval:ssg-test_runlevel1_netconsole:tst:1"/>
        <criterion comment="netconsole runlevel 2" test_ref="oval:ssg-test_runlevel2_netconsole:tst:1"/>
        <criterion comment="netconsole runlevel 3" test_ref="oval:ssg-test_runlevel3_netconsole:tst:1"/>
        <criterion comment="netconsole runlevel 4" test_ref="oval:ssg-test_runlevel4_netconsole:tst:1"/>
        <criterion comment="netconsole runlevel 5" test_ref="oval:ssg-test_runlevel5_netconsole:tst:1"/>
        <criterion comment="netconsole runlevel 6" test_ref="oval:ssg-test_runlevel6_netconsole:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_netfs_disabled:def:1" version="1">
      <metadata>
        <title>Service netfs Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The netfs service should be disabled if possible.</description>
      <reference ref_id="service_netfs_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service netfs is not configured to start">
        <criterion comment="netfs runlevel 0" test_ref="oval:ssg-test_runlevel0_netfs:tst:1"/>
        <criterion comment="netfs runlevel 1" test_ref="oval:ssg-test_runlevel1_netfs:tst:1"/>
        <criterion comment="netfs runlevel 2" test_ref="oval:ssg-test_runlevel2_netfs:tst:1"/>
        <criterion comment="netfs runlevel 3" test_ref="oval:ssg-test_runlevel3_netfs:tst:1"/>
        <criterion comment="netfs runlevel 4" test_ref="oval:ssg-test_runlevel4_netfs:tst:1"/>
        <criterion comment="netfs runlevel 5" test_ref="oval:ssg-test_runlevel5_netfs:tst:1"/>
        <criterion comment="netfs runlevel 6" test_ref="oval:ssg-test_runlevel6_netfs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_nfs_disabled:def:1" version="1">
      <metadata>
        <title>Service nfs Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nfs service should be disabled if possible.</description>
      <reference ref_id="service_nfs_disabled" source="ssg"/></metadata>
      <criteria comment="package nfs-utils removed or service nfs is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="AND" comment="service nfs is not configured to start">
          <criterion comment="nfs runlevel 0" test_ref="oval:ssg-test_runlevel0_nfs:tst:1"/>
          <criterion comment="nfs runlevel 1" test_ref="oval:ssg-test_runlevel1_nfs:tst:1"/>
          <criterion comment="nfs runlevel 2" test_ref="oval:ssg-test_runlevel2_nfs:tst:1"/>
          <criterion comment="nfs runlevel 3" test_ref="oval:ssg-test_runlevel3_nfs:tst:1"/>
          <criterion comment="nfs runlevel 4" test_ref="oval:ssg-test_runlevel4_nfs:tst:1"/>
          <criterion comment="nfs runlevel 5" test_ref="oval:ssg-test_runlevel5_nfs:tst:1"/>
          <criterion comment="nfs runlevel 6" test_ref="oval:ssg-test_runlevel6_nfs:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_nfslock_disabled:def:1" version="1">
      <metadata>
        <title>Service nfslock Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nfslock service should be disabled if possible.</description>
      <reference ref_id="service_nfslock_disabled" source="ssg"/></metadata>
      <criteria comment="package nfs-utils removed or service nfslock is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="AND" comment="service nfslock is not configured to start">
          <criterion comment="nfslock runlevel 0" test_ref="oval:ssg-test_runlevel0_nfslock:tst:1"/>
          <criterion comment="nfslock runlevel 1" test_ref="oval:ssg-test_runlevel1_nfslock:tst:1"/>
          <criterion comment="nfslock runlevel 2" test_ref="oval:ssg-test_runlevel2_nfslock:tst:1"/>
          <criterion comment="nfslock runlevel 3" test_ref="oval:ssg-test_runlevel3_nfslock:tst:1"/>
          <criterion comment="nfslock runlevel 4" test_ref="oval:ssg-test_runlevel4_nfslock:tst:1"/>
          <criterion comment="nfslock runlevel 5" test_ref="oval:ssg-test_runlevel5_nfslock:tst:1"/>
          <criterion comment="nfslock runlevel 6" test_ref="oval:ssg-test_runlevel6_nfslock:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">
      <metadata>
        <title>Service ntpd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The ntpd service should be enabled if possible.</description>
      <reference ref_id="service_ntpd_enabled" source="ssg"/></metadata>
      <criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
        <extend_definition comment="ntp installed" definition_ref="oval:ssg-package_ntp_installed:def:1"/>
        <criteria operator="OR" comment="service ntpd is configured to start">
          <criterion comment="ntpd runlevel 0" test_ref="oval:ssg-test_runlevel0_ntpd:tst:1"/>
          <criterion comment="ntpd runlevel 1" test_ref="oval:ssg-test_runlevel1_ntpd:tst:1"/>
          <criterion comment="ntpd runlevel 2" test_ref="oval:ssg-test_runlevel2_ntpd:tst:1"/>
          <criterion comment="ntpd runlevel 3" test_ref="oval:ssg-test_runlevel3_ntpd:tst:1"/>
          <criterion comment="ntpd runlevel 4" test_ref="oval:ssg-test_runlevel4_ntpd:tst:1"/>
          <criterion comment="ntpd runlevel 5" test_ref="oval:ssg-test_runlevel5_ntpd:tst:1"/>
          <criterion comment="ntpd runlevel 6" test_ref="oval:ssg-test_runlevel6_ntpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ntpdate_disabled:def:1" version="1">
      <metadata>
        <title>Service ntpdate Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The ntpdate service should be disabled if possible.</description>
      <reference ref_id="service_ntpdate_disabled" source="ssg"/></metadata>
      <criteria comment="package ntpdate removed or service ntpdate is not configured to start" operator="OR">
        <extend_definition comment="ntpdate removed" definition_ref="oval:ssg-package_ntpdate_removed:def:1"/>
        <criteria operator="AND" comment="service ntpdate is not configured to start">
          <criterion comment="ntpdate runlevel 0" test_ref="oval:ssg-test_runlevel0_ntpdate:tst:1"/>
          <criterion comment="ntpdate runlevel 1" test_ref="oval:ssg-test_runlevel1_ntpdate:tst:1"/>
          <criterion comment="ntpdate runlevel 2" test_ref="oval:ssg-test_runlevel2_ntpdate:tst:1"/>
          <criterion comment="ntpdate runlevel 3" test_ref="oval:ssg-test_runlevel3_ntpdate:tst:1"/>
          <criterion comment="ntpdate runlevel 4" test_ref="oval:ssg-test_runlevel4_ntpdate:tst:1"/>
          <criterion comment="ntpdate runlevel 5" test_ref="oval:ssg-test_runlevel5_ntpdate:tst:1"/>
          <criterion comment="ntpdate runlevel 6" test_ref="oval:ssg-test_runlevel6_ntpdate:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_oddjobd_disabled:def:1" version="1">
      <metadata>
        <title>Service oddjobd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The oddjobd service should be disabled if possible.</description>
      <reference ref_id="service_oddjobd_disabled" source="ssg"/></metadata>
      <criteria comment="package oddjob removed or service oddjobd is not configured to start" operator="OR">
        <extend_definition comment="oddjob removed" definition_ref="oval:ssg-package_oddjob_removed:def:1"/>
        <criteria operator="AND" comment="service oddjobd is not configured to start">
          <criterion comment="oddjobd runlevel 0" test_ref="oval:ssg-test_runlevel0_oddjobd:tst:1"/>
          <criterion comment="oddjobd runlevel 1" test_ref="oval:ssg-test_runlevel1_oddjobd:tst:1"/>
          <criterion comment="oddjobd runlevel 2" test_ref="oval:ssg-test_runlevel2_oddjobd:tst:1"/>
          <criterion comment="oddjobd runlevel 3" test_ref="oval:ssg-test_runlevel3_oddjobd:tst:1"/>
          <criterion comment="oddjobd runlevel 4" test_ref="oval:ssg-test_runlevel4_oddjobd:tst:1"/>
          <criterion comment="oddjobd runlevel 5" test_ref="oval:ssg-test_runlevel5_oddjobd:tst:1"/>
          <criterion comment="oddjobd runlevel 6" test_ref="oval:ssg-test_runlevel6_oddjobd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_pcscd_enabled:def:1" version="1">
      <metadata>
        <title>Service pcscd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The pcscd service should be enabled if possible.</description>
      <reference ref_id="service_pcscd_enabled" source="ssg"/></metadata>
      <criteria comment="package pcsc-lite installed and service pcscd is configured to start" operator="AND">
        <extend_definition comment="pcsc-lite installed" definition_ref="oval:ssg-package_pcsc-lite_installed:def:1"/>
        <criteria operator="OR" comment="service pcscd is configured to start">
          <criterion comment="pcscd runlevel 0" test_ref="oval:ssg-test_runlevel0_pcscd:tst:1"/>
          <criterion comment="pcscd runlevel 1" test_ref="oval:ssg-test_runlevel1_pcscd:tst:1"/>
          <criterion comment="pcscd runlevel 2" test_ref="oval:ssg-test_runlevel2_pcscd:tst:1"/>
          <criterion comment="pcscd runlevel 3" test_ref="oval:ssg-test_runlevel3_pcscd:tst:1"/>
          <criterion comment="pcscd runlevel 4" test_ref="oval:ssg-test_runlevel4_pcscd:tst:1"/>
          <criterion comment="pcscd runlevel 5" test_ref="oval:ssg-test_runlevel5_pcscd:tst:1"/>
          <criterion comment="pcscd runlevel 6" test_ref="oval:ssg-test_runlevel6_pcscd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_portreserve_disabled:def:1" version="1">
      <metadata>
        <title>Service portreserve Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The portreserve service should be disabled if possible.</description>
      <reference ref_id="service_portreserve_disabled" source="ssg"/></metadata>
      <criteria comment="package portreserve removed or service portreserve is not configured to start" operator="OR">
        <extend_definition comment="portreserve removed" definition_ref="oval:ssg-package_portreserve_removed:def:1"/>
        <criteria operator="AND" comment="service portreserve is not configured to start">
          <criterion comment="portreserve runlevel 0" test_ref="oval:ssg-test_runlevel0_portreserve:tst:1"/>
          <criterion comment="portreserve runlevel 1" test_ref="oval:ssg-test_runlevel1_portreserve:tst:1"/>
          <criterion comment="portreserve runlevel 2" test_ref="oval:ssg-test_runlevel2_portreserve:tst:1"/>
          <criterion comment="portreserve runlevel 3" test_ref="oval:ssg-test_runlevel3_portreserve:tst:1"/>
          <criterion comment="portreserve runlevel 4" test_ref="oval:ssg-test_runlevel4_portreserve:tst:1"/>
          <criterion comment="portreserve runlevel 5" test_ref="oval:ssg-test_runlevel5_portreserve:tst:1"/>
          <criterion comment="portreserve runlevel 6" test_ref="oval:ssg-test_runlevel6_portreserve:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_postfix_enabled:def:1" version="1">
      <metadata>
        <title>Service postfix Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The postfix service should be enabled if possible.</description>
      <reference ref_id="service_postfix_enabled" source="ssg"/></metadata>
      <criteria comment="package postfix installed and service postfix is configured to start" operator="AND">
        <extend_definition comment="postfix installed" definition_ref="oval:ssg-package_postfix_installed:def:1"/>
        <criteria operator="OR" comment="service postfix is configured to start">
          <criterion comment="postfix runlevel 0" test_ref="oval:ssg-test_runlevel0_postfix:tst:1"/>
          <criterion comment="postfix runlevel 1" test_ref="oval:ssg-test_runlevel1_postfix:tst:1"/>
          <criterion comment="postfix runlevel 2" test_ref="oval:ssg-test_runlevel2_postfix:tst:1"/>
          <criterion comment="postfix runlevel 3" test_ref="oval:ssg-test_runlevel3_postfix:tst:1"/>
          <criterion comment="postfix runlevel 4" test_ref="oval:ssg-test_runlevel4_postfix:tst:1"/>
          <criterion comment="postfix runlevel 5" test_ref="oval:ssg-test_runlevel5_postfix:tst:1"/>
          <criterion comment="postfix runlevel 6" test_ref="oval:ssg-test_runlevel6_postfix:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_psacct_enabled:def:1" version="1">
      <metadata>
        <title>Service psacct Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The psacct service should be enabled if possible.</description>
      <reference ref_id="service_psacct_enabled" source="ssg"/></metadata>
      <criteria comment="package psacct installed and service psacct is configured to start" operator="AND">
        <extend_definition comment="psacct installed" definition_ref="oval:ssg-package_psacct_installed:def:1"/>
        <criteria operator="OR" comment="service psacct is configured to start">
          <criterion comment="psacct runlevel 0" test_ref="oval:ssg-test_runlevel0_psacct:tst:1"/>
          <criterion comment="psacct runlevel 1" test_ref="oval:ssg-test_runlevel1_psacct:tst:1"/>
          <criterion comment="psacct runlevel 2" test_ref="oval:ssg-test_runlevel2_psacct:tst:1"/>
          <criterion comment="psacct runlevel 3" test_ref="oval:ssg-test_runlevel3_psacct:tst:1"/>
          <criterion comment="psacct runlevel 4" test_ref="oval:ssg-test_runlevel4_psacct:tst:1"/>
          <criterion comment="psacct runlevel 5" test_ref="oval:ssg-test_runlevel5_psacct:tst:1"/>
          <criterion comment="psacct runlevel 6" test_ref="oval:ssg-test_runlevel6_psacct:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_qpidd_disabled:def:1" version="1">
      <metadata>
        <title>Service qpidd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The qpidd service should be disabled if possible.</description>
      <reference ref_id="service_qpidd_disabled" source="ssg"/></metadata>
      <criteria comment="package qpid-cpp-server removed or service qpidd is not configured to start" operator="OR">
        <extend_definition comment="qpid-cpp-server removed" definition_ref="oval:ssg-package_qpid-cpp-server_removed:def:1"/>
        <criteria operator="AND" comment="service qpidd is not configured to start">
          <criterion comment="qpidd runlevel 0" test_ref="oval:ssg-test_runlevel0_qpidd:tst:1"/>
          <criterion comment="qpidd runlevel 1" test_ref="oval:ssg-test_runlevel1_qpidd:tst:1"/>
          <criterion comment="qpidd runlevel 2" test_ref="oval:ssg-test_runlevel2_qpidd:tst:1"/>
          <criterion comment="qpidd runlevel 3" test_ref="oval:ssg-test_runlevel3_qpidd:tst:1"/>
          <criterion comment="qpidd runlevel 4" test_ref="oval:ssg-test_runlevel4_qpidd:tst:1"/>
          <criterion comment="qpidd runlevel 5" test_ref="oval:ssg-test_runlevel5_qpidd:tst:1"/>
          <criterion comment="qpidd runlevel 6" test_ref="oval:ssg-test_runlevel6_qpidd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_quota_nld_disabled:def:1" version="1">
      <metadata>
        <title>Service quota_nld Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The quota_nld service should be disabled if possible.</description>
      <reference ref_id="service_quota_nld_disabled" source="ssg"/></metadata>
      <criteria comment="package quota removed or service quota_nld is not configured to start" operator="OR">
        <extend_definition comment="quota removed" definition_ref="oval:ssg-package_quota_removed:def:1"/>
        <criteria operator="AND" comment="service quota_nld is not configured to start">
          <criterion comment="quota_nld runlevel 0" test_ref="oval:ssg-test_runlevel0_quota_nld:tst:1"/>
          <criterion comment="quota_nld runlevel 1" test_ref="oval:ssg-test_runlevel1_quota_nld:tst:1"/>
          <criterion comment="quota_nld runlevel 2" test_ref="oval:ssg-test_runlevel2_quota_nld:tst:1"/>
          <criterion comment="quota_nld runlevel 3" test_ref="oval:ssg-test_runlevel3_quota_nld:tst:1"/>
          <criterion comment="quota_nld runlevel 4" test_ref="oval:ssg-test_runlevel4_quota_nld:tst:1"/>
          <criterion comment="quota_nld runlevel 5" test_ref="oval:ssg-test_runlevel5_quota_nld:tst:1"/>
          <criterion comment="quota_nld runlevel 6" test_ref="oval:ssg-test_runlevel6_quota_nld:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rdisc_disabled:def:1" version="1">
      <metadata>
        <title>Service rdisc Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rdisc service should be disabled if possible.</description>
      <reference ref_id="service_rdisc_disabled" source="ssg"/></metadata>
      <criteria comment="package iputils removed or service rdisc is not configured to start" operator="OR">
        <extend_definition comment="iputils removed" definition_ref="oval:ssg-package_iputils_removed:def:1"/>
        <criteria operator="AND" comment="service rdisc is not configured to start">
          <criterion comment="rdisc runlevel 0" test_ref="oval:ssg-test_runlevel0_rdisc:tst:1"/>
          <criterion comment="rdisc runlevel 1" test_ref="oval:ssg-test_runlevel1_rdisc:tst:1"/>
          <criterion comment="rdisc runlevel 2" test_ref="oval:ssg-test_runlevel2_rdisc:tst:1"/>
          <criterion comment="rdisc runlevel 3" test_ref="oval:ssg-test_runlevel3_rdisc:tst:1"/>
          <criterion comment="rdisc runlevel 4" test_ref="oval:ssg-test_runlevel4_rdisc:tst:1"/>
          <criterion comment="rdisc runlevel 5" test_ref="oval:ssg-test_runlevel5_rdisc:tst:1"/>
          <criterion comment="rdisc runlevel 6" test_ref="oval:ssg-test_runlevel6_rdisc:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_restorecond_enabled:def:1" version="1">
      <metadata>
        <title>Service restorecond Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The restorecond service should be enabled if possible.</description>
      <reference ref_id="service_restorecond_enabled" source="ssg"/></metadata>
      <criteria comment="package policycoreutils installed and service restorecond is configured to start" operator="AND">
        <extend_definition comment="policycoreutils installed" definition_ref="oval:ssg-package_policycoreutils_installed:def:1"/>
        <criteria operator="OR" comment="service restorecond is configured to start">
          <criterion comment="restorecond runlevel 0" test_ref="oval:ssg-test_runlevel0_restorecond:tst:1"/>
          <criterion comment="restorecond runlevel 1" test_ref="oval:ssg-test_runlevel1_restorecond:tst:1"/>
          <criterion comment="restorecond runlevel 2" test_ref="oval:ssg-test_runlevel2_restorecond:tst:1"/>
          <criterion comment="restorecond runlevel 3" test_ref="oval:ssg-test_runlevel3_restorecond:tst:1"/>
          <criterion comment="restorecond runlevel 4" test_ref="oval:ssg-test_runlevel4_restorecond:tst:1"/>
          <criterion comment="restorecond runlevel 5" test_ref="oval:ssg-test_runlevel5_restorecond:tst:1"/>
          <criterion comment="restorecond runlevel 6" test_ref="oval:ssg-test_runlevel6_restorecond:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rexec_disabled:def:1" version="1">
      <metadata>
        <title>Service rexec Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rexec service should be disabled if possible.</description>
      <reference ref_id="service_rexec_disabled" source="ssg"/></metadata>
      <criteria comment="package rsh-server removed or service rexec is not configured to start" operator="OR">
        <extend_definition comment="rpm package rsh-server removed" definition_ref="oval:ssg-package_rsh-server_removed:def:1"/>
        <criterion comment="rexec disabled" test_ref="oval:ssg-test_etc_xinetd_rexec_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rhnsd_disabled:def:1" version="1">
      <metadata>
        <title>Service rhnsd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rhnsd service should be disabled if possible.</description>
      <reference ref_id="service_rhnsd_disabled" source="ssg"/></metadata>
      <criteria comment="package rhnsd removed or service rhnsd is not configured to start" operator="OR">
        <extend_definition comment="rhnsd removed" definition_ref="oval:ssg-package_rhnsd_removed:def:1"/>
        <criteria operator="AND" comment="service rhnsd is not configured to start">
          <criterion comment="rhnsd runlevel 0" test_ref="oval:ssg-test_runlevel0_rhnsd:tst:1"/>
          <criterion comment="rhnsd runlevel 1" test_ref="oval:ssg-test_runlevel1_rhnsd:tst:1"/>
          <criterion comment="rhnsd runlevel 2" test_ref="oval:ssg-test_runlevel2_rhnsd:tst:1"/>
          <criterion comment="rhnsd runlevel 3" test_ref="oval:ssg-test_runlevel3_rhnsd:tst:1"/>
          <criterion comment="rhnsd runlevel 4" test_ref="oval:ssg-test_runlevel4_rhnsd:tst:1"/>
          <criterion comment="rhnsd runlevel 5" test_ref="oval:ssg-test_runlevel5_rhnsd:tst:1"/>
          <criterion comment="rhnsd runlevel 6" test_ref="oval:ssg-test_runlevel6_rhnsd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rhsmcertd_disabled:def:1" version="1">
      <metadata>
        <title>Service rhsmcertd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rhsmcertd service should be disabled if possible.</description>
      <reference ref_id="service_rhsmcertd_disabled" source="ssg"/></metadata>
      <criteria comment="package subscription-manager removed or service rhsmcertd is not configured to start" operator="OR">
        <extend_definition comment="subscription-manager removed" definition_ref="oval:ssg-package_subscription-manager_removed:def:1"/>
        <criteria operator="AND" comment="service rhsmcertd is not configured to start">
          <criterion comment="rhsmcertd runlevel 0" test_ref="oval:ssg-test_runlevel0_rhsmcertd:tst:1"/>
          <criterion comment="rhsmcertd runlevel 1" test_ref="oval:ssg-test_runlevel1_rhsmcertd:tst:1"/>
          <criterion comment="rhsmcertd runlevel 2" test_ref="oval:ssg-test_runlevel2_rhsmcertd:tst:1"/>
          <criterion comment="rhsmcertd runlevel 3" test_ref="oval:ssg-test_runlevel3_rhsmcertd:tst:1"/>
          <criterion comment="rhsmcertd runlevel 4" test_ref="oval:ssg-test_runlevel4_rhsmcertd:tst:1"/>
          <criterion comment="rhsmcertd runlevel 5" test_ref="oval:ssg-test_runlevel5_rhsmcertd:tst:1"/>
          <criterion comment="rhsmcertd runlevel 6" test_ref="oval:ssg-test_runlevel6_rhsmcertd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rlogin_disabled:def:1" version="1">
      <metadata>
        <title>Service rlogin Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rlogin service should be disabled if possible.</description>
      <reference ref_id="service_rlogin_disabled" source="ssg"/></metadata>
      <criteria comment="package rsh-server removed or service rlogin is not configured to start" operator="OR">
        <extend_definition comment="rpm package rsh-server removed" definition_ref="oval:ssg-package_rsh-server_removed:def:1"/>
        <criterion comment="rlogin disabled" test_ref="oval:ssg-test_etc_xinetd_rlogin_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcbind_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcbind Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rpcbind service should be disabled if possible.</description>
      <reference ref_id="service_rpcbind_disabled" source="ssg"/></metadata>
      <criteria comment="package rpcbind removed or service rpcbind is not configured to start" operator="OR">
        <extend_definition comment="rpcbind removed" definition_ref="oval:ssg-package_rpcbind_removed:def:1"/>
        <criteria operator="AND" comment="service rpcbind is not configured to start">
          <criterion comment="rpcbind runlevel 0" test_ref="oval:ssg-test_runlevel0_rpcbind:tst:1"/>
          <criterion comment="rpcbind runlevel 1" test_ref="oval:ssg-test_runlevel1_rpcbind:tst:1"/>
          <criterion comment="rpcbind runlevel 2" test_ref="oval:ssg-test_runlevel2_rpcbind:tst:1"/>
          <criterion comment="rpcbind runlevel 3" test_ref="oval:ssg-test_runlevel3_rpcbind:tst:1"/>
          <criterion comment="rpcbind runlevel 4" test_ref="oval:ssg-test_runlevel4_rpcbind:tst:1"/>
          <criterion comment="rpcbind runlevel 5" test_ref="oval:ssg-test_runlevel5_rpcbind:tst:1"/>
          <criterion comment="rpcbind runlevel 6" test_ref="oval:ssg-test_runlevel6_rpcbind:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcgssd_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcgssd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rpcgssd service should be disabled if possible.</description>
      <reference ref_id="service_rpcgssd_disabled" source="ssg"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcgssd is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="AND" comment="service rpcgssd is not configured to start">
          <criterion comment="rpcgssd runlevel 0" test_ref="oval:ssg-test_runlevel0_rpcgssd:tst:1"/>
          <criterion comment="rpcgssd runlevel 1" test_ref="oval:ssg-test_runlevel1_rpcgssd:tst:1"/>
          <criterion comment="rpcgssd runlevel 2" test_ref="oval:ssg-test_runlevel2_rpcgssd:tst:1"/>
          <criterion comment="rpcgssd runlevel 3" test_ref="oval:ssg-test_runlevel3_rpcgssd:tst:1"/>
          <criterion comment="rpcgssd runlevel 4" test_ref="oval:ssg-test_runlevel4_rpcgssd:tst:1"/>
          <criterion comment="rpcgssd runlevel 5" test_ref="oval:ssg-test_runlevel5_rpcgssd:tst:1"/>
          <criterion comment="rpcgssd runlevel 6" test_ref="oval:ssg-test_runlevel6_rpcgssd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcidmapd_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcidmapd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rpcidmapd service should be disabled if possible.</description>
      <reference ref_id="service_rpcidmapd_disabled" source="ssg"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcidmapd is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="AND" comment="service rpcidmapd is not configured to start">
          <criterion comment="rpcidmapd runlevel 0" test_ref="oval:ssg-test_runlevel0_rpcidmapd:tst:1"/>
          <criterion comment="rpcidmapd runlevel 1" test_ref="oval:ssg-test_runlevel1_rpcidmapd:tst:1"/>
          <criterion comment="rpcidmapd runlevel 2" test_ref="oval:ssg-test_runlevel2_rpcidmapd:tst:1"/>
          <criterion comment="rpcidmapd runlevel 3" test_ref="oval:ssg-test_runlevel3_rpcidmapd:tst:1"/>
          <criterion comment="rpcidmapd runlevel 4" test_ref="oval:ssg-test_runlevel4_rpcidmapd:tst:1"/>
          <criterion comment="rpcidmapd runlevel 5" test_ref="oval:ssg-test_runlevel5_rpcidmapd:tst:1"/>
          <criterion comment="rpcidmapd runlevel 6" test_ref="oval:ssg-test_runlevel6_rpcidmapd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcsvcgssd_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcsvcgssd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rpcsvcgssd service should be disabled if possible.</description>
      <reference ref_id="service_rpcsvcgssd_disabled" source="ssg"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcsvcgssd is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="AND" comment="service rpcsvcgssd is not configured to start">
          <criterion comment="rpcsvcgssd runlevel 0" test_ref="oval:ssg-test_runlevel0_rpcsvcgssd:tst:1"/>
          <criterion comment="rpcsvcgssd runlevel 1" test_ref="oval:ssg-test_runlevel1_rpcsvcgssd:tst:1"/>
          <criterion comment="rpcsvcgssd runlevel 2" test_ref="oval:ssg-test_runlevel2_rpcsvcgssd:tst:1"/>
          <criterion comment="rpcsvcgssd runlevel 3" test_ref="oval:ssg-test_runlevel3_rpcsvcgssd:tst:1"/>
          <criterion comment="rpcsvcgssd runlevel 4" test_ref="oval:ssg-test_runlevel4_rpcsvcgssd:tst:1"/>
          <criterion comment="rpcsvcgssd runlevel 5" test_ref="oval:ssg-test_runlevel5_rpcsvcgssd:tst:1"/>
          <criterion comment="rpcsvcgssd runlevel 6" test_ref="oval:ssg-test_runlevel6_rpcsvcgssd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rsh_disabled:def:1" version="1">
      <metadata>
        <title>Service rsh Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rsh service should be disabled if possible.</description>
      <reference ref_id="service_rsh_disabled" source="ssg"/></metadata>
      <criteria comment="package rsh-server removed or service rsh is not configured to start" operator="OR">
        <extend_definition comment="rpm package rsh-server removed" definition_ref="oval:ssg-package_rsh-server_removed:def:1"/>
        <criterion comment="rsh disabled" test_ref="oval:ssg-test_etc_xinetd_rsh_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">
      <metadata>
        <title>Service rsyslog Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The rsyslog service should be enabled if possible.</description>
      <reference ref_id="service_rsyslog_enabled" source="ssg"/></metadata>
      <criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
        <extend_definition comment="rsyslog installed" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>
        <criteria operator="OR" comment="service rsyslog is configured to start">
          <criterion comment="rsyslog runlevel 0" test_ref="oval:ssg-test_runlevel0_rsyslog:tst:1"/>
          <criterion comment="rsyslog runlevel 1" test_ref="oval:ssg-test_runlevel1_rsyslog:tst:1"/>
          <criterion comment="rsyslog runlevel 2" test_ref="oval:ssg-test_runlevel2_rsyslog:tst:1"/>
          <criterion comment="rsyslog runlevel 3" test_ref="oval:ssg-test_runlevel3_rsyslog:tst:1"/>
          <criterion comment="rsyslog runlevel 4" test_ref="oval:ssg-test_runlevel4_rsyslog:tst:1"/>
          <criterion comment="rsyslog runlevel 5" test_ref="oval:ssg-test_runlevel5_rsyslog:tst:1"/>
          <criterion comment="rsyslog runlevel 6" test_ref="oval:ssg-test_runlevel6_rsyslog:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_saslauthd_disabled:def:1" version="1">
      <metadata>
        <title>Service saslauthd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The saslauthd service should be disabled if possible.</description>
      <reference ref_id="service_saslauthd_disabled" source="ssg"/></metadata>
      <criteria comment="package cyrus-sasl removed or service saslauthd is not configured to start" operator="OR">
        <extend_definition comment="cyrus-sasl removed" definition_ref="oval:ssg-package_cyrus-sasl_removed:def:1"/>
        <criteria operator="AND" comment="service saslauthd is not configured to start">
          <criterion comment="saslauthd runlevel 0" test_ref="oval:ssg-test_runlevel0_saslauthd:tst:1"/>
          <criterion comment="saslauthd runlevel 1" test_ref="oval:ssg-test_runlevel1_saslauthd:tst:1"/>
          <criterion comment="saslauthd runlevel 2" test_ref="oval:ssg-test_runlevel2_saslauthd:tst:1"/>
          <criterion comment="saslauthd runlevel 3" test_ref="oval:ssg-test_runlevel3_saslauthd:tst:1"/>
          <criterion comment="saslauthd runlevel 4" test_ref="oval:ssg-test_runlevel4_saslauthd:tst:1"/>
          <criterion comment="saslauthd runlevel 5" test_ref="oval:ssg-test_runlevel5_saslauthd:tst:1"/>
          <criterion comment="saslauthd runlevel 6" test_ref="oval:ssg-test_runlevel6_saslauthd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_smartd_disabled:def:1" version="1">
      <metadata>
        <title>Service smartd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The smartd service should be disabled if possible.</description>
      <reference ref_id="service_smartd_disabled" source="ssg"/></metadata>
      <criteria comment="package smartmontools removed or service smartd is not configured to start" operator="OR">
        <extend_definition comment="smartmontools removed" definition_ref="oval:ssg-package_smartmontools_removed:def:1"/>
        <criteria operator="AND" comment="service smartd is not configured to start">
          <criterion comment="smartd runlevel 0" test_ref="oval:ssg-test_runlevel0_smartd:tst:1"/>
          <criterion comment="smartd runlevel 1" test_ref="oval:ssg-test_runlevel1_smartd:tst:1"/>
          <criterion comment="smartd runlevel 2" test_ref="oval:ssg-test_runlevel2_smartd:tst:1"/>
          <criterion comment="smartd runlevel 3" test_ref="oval:ssg-test_runlevel3_smartd:tst:1"/>
          <criterion comment="smartd runlevel 4" test_ref="oval:ssg-test_runlevel4_smartd:tst:1"/>
          <criterion comment="smartd runlevel 5" test_ref="oval:ssg-test_runlevel5_smartd:tst:1"/>
          <criterion comment="smartd runlevel 6" test_ref="oval:ssg-test_runlevel6_smartd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_smb_disabled:def:1" version="1">
      <metadata>
        <title>Service smb Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The smb service should be disabled if possible.</description>
      <reference ref_id="service_smb_disabled" source="ssg"/></metadata>
      <criteria operator="AND" comment="service smb is not configured to start">
        <criterion comment="smb runlevel 0" test_ref="oval:ssg-test_runlevel0_smb:tst:1"/>
        <criterion comment="smb runlevel 1" test_ref="oval:ssg-test_runlevel1_smb:tst:1"/>
        <criterion comment="smb runlevel 2" test_ref="oval:ssg-test_runlevel2_smb:tst:1"/>
        <criterion comment="smb runlevel 3" test_ref="oval:ssg-test_runlevel3_smb:tst:1"/>
        <criterion comment="smb runlevel 4" test_ref="oval:ssg-test_runlevel4_smb:tst:1"/>
        <criterion comment="smb runlevel 5" test_ref="oval:ssg-test_runlevel5_smb:tst:1"/>
        <criterion comment="smb runlevel 6" test_ref="oval:ssg-test_runlevel6_smb:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_snmpd_disabled:def:1" version="1">
      <metadata>
        <title>Service snmpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The snmpd service should be disabled if possible.</description>
      <reference ref_id="service_snmpd_disabled" source="ssg"/></metadata>
      <criteria comment="package net-snmp removed or service snmpd is not configured to start" operator="OR">
        <extend_definition comment="net-snmp removed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criteria operator="AND" comment="service snmpd is not configured to start">
          <criterion comment="snmpd runlevel 0" test_ref="oval:ssg-test_runlevel0_snmpd:tst:1"/>
          <criterion comment="snmpd runlevel 1" test_ref="oval:ssg-test_runlevel1_snmpd:tst:1"/>
          <criterion comment="snmpd runlevel 2" test_ref="oval:ssg-test_runlevel2_snmpd:tst:1"/>
          <criterion comment="snmpd runlevel 3" test_ref="oval:ssg-test_runlevel3_snmpd:tst:1"/>
          <criterion comment="snmpd runlevel 4" test_ref="oval:ssg-test_runlevel4_snmpd:tst:1"/>
          <criterion comment="snmpd runlevel 5" test_ref="oval:ssg-test_runlevel5_snmpd:tst:1"/>
          <criterion comment="snmpd runlevel 6" test_ref="oval:ssg-test_runlevel6_snmpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_squid_disabled:def:1" version="1">
      <metadata>
        <title>Service squid Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The squid service should be disabled if possible.</description>
      <reference ref_id="service_squid_disabled" source="ssg"/></metadata>
      <criteria comment="package squid removed or service squid is not configured to start" operator="OR">
        <extend_definition comment="squid removed" definition_ref="oval:ssg-package_squid_removed:def:1"/>
        <criteria operator="AND" comment="service squid is not configured to start">
          <criterion comment="squid runlevel 0" test_ref="oval:ssg-test_runlevel0_squid:tst:1"/>
          <criterion comment="squid runlevel 1" test_ref="oval:ssg-test_runlevel1_squid:tst:1"/>
          <criterion comment="squid runlevel 2" test_ref="oval:ssg-test_runlevel2_squid:tst:1"/>
          <criterion comment="squid runlevel 3" test_ref="oval:ssg-test_runlevel3_squid:tst:1"/>
          <criterion comment="squid runlevel 4" test_ref="oval:ssg-test_runlevel4_squid:tst:1"/>
          <criterion comment="squid runlevel 5" test_ref="oval:ssg-test_runlevel5_squid:tst:1"/>
          <criterion comment="squid runlevel 6" test_ref="oval:ssg-test_runlevel6_squid:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">
      <metadata>
        <title>Service sshd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The sshd service should be disabled if possible.</description>
      <reference ref_id="service_sshd_disabled" source="ssg"/></metadata>
      <criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
        <extend_definition comment="openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criteria operator="AND" comment="service sshd is not configured to start">
          <criterion comment="sshd runlevel 0" test_ref="oval:ssg-test_runlevel0_sshd:tst:1"/>
          <criterion comment="sshd runlevel 1" test_ref="oval:ssg-test_runlevel1_sshd:tst:1"/>
          <criterion comment="sshd runlevel 2" test_ref="oval:ssg-test_runlevel2_sshd:tst:1"/>
          <criterion comment="sshd runlevel 3" test_ref="oval:ssg-test_runlevel3_sshd:tst:1"/>
          <criterion comment="sshd runlevel 4" test_ref="oval:ssg-test_runlevel4_sshd:tst:1"/>
          <criterion comment="sshd runlevel 5" test_ref="oval:ssg-test_runlevel5_sshd:tst:1"/>
          <criterion comment="sshd runlevel 6" test_ref="oval:ssg-test_runlevel6_sshd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sysstat_disabled:def:1" version="1">
      <metadata>
        <title>Service sysstat Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The sysstat service should be disabled if possible.</description>
      <reference ref_id="service_sysstat_disabled" source="ssg"/></metadata>
      <criteria comment="package sysstat removed or service sysstat is not configured to start" operator="OR">
        <extend_definition comment="sysstat removed" definition_ref="oval:ssg-package_sysstat_removed:def:1"/>
        <criteria operator="AND" comment="service sysstat is not configured to start">
          <criterion comment="sysstat runlevel 0" test_ref="oval:ssg-test_runlevel0_sysstat:tst:1"/>
          <criterion comment="sysstat runlevel 1" test_ref="oval:ssg-test_runlevel1_sysstat:tst:1"/>
          <criterion comment="sysstat runlevel 2" test_ref="oval:ssg-test_runlevel2_sysstat:tst:1"/>
          <criterion comment="sysstat runlevel 3" test_ref="oval:ssg-test_runlevel3_sysstat:tst:1"/>
          <criterion comment="sysstat runlevel 4" test_ref="oval:ssg-test_runlevel4_sysstat:tst:1"/>
          <criterion comment="sysstat runlevel 5" test_ref="oval:ssg-test_runlevel5_sysstat:tst:1"/>
          <criterion comment="sysstat runlevel 6" test_ref="oval:ssg-test_runlevel6_sysstat:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_telnetd_disabled:def:1" version="1">
      <metadata>
        <title>Disable telnet Service</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable telnet Service</description>
      <reference ref_id="service_telnetd_disabled" source="ssg"/></metadata>
      <criteria comment="package telnet-server removed or service telnetd is not configured to start" operator="OR">
        <extend_definition comment="rpm package telnet-server removed" definition_ref="oval:ssg-package_telnet-server_removed:def:1"/>
        <criterion comment="Disable telnet Service" test_ref="oval:ssg-test_service_telnetd_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_tftp_disabled:def:1" version="1">
      <metadata>
        <title>Service tftp Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The tftp service should be disabled if possible.</description>
      <reference ref_id="service_tftp_disabled" source="ssg"/></metadata>
      <criteria comment="package tftp-server removed or service tftp is not configured to start" operator="OR">
        <extend_definition comment="tftp-server removed" definition_ref="oval:ssg-package_tftp-server_removed:def:1"/>
        <criteria operator="AND" comment="service tftp is not configured to start">
          <criterion comment="tftp runlevel 0" test_ref="oval:ssg-test_runlevel0_tftp:tst:1"/>
          <criterion comment="tftp runlevel 1" test_ref="oval:ssg-test_runlevel1_tftp:tst:1"/>
          <criterion comment="tftp runlevel 2" test_ref="oval:ssg-test_runlevel2_tftp:tst:1"/>
          <criterion comment="tftp runlevel 3" test_ref="oval:ssg-test_runlevel3_tftp:tst:1"/>
          <criterion comment="tftp runlevel 4" test_ref="oval:ssg-test_runlevel4_tftp:tst:1"/>
          <criterion comment="tftp runlevel 5" test_ref="oval:ssg-test_runlevel5_tftp:tst:1"/>
          <criterion comment="tftp runlevel 6" test_ref="oval:ssg-test_runlevel6_tftp:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_vsftpd_disabled:def:1" version="1">
      <metadata>
        <title>Service vsftpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The vsftpd service should be disabled if possible.</description>
      <reference ref_id="service_vsftpd_disabled" source="ssg"/></metadata>
      <criteria comment="package vsftpd removed or service vsftpd is not configured to start" operator="OR">
        <extend_definition comment="vsftpd removed" definition_ref="oval:ssg-package_vsftpd_removed:def:1"/>
        <criteria operator="AND" comment="service vsftpd is not configured to start">
          <criterion comment="vsftpd runlevel 0" test_ref="oval:ssg-test_runlevel0_vsftpd:tst:1"/>
          <criterion comment="vsftpd runlevel 1" test_ref="oval:ssg-test_runlevel1_vsftpd:tst:1"/>
          <criterion comment="vsftpd runlevel 2" test_ref="oval:ssg-test_runlevel2_vsftpd:tst:1"/>
          <criterion comment="vsftpd runlevel 3" test_ref="oval:ssg-test_runlevel3_vsftpd:tst:1"/>
          <criterion comment="vsftpd runlevel 4" test_ref="oval:ssg-test_runlevel4_vsftpd:tst:1"/>
          <criterion comment="vsftpd runlevel 5" test_ref="oval:ssg-test_runlevel5_vsftpd:tst:1"/>
          <criterion comment="vsftpd runlevel 6" test_ref="oval:ssg-test_runlevel6_vsftpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_xinetd_disabled:def:1" version="1">
      <metadata>
        <title>Service xinetd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The xinetd service should be disabled if possible.</description>
      <reference ref_id="service_xinetd_disabled" source="ssg"/></metadata>
      <criteria comment="package xinetd removed or service xinetd is not configured to start" operator="OR">
        <extend_definition comment="xinetd removed" definition_ref="oval:ssg-package_xinetd_removed:def:1"/>
        <criteria operator="AND" comment="service xinetd is not configured to start">
          <criterion comment="xinetd runlevel 0" test_ref="oval:ssg-test_runlevel0_xinetd:tst:1"/>
          <criterion comment="xinetd runlevel 1" test_ref="oval:ssg-test_runlevel1_xinetd:tst:1"/>
          <criterion comment="xinetd runlevel 2" test_ref="oval:ssg-test_runlevel2_xinetd:tst:1"/>
          <criterion comment="xinetd runlevel 3" test_ref="oval:ssg-test_runlevel3_xinetd:tst:1"/>
          <criterion comment="xinetd runlevel 4" test_ref="oval:ssg-test_runlevel4_xinetd:tst:1"/>
          <criterion comment="xinetd runlevel 5" test_ref="oval:ssg-test_runlevel5_xinetd:tst:1"/>
          <criterion comment="xinetd runlevel 6" test_ref="oval:ssg-test_runlevel6_xinetd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ypbind_disabled:def:1" version="1">
      <metadata>
        <title>Service ypbind Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The ypbind service should be disabled if possible.</description>
      <reference ref_id="service_ypbind_disabled" source="ssg"/></metadata>
      <criteria comment="package ypbind removed or service ypbind is not configured to start" operator="OR">
        <extend_definition comment="ypbind removed" definition_ref="oval:ssg-package_ypbind_removed:def:1"/>
        <criteria operator="AND" comment="service ypbind is not configured to start">
          <criterion comment="ypbind runlevel 0" test_ref="oval:ssg-test_runlevel0_ypbind:tst:1"/>
          <criterion comment="ypbind runlevel 1" test_ref="oval:ssg-test_runlevel1_ypbind:tst:1"/>
          <criterion comment="ypbind runlevel 2" test_ref="oval:ssg-test_runlevel2_ypbind:tst:1"/>
          <criterion comment="ypbind runlevel 3" test_ref="oval:ssg-test_runlevel3_ypbind:tst:1"/>
          <criterion comment="ypbind runlevel 4" test_ref="oval:ssg-test_runlevel4_ypbind:tst:1"/>
          <criterion comment="ypbind runlevel 5" test_ref="oval:ssg-test_runlevel5_ypbind:tst:1"/>
          <criterion comment="ypbind runlevel 6" test_ref="oval:ssg-test_runlevel6_ypbind:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_ip6tables_default_rule:def:1" version="2">
      <metadata>
        <title>Change the default policy to DROP (from ACCEPT) for
      the INPUT built-in chain</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Change the default policy to DROP (from ACCEPT)
      for the INPUT built-in chain.</description>
      <reference ref_id="set_ip6tables_default_rule" source="ssg"/></metadata>
      <criteria>
        <criterion comment=":INPUT DROP [0:0]" test_ref="oval:ssg-test_ip6tables_input_drop:tst:1"/>
        <criterion comment=":INPUT ACCEPT [0:0]" negate="true" test_ref="oval:ssg-test_ip6tables_input_accept:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_iptables_default_rule:def:1" version="2">
      <metadata>
        <title>Change the default policy to DROP (from ACCEPT) for
      the INPUT built-in chain</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Change the default policy to DROP (from ACCEPT)
      for the INPUT built-in chain.</description>
      <reference ref_id="set_iptables_default_rule" source="ssg"/></metadata>
      <criteria>
        <criterion comment=":INPUT DROP [0:0]" test_ref="oval:ssg-test_iptables_input_drop:tst:1"/>
        <criterion comment=":INPUT ACCEPT [0:0]" negate="true" test_ref="oval:ssg-test_iptables_input_accept:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_iptables_default_rule_forward:def:1" version="2">
      <metadata>
        <title>Change the default policy to DROP (from ACCEPT) for
      the FORWARD built-in chain</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Change the default policy to DROP (from ACCEPT)
      for the FORWARD built-in chain.</description>
      <reference ref_id="set_iptables_default_rule_forward" source="ssg"/></metadata>
      <criteria>
        <criterion comment=":FORWARD DROP [0:0]" test_ref="oval:ssg-test_iptables_forward_drop:tst:1"/>
        <criterion comment=":FORWARD ACCEPT [0:0]" negate="true" test_ref="oval:ssg-test_iptables_forward_accept:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-smartcard_auth:def:1" version="2">
      <metadata>
        <title>Enable Smart Card Login</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Enable Smart Card logins</description>
      <reference ref_id="smartcard_auth" source="ssg"/></metadata>
      <criteria comment="smart card authentication is configured" operator="AND">
        <extend_definition comment="pam_pkcs11 package is installed" definition_ref="oval:ssg-package_pam_pkcs11_installed:def:1"/>
        <extend_definition comment="esc package is installed" definition_ref="oval:ssg-package_esc_installed:def:1"/>
        <extend_definition comment="pcscd service is enabled" definition_ref="oval:ssg-service_pcscd_enabled:def:1"/>
        <criterion comment="cert_policy directive contains oscp_on" test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1"/>
        <criteria comment="smart card authentication is enabled or required in system-auth" operator="OR">
          <!-- Smartcard authentication enabled, but login is allowed also by other means -->
          <criterion comment="smart card authentication is enabled in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1"/>
          <!-- Smartcard authentication required (login is allowed only via smartcard) -->
          <criterion comment="smart card is required in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1"/>
        </criteria>
        <criterion comment="smart card is required in /etc/pam.d/smartcard-auth" test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "fs.suid_dumpable" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>
        <extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "kernel.dmesg_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>
        <extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.exec-shield" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "kernel.exec-shield" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_exec_shield" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.exec-shield configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_exec_shield:def:1"/>
        <extend_definition comment="kernel.exec-shield runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_exec_shield:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "kernel.randomize_va_space" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>
        <extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.all.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_all_accept_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.all.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_all_accept_source_route" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.log_martians" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.all.log_martians" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_all_log_martians" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.rp_filter" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.all.rp_filter" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_all_rp_filter" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.secure_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.all.secure_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_all_secure_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.send_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.all.send_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_all_send_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.default.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_default_accept_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.default.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_default_accept_source_route" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.rp_filter" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.default.rp_filter" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_default_rp_filter" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.secure_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.default.secure_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_default_secure_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.send_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.conf.default.send_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_conf_default_send_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_echo_ignore_broadcasts" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.icmp_echo_ignore_broadcasts" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
        <extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_ignore_bogus_error_responses" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.icmp_ignore_bogus_error_responses" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
        <extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.ip_forward" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>
        <extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.tcp_syncookies" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv4.tcp_syncookies" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv4_tcp_syncookies" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.tcp_syncookies configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1"/>
        <extend_definition comment="net.ipv4.tcp_syncookies runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_ra" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.all.accept_ra" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_all_accept_ra" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.all.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_all_accept_redirects" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_redirects set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_redirects:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_redirects:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.all.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_all_accept_source_route" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_source_route set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_source_route:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_source_route:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.forwarding" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.all.forwarding" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_all_forwarding" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.forwarding set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.forwarding configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_forwarding:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.forwarding runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_forwarding:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_ra" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.default.accept_ra" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_default_accept_ra" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.default.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1"/>
          <extend_definition comment="net.ipv6.conf.default.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.default.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_default_accept_redirects" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1"/>
          <extend_definition comment="net.ipv6.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "net.ipv6.conf.default.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference ref_id="sysctl_net_ipv6_conf_default_accept_source_route" source="ssg"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_source_route set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_source_route:def:1"/>
          <extend_definition comment="net.ipv6.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_source_route:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_runtime_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_runtime_kernel_dmesg_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_exec_shield:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.exec-shield" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.exec-shield" parameter should be set to "1" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_exec_shield" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_runtime_kernel_exec_shield:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in system runtime.</description>
      <reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_runtime_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_all_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_source_route" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_all_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.log_martians" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.log_martians" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_all_log_martians" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_all_log_martians:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.rp_filter" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.rp_filter" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_all_rp_filter" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_all_rp_filter:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.secure_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.secure_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_all_secure_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_all_secure_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.send_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.send_redirects" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_all_send_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:ssg-test_runtime_net_ipv4_conf_all_send_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_default_accept_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_default_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_default_accept_source_route" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_default_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.rp_filter" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.rp_filter" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_default_rp_filter" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_default_rp_filter:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.secure_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.secure_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_default_secure_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_conf_default_secure_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.send_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.send_redirects" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_conf_default_send_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:ssg-test_runtime_net_ipv4_conf_default_send_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_echo_ignore_broadcasts" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_echo_ignore_broadcasts" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_ignore_bogus_error_responses" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_ignore_bogus_error_responses" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to "0" in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="oval:ssg-test_runtime_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.tcp_syncookies" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.tcp_syncookies" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv4_tcp_syncookies" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv4_tcp_syncookies:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_ra" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_ra" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_all_accept_ra:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_all_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_source_route" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_all_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_forwarding:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.forwarding" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.forwarding" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_all_forwarding" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_all_forwarding:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_ra" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_ra" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_default_accept_ra:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_redirects" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_default_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_source_route" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_net_ipv6_conf_default_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the fs.suid_dumpable directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the fs.suid_dumpable directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the fs.suid_dumpable directive, and /etc/sysctl.conf
             contains the fs.suid_dumpable directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_fs_suid_dumpable:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_fs_suid_dumpable:tst:1"/>
          <criterion comment="Kernel static parameter fs.suid_dumpable not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_fs_suid_dumpable_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the kernel.dmesg_restrict directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the kernel.dmesg_restrict directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the kernel.dmesg_restrict directive, and /etc/sysctl.conf
             contains the kernel.dmesg_restrict directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_kernel_dmesg_restrict:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_kernel_dmesg_restrict:tst:1"/>
          <criterion comment="Kernel static parameter kernel.dmesg_restrict not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_kernel_dmesg_restrict_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_exec_shield:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.exec-shield" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.exec-shield" parameter should be set to "1" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_exec_shield" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the kernel.exec-shield directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the kernel.exec-shield directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the kernel.exec-shield directive, and /etc/sysctl.conf
             contains the kernel.exec-shield directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter kernel.exec-shield set to 1 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_kernel_exec_shield:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater kernel.exec-shield set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_kernel_exec_shield:tst:1"/>
          <criterion comment="Kernel static parameter kernel.exec-shield not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_kernel_exec_shield_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in the system configuration.</description>
      <reference ref_id="sysctl_static_kernel_randomize_va_space" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the kernel.randomize_va_space directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the kernel.randomize_va_space directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the kernel.randomize_va_space directive, and /etc/sysctl.conf
             contains the kernel.randomize_va_space directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_kernel_randomize_va_space:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_kernel_randomize_va_space:tst:1"/>
          <criterion comment="Kernel static parameter kernel.randomize_va_space not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_kernel_randomize_va_space_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_all_accept_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.all.accept_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.all.accept_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.all.accept_redirects directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.all.accept_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_accept_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.all.accept_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_all_accept_source_route" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.all.accept_source_route directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.all.accept_source_route directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.all.accept_source_route directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.all.accept_source_route directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_accept_source_route:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.all.accept_source_route not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_source_route_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.log_martians" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.log_martians" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_all_log_martians" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.all.log_martians directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.all.log_martians directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.all.log_martians directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.all.log_martians directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_log_martians:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.all.log_martians not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_log_martians_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.rp_filter" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.rp_filter" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_all_rp_filter" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.all.rp_filter directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.all.rp_filter directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.all.rp_filter directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.all.rp_filter directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_rp_filter:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.all.rp_filter not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_rp_filter_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.secure_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.secure_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_all_secure_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.all.secure_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.all.secure_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.all.secure_redirects directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.all.secure_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_secure_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.all.secure_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_secure_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.send_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.send_redirects" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_all_send_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.all.send_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.all.send_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.all.send_redirects directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.all.send_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_send_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.all.send_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_all_send_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_default_accept_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.default.accept_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.default.accept_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.default.accept_redirects directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.default.accept_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_accept_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.default.accept_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_default_accept_source_route" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.default.accept_source_route directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.default.accept_source_route directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.default.accept_source_route directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.default.accept_source_route directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_accept_source_route:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.default.accept_source_route not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_source_route_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.rp_filter" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.rp_filter" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_default_rp_filter" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.default.rp_filter directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.default.rp_filter directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.default.rp_filter directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.default.rp_filter directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_rp_filter:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.default.rp_filter not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_rp_filter_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.secure_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.secure_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_default_secure_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.default.secure_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.default.secure_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.default.secure_redirects directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.default.secure_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_secure_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.default.secure_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_secure_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.send_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.send_redirects" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_conf_default_send_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.conf.default.send_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.conf.default.send_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.conf.default.send_redirects directive, and /etc/sysctl.conf
             contains the net.ipv4.conf.default.send_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_send_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.conf.default.send_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_conf_default_send_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_echo_ignore_broadcasts" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_echo_ignore_broadcasts" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.icmp_echo_ignore_broadcasts directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.icmp_echo_ignore_broadcasts directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.icmp_echo_ignore_broadcasts directive, and /etc/sysctl.conf
             contains the net.ipv4.icmp_echo_ignore_broadcasts directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_ignore_bogus_error_responses" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_ignore_bogus_error_responses" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.icmp_ignore_bogus_error_responses directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.icmp_ignore_bogus_error_responses directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.icmp_ignore_bogus_error_responses directive, and /etc/sysctl.conf
             contains the net.ipv4.icmp_ignore_bogus_error_responses directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to "0" in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_ip_forward" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.ip_forward directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.ip_forward directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.ip_forward directive, and /etc/sysctl.conf
             contains the net.ipv4.ip_forward directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.ip_forward set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_ip_forward:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.ip_forward not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_ip_forward_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.tcp_syncookies" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv4.tcp_syncookies" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv4_tcp_syncookies" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv4.tcp_syncookies directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv4.tcp_syncookies directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv4.tcp_syncookies directive, and /etc/sysctl.conf
             contains the net.ipv4.tcp_syncookies directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv4_tcp_syncookies:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv4.tcp_syncookies not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv4_tcp_syncookies_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_ra" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_ra" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.all.accept_ra directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.all.accept_ra directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.all.accept_ra directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.all.accept_ra directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_ra:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.all.accept_ra set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_accept_ra:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.all.accept_ra not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_ra_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_all_accept_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.all.accept_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.all.accept_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.all.accept_redirects directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.all.accept_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_accept_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.all.accept_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_all_accept_source_route" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.all.accept_source_route directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.all.accept_source_route directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.all.accept_source_route directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.all.accept_source_route directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_source_route:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_accept_source_route:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.all.accept_source_route not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_source_route_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_forwarding:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.forwarding" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.forwarding" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_all_forwarding" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.all.forwarding directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.all.forwarding directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.all.forwarding directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.all.forwarding directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_forwarding:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.all.forwarding set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_forwarding:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.all.forwarding not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_all_forwarding_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_ra" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_ra" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.default.accept_ra directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.default.accept_ra directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.default.accept_ra directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.default.accept_ra directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_default_accept_ra:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.default.accept_ra not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_ra_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_default_accept_redirects" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.default.accept_redirects directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.default.accept_redirects directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.default.accept_redirects directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.default.accept_redirects directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_default_accept_redirects:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.default.accept_redirects not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_redirects_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference ref_id="sysctl_static_net_ipv6_conf_default_accept_source_route" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the net.ipv6.conf.default.accept_source_route directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the net.ipv6.conf.default.accept_source_route directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the net.ipv6.conf.default.accept_source_route directive, and /etc/sysctl.conf
             contains the net.ipv6.conf.default.accept_source_route directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_source_route:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater net.ipv6.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_default_accept_source_route:tst:1"/>
          <criterion comment="Kernel static parameter net.ipv6.conf.default.accept_source_route not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_source_route_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-xwindows_runlevel_setting:def:1" version="1">
      <metadata>
        <title>Disable X Windows Startup By Setting Runlevel</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks /etc/inittab to ensure that default runlevel is set to 3.</description>
      <reference ref_id="xwindows_runlevel_setting" source="ssg"/></metadata>
      <criteria>
        <criterion comment="default runlevel is 3" test_ref="oval:ssg-test_etc_inittab_default_runlevel:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2">
      <metadata>
        <title>Set Accounts to Expire Following Password Expiration</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The accounts should be configured to expire automatically following password expiration.</description>
      <reference ref_id="account_disable_post_pw_expiration" source="ssg"/></metadata>
      <criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
        <criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-account_unique_name:def:1" version="1">
      <metadata>
        <title>Set All Accounts To Have Unique Names</title>
        <affected family="unix">
        </affected>
        <description>All accounts on the system should have unique names for proper accountability.</description>
      <reference ref_id="account_unique_name" source="ssg"/></metadata>
      <criteria comment="There should not exist duplicate user name entries in /etc/passwd">
        <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1">
      <metadata>
        <title>Set Maximum Number of Concurrent Login Sessions Per User</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</description>
      <reference ref_id="accounts_max_concurrent_login_sessions" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins:tst:1"/>
        <criteria operator="AND">
          <criterion comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" negate="true"/>
          <criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" test_ref="oval:ssg-test_maxlogins:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The maximum password age policy should meet minimum requirements.</description>
      <reference ref_id="accounts_maximum_age_login_defs" source="ssg"/></metadata>
      <criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The minimum password age policy should be set appropriately.</description>
      <reference ref_id="accounts_minimum_age_login_defs" source="ssg"/></metadata>
      <criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1">
      <metadata>
        <title>UID 0 Belongs Only To Root</title>
        <affected family="unix">
        </affected>
        <description>Only the root account should be assigned a user id of 0.</description>
      <reference ref_id="accounts_no_uid_except_zero" source="ssg"/></metadata>
      <criteria>
        <criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_all_shadowed:def:1" version="1">
      <metadata>
        <title>All Password Hashes Shadowed</title>
        <affected family="unix">
        </affected>
        <description>All password hashes should be shadowed.</description>
      <reference ref_id="accounts_password_all_shadowed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password minimum length should be set appropriately.</description>
      <reference ref_id="accounts_password_minlen_login_defs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2">
      <metadata>
        <title>Limit Password Reuse</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The passwords to remember should be set correctly.</description>
      <reference ref_id="accounts_password_pam_unix_remember" source="ssg"/></metadata>
      <criteria comment="remember parameter of pam_unix.so or pam_pwhistory.so is set correctly" operator="OR">
        <criterion comment="remember parameter of pam_unix.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1"/>
        <criterion comment="remember parameter of pam_pwhistory.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password expiration warning age should be set appropriately.</description>
      <reference ref_id="accounts_password_warn_age_login_defs" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="4">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference ref_id="accounts_passwords_pam_faillock_deny" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" comment="pam_faillock.so authfail deny value set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" comment="pam_faillock.so set in account phase of system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" comment="pam_faillock.so authfail deny value set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" comment="pam_faillock.so set in account phase of password-auth"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="2">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference ref_id="accounts_passwords_pam_faillock_interval" source="ssg"/></metadata>
      <criteria>
        <criterion comment="preauth default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1"/>
        <criterion comment="preauth default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="2">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference ref_id="accounts_passwords_pam_faillock_unlock_time" source="ssg"/></metadata>
      <criteria>
        <criterion comment="preauth default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password-auth:tst:1"/>
        <criterion comment="preauth default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2">
      <metadata>
        <title>Write permissions are disabled for group and other in all
      directories in Root's Path</title>
        <affected family="unix">
        </affected>
        <description>Check each directory in root's path and make use it does
      not grant write permission to group and other</description>
      <reference ref_id="accounts_root_path_dirs_no_write" source="ssg"/></metadata>
      <criteria comment="Check that write permission to group and other in root's path is denied">
        <criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_tmout:def:1" version="2">
      <metadata>
        <title>Set Interactive Session Timeout</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks interactive shell timeout</description>
      <reference ref_id="accounts_tmout" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="TMOUT value in /etc/profile &gt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profile_tmout:tst:1"/>
        <criterion comment="TMOUT value in /etc/profile.d/*.sh &gt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profiled_tmout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_bashrc:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values set for bash</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for users of the bash shell</description>
      <reference ref_id="accounts_umask_etc_bashrc" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_bashrc:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_csh_cshrc:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values set for csh</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for users of the csh shell</description>
      <reference ref_id="accounts_umask_etc_csh_cshrc" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values in /etc/login.defs</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for all users specified in /etc/login.defs</description>
      <reference ref_id="accounts_umask_etc_login_defs" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_profile:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values in /etc/profile</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for all users should be set correctly</description>
      <reference ref_id="accounts_umask_etc_profile" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_build_database:def:1" version="2">
      <metadata>
        <title>Aide Database Must Exist</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The aide database must be initialized.</description>
      <reference ref_id="aide_build_database" source="ssg"/></metadata>
      <criteria operator="AND">
        <!-- Only the configuration when location of the Aide database file is specified in the
           form of absolute path is checked. To check any possible relative path configuration
           that might happen would require to browse whole file system (resources expensive operation).
           Case when Aide database file is configured to be written into an SQL table (possibly
           even on remote host) is out of scope of this check -->
        <criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1"/>
        <criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_periodic_cron_checking:def:1" version="3">
      <metadata>
        <title>Configure Periodic Execution of AIDE</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </description>
      <reference ref_id="aide_periodic_cron_checking" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criteria operator="OR">
          <criterion comment="run aide daily with cron" test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1"/>
          <criterion comment="run aide daily with cron" test_ref="oval:ssg-test_aide_crond_checking:tst:1"/>
          <criterion comment="run aide daily with cron" test_ref="oval:ssg-test_aide_var_cron_checking:tst:1"/>
          <criterion comment="run aide daily with cron.(daily|weekly|monthly)" test_ref="oval:ssg-test_aide_crontabs_checking:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_scan_notification:def:1" version="1">
      <metadata>
        <title>Configure Notification of Post-AIDE Scan Details</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should notify appropriate personnel of the details
      of a scan after the scan has been run.</description>
      <reference ref_id="aide_scan_notification" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criteria operator="OR">
          <criterion comment="notify personnel when aide completes" test_ref="oval:ssg-test_aide_scan_notification:tst:1"/>
          <criterion comment="notify personnel when aide completes" test_ref="oval:ssg-test_aide_var_cron_notification:tst:1"/>
          <criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" test_ref="oval:ssg-test_aide_crontabs_notification:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_use_fips_hashes:def:1" version="1">
      <metadata>
        <title>Configure AIDE to Use FIPS 140-2 for Validating Hashes</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should be configured to use the FIPS 140-2 
      cryptographic hashes.</description>
      <reference ref_id="aide_use_fips_hashes" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criterion comment="non-FIPS hashes are not configured" test_ref="oval:ssg-test_aide_non_fips_hashes:tst:1"/>
        <criterion comment="FIPS hashes are configured" test_ref="oval:ssg-test_aide_use_fips_hashes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_verify_acls:def:1" version="1">
      <metadata>
        <title>Configure AIDE to Verify Access Control Lists (ACLs)</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should be configured to verify Access Control Lists (ACLs).</description>
      <reference ref_id="aide_verify_acls" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criterion comment="acl is set in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_acls:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_verify_ext_attributes:def:1" version="1">
      <metadata>
        <title>Configure AIDE to Verify Extended Attributes</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should be configured to verify extended file attributes.</description>
      <reference ref_id="aide_verify_ext_attributes" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criterion comment="xattrs is set in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_ext_attributes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1">
      <metadata>
        <title>The syslog Plugin Of the Audit Event Multiplexor (audispd) Is Activated</title>
        <affected family="unix">
        </affected>
        <description>active setting in /etc/audisp/plugins.d/syslog.conf is set to 'yes'</description>
      <reference ref_id="auditd_audispd_syslog_plugin_activated" source="ssg"/></metadata>
      <criteria>
        <criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1">
      <metadata>
        <title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</title>
        <affected family="unix">
        </affected>
        <description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</description>
      <reference ref_id="auditd_conf_log_group_not_root" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2">
      <metadata>
        <title>Auditd Email Account to Notify Upon Action</title>
        <affected family="unix">
        </affected>
        <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
      <reference ref_id="auditd_data_retention_action_mail_acct" source="ssg"/></metadata>
      <criteria>
        <criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Disk is Low on Space</title>
        <affected family="unix">
        </affected>
        <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_admin_space_left_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_flush:def:1" version="1">
      <metadata>
        <title>Auditd priority for flushing data to disk</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The setting for flush in /etc/audit/auditd.conf</description>
      <reference ref_id="auditd_data_retention_flush" source="ssg"/></metadata>
      <criteria>
        <criterion comment="flush setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Log File Size</title>
        <affected family="unix">
        </affected>
        <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference ref_id="auditd_data_retention_max_log_file" source="ssg"/></metadata>
      <criteria>
        <criterion comment="max_log_file setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Maximum Log Size Reached</title>
        <affected family="unix">
        </affected>
        <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_max_log_file_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Number of Logs to Retain</title>
        <affected family="unix">
        </affected>
        <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference ref_id="auditd_data_retention_num_logs" source="ssg"/></metadata>
      <criteria>
        <criterion comment="num_logs setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3">
      <metadata>
        <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
        <affected family="unix">
        </affected>
        <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference ref_id="auditd_data_retention_space_left_action" source="ssg"/></metadata>
      <criteria>
        <criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-banner_etc_issue:def:1" version="2">
      <metadata>
        <title>System Login Banner Compliance</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The system login banner text should be set correctly.</description>
      <reference ref_id="banner_etc_issue" source="ssg"/></metadata>
      <criteria>
        <criterion comment="/etc/issue is set appropriately" test_ref="oval:ssg-test_banner_etc_issue:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-cups_disable_browsing:def:1" version="1">
      <metadata>
        <title>Disable Printer Browsing Entirely if Possible</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The CUPS print service can be configured to broadcast a list
      of available printers to the network. Other machines on the network, also
      running the CUPS print service, can be configured to listen to these
      broadcasts and add and configure these printers for immediate use. By
      disabling this browsing capability, the machine will no longer generate
      or receive such broadcasts.</description>
      <reference ref_id="cups_disable_browsing" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Ensure remote printer browsing is off" test_ref="oval:ssg-test_cups_disable_browsing_browsing_off:tst:1"/>
        <criterion comment="Ensure no incoming printer information packets are allowed" test_ref="oval:ssg-test_cups_disable_browsing_browseallow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-cups_disable_printserver:def:1" version="1">
      <metadata>
        <title>Disable Printer Server if Possible</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>By default, locally configured printers will not be shared
      over the network, but if this functionality has somehow been enabled,
      these recommendations will disable it again. Be sure to disable outgoing
      printer list broadcasts, or remote users will still be able to see the
      locally configured printers, even if they cannot actually print to them.
      To limit print serving to a particular set of users, use the Policy
      directive.</description>
      <reference ref_id="cups_disable_printserver" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Don't use port directive" test_ref="oval:ssg-test_cups_disable_printserver_disable_port:tst:1"/>
        <criterion comment="Do use the listen directive" test_ref="oval:ssg-test_cups_disable_printserver_use_listen:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_etc_httpd_conf:def:1" version="2">
      <metadata>
        <title>Directory /etc/httpd/conf/ Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Directory permissions for /etc/httpd/conf/ should be set to 0750 (or stronger).</description>
      <reference ref_id="dir_perms_etc_httpd_conf" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="httpd not present or in use" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criterion test_ref="oval:ssg-test_dir_perms_etc_httpd_conf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_var_log_httpd:def:1" version="2">
      <metadata>
        <title>Directory /var/log/httpd/ Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Directory permissions for /var/log/httpd should be set to 0700 (or stronger).</description>
      <reference ref_id="dir_perms_var_log_httpd" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="httpd not present or in use" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criterion test_ref="oval:ssg-test_dir_perms_var_log_httpd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="1">
      <metadata>
        <title>Verify that All World-Writable Directories Have Sticky Bits Set</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The sticky bit should be set for all world-writable directories.</description>
      <reference ref_id="dir_perms_world_writable_sticky_bits" source="ssg"/></metadata>
      <criteria>
        <criterion comment="all local world writable directories have sticky bit set" test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_host_auth:def:1" version="2">
      <metadata>
        <title>Disable Host-Based Authentication</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>SSH host-based authentication should be disabled.</description>
      <reference ref_id="disable_host_auth" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check HostbasedAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_hostbasedauthentication:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_prelink:def:1" version="3">
      <metadata>
        <title>Disable Prelinking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>The prelinking feature can interfere with the operation of
      checksum integrity tools (e.g. AIDE), mitigates the protection provided
      by ASLR, and requires additional CPU cycles by software upgrades.
      </description>
      <reference ref_id="disable_prelink" source="ssg"/></metadata>
      <criteria operator="OR" comment="Conditions for prelinking disabled are satisfied">
        <!-- Part for testing RHEL-6 system -->
        <!-- On RHEL6 system the prelink RPM package is installed by default -->
        <criteria operator="AND" comment="System is RHEL6 with prelinking disabled">
          <extend_definition comment="Installed OS is RHEL6" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
          <criterion comment="Prelinking is disabled" test_ref="oval:ssg-test_prelinking_disabled:tst:1"/>
        </criteria>
        <!-- Part for testing RHEL-7 or Fedora system -->
        <!-- On RHEL7 and Fedora systems the prelink RPM package is *not* installed by default -->
        <criteria operator="AND" comment="System is RHEL7 or Fedora and prelink RPM is not installed or prelinking is disabled">
          <criteria operator="OR" comment="System is RHEL7 or Fedora">
            <extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <extend_definition comment="Installed OS is Fedora" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          </criteria>
          <criteria operator="OR" comment="prelink RPM package not installed or prelinking disabled">
            <extend_definition comment="prelink RPM package not installed" definition_ref="oval:ssg-package_prelink_removed:def:1"/>
            <criterion comment="Prelinking is disabled" test_ref="oval:ssg-test_prelinking_disabled:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_users_coredumps:def:1" version="1">
      <metadata>
        <title>Disable Core Dumps</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Core dumps for all users should be disabled</description>
      <reference ref_id="disable_users_coredumps" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Are core dumps disabled" test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1">
      <metadata>
        <title>Ensure Yum gpgcheck Globally Activated</title>
        <affected family="unix">
        </affected>
        <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
      <reference ref_id="ensure_gpgcheck_globally_activated" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="Fedora installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          <criterion comment="check value of gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1"/>
        </criteria>
        <criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1">
      <metadata>
        <title>Ensure gpgcheck Enabled For All Yum or Dnf Package Repositories</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>Ensure all yum or dnf repositories utilize signature checking.</description>
      <reference ref_id="ensure_gpgcheck_never_disabled" source="ssg"/></metadata>
      <criteria comment="ensure all yum or dnf repositories utilize signiature checking" operator="AND">
        <criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files" test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_logrotate_activated:def:1" version="1">
      <metadata>
        <title>Ensure the logrotate utility performs the automatic rotation of log files on daily basis</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </description>
      <reference ref_id="ensure_logrotate_activated" source="ssg"/></metadata>
      <criteria comment="/etc/logrotate.conf contains daily setting or /etc/cron.daily/logrotate file exists" operator="OR">
        <criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
        <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_redhat_gpgkey_installed:def:1" version="2">
      <metadata>
        <title>Red Hat Release and Auxiliary gpg-pubkey Packages Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The Red Hat release and auxiliary key packages are required to be installed.</description>
      <reference ref_id="ensure_redhat_gpgkey_installed" source="ssg"/></metadata>
      <criteria comment="Vendor GPG keys" operator="OR">
        <criteria comment="Red Hat Vendor Keys" operator="AND">
          <criteria comment="Red Hat Installed" operator="OR">
            <extend_definition comment="RHEL6 installed" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
            <extend_definition comment="RHEL7 installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
          </criteria>
          <criterion comment="package gpg-pubkey-fd431d51-4ae0493b is installed" test_ref="oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1"/>
          <criterion comment="package gpg-pubkey-2fa658e0-45700c69 is installed" test_ref="oval:ssg-test_package_gpgkey-2fa658e0-45700c69_installed:tst:1"/>
        </criteria>
        <criteria comment="CentOS Vendor Keys" operator="OR">
          <criteria comment="CentOS Installed" operator="OR">
            <extend_definition comment="CentOS6 installed" definition_ref="oval:ssg-installed_OS_is_centos6:def:1"/>
            <extend_definition comment="CentOS7 installed" definition_ref="oval:ssg-installed_OS_is_centos7:def:1"/>
          </criteria>
          <criterion comment="package gpg-pubkey-f4a80eb5-53a7ff4b is installed" test_ref="oval:ssg-test_package_gpgkey-f4a80eb5-53a7ff4b_installed:tst:1"/>
          <criterion comment="package gpg-pubkey-c105b9de-4e0fd3a3 is installed" test_ref="oval:ssg-test_package_gpgkey-c105b9de-4e0fd3a3_installed:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_etc_group:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/group file should be owned by the appropriate
      group.</description>
      <reference ref_id="file_groupowner_etc_group" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_groupowner_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/gshadow file should be owned by the appropriate
      group.</description>
      <reference ref_id="file_groupowner_etc_gshadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_groupowner_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'passwd' file</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/passwd file should be owned by the appropriate
      group.</description>
      <reference ref_id="file_groupowner_etc_passwd" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_groupowner_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_etc_group:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/group file should be owned by the appropriate
      user.</description>
      <reference ref_id="file_owner_etc_group" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_owner_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/gshadow file should be owned by the appropriate
      user.</description>
      <reference ref_id="file_owner_etc_gshadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_owner_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_etc_passwd:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'passwd' file</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/passwd file should be owned by the appropriate
      user.</description>
      <reference ref_id="file_owner_etc_passwd" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_owner_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_binary_dirs:def:1" version="2">
      <metadata>
        <title>Verify that System Executables Have Root Ownership</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </description>
      <reference ref_id="file_ownership_binary_dirs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
        <criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_library_dirs:def:1" version="1">
      <metadata>
        <title>Verify that Shared Library Files Have Root Ownership</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are owned by root.
      </description>
      <reference ref_id="file_ownership_library_dirs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_ownership_lib_dir:tst:1"/>
        <criterion test_ref="oval:ssg-test_ownership_lib_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_var_log_audit:def:1" version="3">
      <metadata>
        <title>Verify /var/log/audit Ownership</title>
        <affected family="unix">
        </affected>
        <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
      <reference ref_id="file_ownership_var_log_audit" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="directories are root owned">
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
        </criteria>
        <criteria operator="AND" comment="log_group in auditd.conf is not root">
          <extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_binary_dirs:def:1" version="2">
      <metadata>
        <title>Verify that System Executables Have Restrictive Permissions</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </description>
      <reference ref_id="file_permissions_binary_dirs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="2">
      <metadata>
        <title>Verify permissions on 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>File permissions for /etc/group should be set
      correctly.</description>
      <reference ref_id="file_permissions_etc_group" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/gshadow Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_gshadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="2">
      <metadata>
        <title>Verify /etc/passwd Permissions</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644 (or stronger). If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_passwd" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/shadow Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>This test makes sure that /etc/shadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference ref_id="file_permissions_etc_shadow" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_shadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_home_dirs:def:1" version="1">
      <metadata>
        <title>Proper Permissions User Home Directories</title>
        <affected family="unix">
        </affected>
        <description>File permissions should be set correctly for the home directories for all user accounts.</description>
      <reference ref_id="file_permissions_home_dirs" source="ssg"/></metadata>
      <criteria>
        <criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_httpd_server_conf_files:def:1" version="2">
      <metadata>
        <title>Verify Permissions On Apache Web Server Configuration Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/httpd/conf/* files should have the appropriate permissions (0640 or stronger).</description>
      <reference ref_id="file_permissions_httpd_server_conf_files" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="httpd not present or in use" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criterion test_ref="oval:ssg-test_file_permissions_httpd_server_conf_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_library_dirs:def:1" version="1">
      <metadata>
        <title>Verify that Shared Library Files Have Restrictive Permissions</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are not group-writable or world-writable.
      </description>
      <reference ref_id="file_permissions_library_dirs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_perms_lib_dir:tst:1"/>
        <criterion test_ref="oval:ssg-test_perms_lib_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1">
      <metadata>
        <title>Find Unauthorized World-Writable Files</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The world-write permission should be disabled for all files.</description>
      <reference ref_id="file_permissions_unauthorized_world_writable" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_ungroupowned:def:1" version="2">
      <metadata>
        <title>Find files unowned by a group</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
        </affected>
        <description>All files should be owned by a group</description>
      <reference ref_id="file_permissions_ungroupowned" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check all files and make sure they are owned by a group" test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_var_log_audit:def:1" version="2">
      <metadata>
        <title>Verify /var/log/audit Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks for correct permissions for all log files in /var/log/audit.</description>
      <reference ref_id="file_permissions_var_log_audit" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" negate="true"/>
        <criteria operator="AND" comment="log_group in auditd.conf is not root">
          <extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
          <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" negate="true"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_log_transactions:def:1" version="1">
      <metadata>
        <title>Banner for FTP Users</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>To trace malicious activity facilitated by the FTP 
      service, it must be configured to ensure that all commands sent to 
      the FTP server are logged using the verbose vsftpd log format.
      </description>
      <reference ref_id="ftp_log_transactions" source="ssg"/></metadata>
      <criteria comment="FTP is not being used or the conditions are met" operator="OR">
        <extend_definition comment="vsftp package is not installed" definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true"/>
        <criteria comment="FTP configuration conditions are not set or are met" operator="AND">
          <criterion comment="log ftp transactions enable" test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1"/>
          <criterion comment="log ftp transactions format" test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1"/>
          <criterion comment="log ftp transactions protocol" test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_present_banner:def:1" version="1">
      <metadata>
        <title>Banner for FTP Users</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>This setting will cause the system greeting banner to be 
      used for FTP connections as well.</description>
      <reference ref_id="ftp_present_banner" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="vsftpd package is not installed" negate="true" definition_ref="oval:ssg-package_vsftpd_installed:def:1"/>
        <criterion comment="Banner for FTP Users" test_ref="oval:ssg-test_ftp_present_banner:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gid_passwd_group_same:def:1" version="2">
      <metadata>
        <title>All GIDs Are Present In /etc/group</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</description>
      <reference ref_id="gid_passwd_group_same" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2">
      <metadata>
        <title>Disable GDM Automatic Login</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</description>
      <reference ref_id="gnome_gdm_disable_automatic_login" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="Disable GDM Automatic Login" test_ref="oval:ssg-test_disable_automatic_login:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gnome_gdm_disable_guest_login:def:1" version="2">
      <metadata>
        <title>Disable GDM Guest Login</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME Display Manager (GDM) ability to allow guest users
      to login.</description>
      <reference ref_id="gnome_gdm_disable_guest_login" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="Disable GDM Guest Login" test_ref="oval:ssg-test_disable_guest_login:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-groupowner_shadow_file:def:1" version="2">
      <metadata>
        <title>Verify group who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/shadow file should be owned by the appropriate
      group.</description>
      <reference ref_id="groupowner_shadow_file" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_groupowner_etc_shadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_antivirus:def:1" version="1">
      <metadata>
        <title>Package Antivirus Installed</title>
        <affected family="unix">
        </affected>
        <description>Antivirus software should be installed.</description>
      <reference ref_id="install_antivirus" source="ssg"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met">
        <extend_definition comment="McAfee A/V Installed" definition_ref="oval:ssg-install_mcafee_antivirus:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_antivirus:def:1" version="1">
      <metadata>
        <title>Package McAfeeVSEForLinux Installed</title>
        <affected family="unix">
        </affected>
        <description>McAfee Antivirus software should be installed.</description>
      <reference ref_id="install_mcafee_antivirus" source="ssg"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met" operator="AND">
        <extend_definition comment="McAfee Runtime Libraries and Agent" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <criterion comment="Linuxshield AntiVirus package is installed" test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_cma_rt:def:1" version="1">
      <metadata>
        <title>Install the McAfee Runtime Libraries and Linux Agent</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</description>
      <reference ref_id="install_mcafee_cma_rt" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="McAfee runtime library package installed" test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1"/>
        <criterion comment="McAfee management agent package installed" test_ref="oval:ssg-test_mcafee_management_agent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss:def:1" version="1">
      <metadata>
        <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
        <affected family="unix">
        </affected>
        <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</description>
      <reference ref_id="install_mcafee_hbss" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_hips:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1">
      <metadata>
        <title>Install the Asset Configuration Compliance Module (ACCM)</title>
        <affected family="unix">
        </affected>
        <description>Install the Asset Configuration Compliance Module (ACCM).</description>
      <reference ref_id="install_mcafee_hbss_accm" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee ACCM is installed" test_ref="oval:ssg-test_mcafee_accm_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_hips:def:1" version="1">
      <metadata>
        <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is
      absolutely necessary. If SELinux is enabled, do not install or enable this module.</description>
      <reference ref_id="install_mcafee_hbss_hips" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee IPS  is installed" test_ref="oval:ssg-test_mcafee_hbss_hips_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1">
      <metadata>
        <title>Install the Policy Auditor (PA) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the Policy Auditor (PA) Module.</description>
      <reference ref_id="install_mcafee_hbss_pa" source="ssg"/></metadata>
      <criteria>
        <criterion comment="McAfee Policy Auditor is installed" test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
      <metadata>
        <title>CentOS 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 6</description>
      <reference ref_id="installed_OS_is_centos6" source="ssg"/></metadata>
      <criteria>
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
      <metadata>
        <title>CentOS 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 7</description>
      <reference ref_id="installed_OS_is_centos7" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-installed_OS_is_certified:def:1" version="1">
      <metadata>
        <title>Vendor Certified Operating System</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The operating system installed on the system is
      a certified vendor operating system and meets government
      requirements/certifications such as FIPS, NIAP, etc.</description>
      <reference ref_id="installed_OS_is_certified" source="ssg"/></metadata>
      <criteria comment="Installed operating system is a certified operating system" operator="OR">
        <extend_definition comment="Installed OS is RHEL6" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
        <extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
      <metadata>
        <title>Installed operating system is Fedora</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:fedoraproject:fedora:22" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:23" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:24" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:25" source="CPE"/>
        <description>The operating system installed on the system is Fedora</description>
      <reference ref_id="installed_OS_is_fedora" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="fedora-release RPM package is installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
        <criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
      <metadata>
        <title>Installed operating system is part of the Unix family</title>
        <affected family="unix">
        </affected>
        <description>The operating system installed on the system is part of the Unix OS family</description>
      <reference ref_id="installed_OS_is_part_of_Unix_family" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel6:def:1" version="2">
      <metadata>
        <title>Red Hat Enterprise Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 6</description>
      <reference ref_id="installed_OS_is_rhel6" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 6 Workstation is installed" test_ref="oval:ssg-test_rhel_workstation:tst:1"/>
          <criterion comment="RHEL 6 Server is installed" test_ref="oval:ssg-test_rhel_server:tst:1"/>
          <criterion comment="RHEL 6 Compute Node is installed" test_ref="oval:ssg-test_rhel_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
      <metadata>
        <title>Red Hat Enterprise Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
      <reference ref_id="installed_OS_is_rhel7" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
          <criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
          <criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
      <metadata>
        <title>Scientific Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 6</description>
      <reference ref_id="installed_OS_is_sl6" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
      <metadata>
        <title>Scientific Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 7</description>
      <reference ref_id="installed_OS_is_sl7" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux:def:1" version="1">
      <metadata>
        <title>WRLinux</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
        <description>The operating system installed on the system is
      Wind River Linux</description>
      <reference ref_id="installed_OS_is_wrlinux" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux:tst:1"/>
        <criterion comment="WRLinux is installed" test_ref="oval:ssg-test_wrlinux:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-logwatch_configured_hostlimit:def:1" version="1">
      <metadata>
        <title>Ensure Logwatch HostLimit Configured</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Test if HostLimit line in logwatch.conf is set appropriately.</description>
      <reference ref_id="logwatch_configured_hostlimit" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Test value of HostLimit" test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-logwatch_configured_splithosts:def:1" version="1">
      <metadata>
        <title>Ensure Logwatch SplitHosts Configured</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Check if SplitHosts line in logwatch.conf is set appropriately.</description>
      <reference ref_id="logwatch_configured_splithosts" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Test value of SplitHosts" test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="1">
      <metadata>
        <title>Add nodev Option to /dev/shm</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Legitimate character and block devices should not exist
      within temporary directories like /dev/shm. The nodev mount option should
      be specified for /dev/shm.</description>
      <reference ref_id="mount_option_dev_shm_nodev" source="ssg"/></metadata>
      <criteria>
        <criterion comment="nodev on /dev/shm" test_ref="oval:ssg-test_nodev_dev_shm:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="1">
      <metadata>
        <title>Add noexec Option to /dev/shm</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>It can be dangerous to allow the execution of binaries from
      world-writable temporary storage directories such as /dev/shm. The noexec
      mount option prevents binaries from being executed out of
      /dev/shm.</description>
      <reference ref_id="mount_option_dev_shm_noexec" source="ssg"/></metadata>
      <criteria>
        <criterion comment="noexec on /dev/shm" test_ref="oval:ssg-test_noexec_dev_shm:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="1">
      <metadata>
        <title>Add nosuid Option to /dev/shm</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid mount option should be set for temporary storage
      partitions such as /dev/shm. The suid/sgid permissions should not be
      required in these world-writable directories.</description>
      <reference ref_id="mount_option_dev_shm_nosuid" source="ssg"/></metadata>
      <criteria>
        <criterion comment="nosuid on /dev/shm" test_ref="oval:ssg-test_nosuid_dev_shm:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1">
      <metadata>
        <title>Add nodev Option to Non-Root Local Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
      <reference ref_id="mount_option_nodev_nonroot_local_partitions" source="ssg"/></metadata>
      <criteria>
        <criterion comment="nodev on local filesystems" test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nodev_remote_filesystems:def:1" version="1">
      <metadata>
        <title>Mount Remote Filesystems with nodev</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nodev option should be enabled for all NFS mounts in /etc/fstab.</description>
      <reference ref_id="mount_option_nodev_remote_filesystems" source="ssg"/></metadata>
      <criteria operator="XOR">
        <!-- these tests are designed to be mutually exclusive; either no nfs mounts exist in /etc/fstab -->
        <!-- or all of the nfs mounts defined in /etc/fstab have the nodev mount option specified -->
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_no_nfs_defined_etc_fstab_nodev:tst:1"/>
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_nodev_etc_fstab:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="4">
      <metadata>
        <title>Add nodev Option to Removable Media Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
      <reference ref_id="mount_option_nodev_removable_partitions" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- First check if specified removable partition truly exists on the system. If not, don't check /etc/fstab & runtime configuration
           since there's no device to check against -->
        <extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
        <!-- Removable device exists. Check if it's CD/DVD drive. If so, verify that at least one from all of the possible its alternative
           names in /etc/fstab & runtime configuration are configured with 'nodev' option -->
        <criteria operator="AND">
          <extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
          <criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nodev_runtime_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in runtime configuration"/>
        </criteria>
        <!-- Removable device exists & isn't CD/DVD drive. Check the particular devices is configured with 'nodev' mount option in both
           /etc/fstab & runtime configuration -->
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nodev_runtime_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in runtime configuration"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="4">
      <metadata>
        <title>Add noexec Option to Removable Media Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The noexec mount option prevents the direct execution of
      binaries on the mounted filesystem. Users should not be allowed to
      execute binaries that exist on partitions mounted from removable media
      (such as a USB key). The noexec option prevents code from being executed
      directly from the media itself, and may therefore provide a line of
      defense against certain types of worms or malicious code.</description>
      <reference ref_id="mount_option_noexec_removable_partitions" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- First check if specified removable partition truly exists on the system. If not, don't check /etc/fstab & runtime configuration
           since there's no device to check against -->
        <extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
        <!-- Removable device exists. Check if it's CD/DVD drive. If so, verify that at least one from all of the possible its alternative
           names in /etc/fstab & runtime configuration are configured with 'noexec' option -->
        <criteria operator="AND">
          <extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
          <criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_noexec_runtime_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in runtime configuration"/>
        </criteria>
        <!-- Removable device exists & isn't CD/DVD drive. Check the particular devices is configured with 'noexec' mount option in both
           /etc/fstab & runtime configuration -->
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_noexec_runtime_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in runtime configuration"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nosuid_remote_filesystems:def:1" version="1">
      <metadata>
        <title>Mount Remote Filesystems with nosuid</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid option should be enabled for all NFS mounts in /etc/fstab.</description>
      <reference ref_id="mount_option_nosuid_remote_filesystems" source="ssg"/></metadata>
      <criteria operator="XOR">
        <!-- these tests are designed to be mutually exclusive; either no nfs mounts exist in /etc/fstab -->
        <!-- or all of the nfs mounts defined in /etc/fstab have the nosuid mount option specified -->
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_no_nfs_defined_etc_fstab_nosuid:tst:1"/>
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_nosuid_etc_fstab:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="4">
      <metadata>
        <title>Add nosuid Option to Removable Media Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid mount option prevents set-user-identifier (suid)
      and set-group-identifier (sgid) permissions from taking effect. These
      permissions allow users to execute binaries with the same permissions as
      the owner and group of the file respectively. Users should not be allowed
      to introduce suid and guid files into the system via partitions mounted
      from removeable media.</description>
      <reference ref_id="mount_option_nosuid_removable_partitions" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- First check if specified removable partition truly exists on the system. If not, don't check /etc/fstab & runtime configuration
           since there's no device to check against -->
        <extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
        <!-- Removable device exists. Check if it's CD/DVD drive. If so, verify that at least one from all of the possible its alternative
           names in /etc/fstab & runtime configuration are configured with 'nosuid' option -->
        <criteria operator="AND">
          <extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
          <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nosuid_runtime_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in runtime configuration"/>
        </criteria>
        <!-- Removable device exists & isn't CD/DVD drive. Check the particular devices is configured with 'nosuid' mount option in both
           /etc/fstab & runtime configuration -->
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nosuid_runtime_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in runtime configuration"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_smb_client_signing:def:1" version="1">
      <metadata>
        <title>Require Client SMB Packet Signing, if using
      mount.cifs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require packet signing of clients who mount
      Samba shares using the mount.cifs program (e.g., those who
      specify shares in /etc/fstab). To do so, ensure that signing
      options (either sec=krb5i or sec=ntlmv2i) are
      used.</description>
      <reference ref_id="mount_option_smb_client_signing" source="ssg"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="samba-common installed" definition_ref="oval:ssg-package_samba-common_installed:def:1"/>
          <criteria operator="OR">
            <criterion comment="check for no cifs in /etc/fstab" test_ref="oval:ssg-test_20340111:tst:1"/>
            <criterion comment="check for sec=krb5i or sec=ntlmv2i in /etc/fstab" test_ref="oval:ssg-test_20340112:tst:1"/>
          </criteria>
          <criteria operator="OR">
            <criterion comment="check for no cifs in /etc/mtab" test_ref="oval:ssg-test_20340113:tst:1"/>
            <criterion comment="check for sec=krb5i or sec=ntlmv2i in /etc/mtab" test_ref="oval:ssg-test_20340114:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_tmp_nodev:def:1" version="1">
      <metadata>
        <title>Add nodev Option to /tmp</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Legitimate character and block devices should not exist
      within temporary directories like /tmp. The nodev mount option should be
      specified for /tmp.</description>
      <reference ref_id="mount_option_tmp_nodev" source="ssg"/></metadata>
      <criteria>
        <criterion comment="nodev on /tmp" test_ref="oval:ssg-test_nodev_tmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_tmp_noexec:def:1" version="1">
      <metadata>
        <title>Add noexec Option to /tmp</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>It can be dangerous to allow the execution of binaries from
      world-writable temporary storage directories such as /tmp. The noexec
      mount option prevents binaries from being executed out of
      /tmp.</description>
      <reference ref_id="mount_option_tmp_noexec" source="ssg"/></metadata>
      <criteria>
        <criterion comment="noexec on /tmp" test_ref="oval:ssg-test_noexec_tmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_tmp_nosuid:def:1" version="1">
      <metadata>
        <title>Add nosuid Option to /tmp</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid mount option should be set for temporary storage
      partitions such as /tmp. The suid/sgid permissions should not be required
      in these world-writable directories.</description>
      <reference ref_id="mount_option_tmp_nosuid" source="ssg"/></metadata>
      <criteria>
        <criterion comment="nosuid on /tmp" test_ref="oval:ssg-test_nosuid_tmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_var_tmp_bind:def:1" version="1">
      <metadata>
        <title>Bind Mount /var/tmp To /tmp</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.</description>
      <reference ref_id="mount_option_var_tmp_bind" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Ensure /var/tmp is mounted" test_ref="oval:ssg-test_mount_option_var_tmp:tst:1"/>
        <criterion comment="Ensure /tmp is bind mounted" test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_disable_zeroconf:def:1" version="1">
      <metadata>
        <title>Disable Zeroconf Networking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable Zeroconf automatic route assignment in the
      169.254.0.0 subnet.</description>
      <reference ref_id="network_disable_zeroconf" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Look for NOZEROCONF=yes in /etc/sysconfig/network" test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_disable_rpc:def:1" version="1">
      <metadata>
        <title>Disable Support for RPC IPv6</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable ipv6 based rpc services</description>
      <reference ref_id="network_ipv6_disable_rpc" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Disable udp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1"/>
        <criterion comment="Disable tcp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_sniffer_disabled:def:1" version="1">
      <metadata>
        <title>Disable the network sniffer</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable the network sniffer</description>
      <reference ref_id="network_sniffer_disabled" source="ssg"/></metadata>
      <criteria>
        <criterion comment="promisc interfaces" test_ref="oval:ssg-test_promisc_interfaces:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_direct_root_logins:def:1" version="1">
      <metadata>
        <title>Direct root Logins Not Allowed</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</description>
      <reference ref_id="no_direct_root_logins" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_empty_passwords:def:1" version="1">
      <metadata>
        <title>No nullok Option in /etc/pam.d/system-auth</title>
        <affected family="unix">
        </affected>
        <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
      <reference ref_id="no_empty_passwords" source="ssg"/></metadata>
      <criteria>
        <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_files_unowned_by_user:def:1" version="1">
      <metadata>
        <title>Find files unowned by a user</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All files should be owned by a user</description>
      <reference ref_id="no_files_unowned_by_user" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check all files and make sure they are owned by a user" test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_insecure_locks_exports:def:1" version="1">
      <metadata>
        <title>Ensure insecure_locks is disabled</title>
        <affected family="unix">
        </affected>
        <description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</description>
      <reference ref_id="no_insecure_locks_exports" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check for insecure NFS locks in /etc/exports" test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_netrc_files:def:1" version="1">
      <metadata>
        <title>Verify No netrc Files Exist</title>
        <affected family="unix">
        </affected>
        <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
      <reference ref_id="no_netrc_files" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_rsh_trust_files:def:1" version="1">
      <metadata>
        <title>No Legacy .rhosts Or hosts.equiv Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>There should not be any .rhosts or hosts.equiv files on the system.</description>
      <reference ref_id="no_rsh_trust_files" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" negate="true"/>
        <criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" negate="true"/>
        <criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2">
      <metadata>
        <title>System Accounts Do Not Run a Shell</title>
        <affected family="unix">
        </affected>
        <description>The root account is the only system account that should have
      a login shell.</description>
      <reference ref_id="no_shelllogin_for_systemaccounts" source="ssg"/></metadata>
      <criteria operator="OR">
        <!-- If SYS_UID_MIN and SYS_UID_MAX is not defined in /etc/login.defs
           perform the check that all /etc/passwd entries having shell defined
           have UIDs outside the default <0, UID_MIN -1> range.
           If at least one UID with shell defined exists within that range,
           the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
          <criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
          <criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
        </criteria>
        <!-- If both SYS_UID_MIN and SYS_UID_MAX are defined in /etc/login.defs
           perform both checks:
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for reserved system accounts <0, SYS_UID_MIN> range,
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for dynamically allocated system accounts <SYS_UID_MIN, SYS_UID_MAX>
           If at least one UID with shell defined exists within some of the two
           ranges, the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true"/>
          <criterion comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true"/>
          <criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
          <criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_aide_installed:def:1" version="1">
      <metadata>
        <title>Package aide Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package aide should be installed.</description>
      <reference ref_id="package_aide_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package aide is installed" test_ref="oval:ssg-test_package_aide_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_audit_installed:def:1" version="1">
      <metadata>
        <title>Package audit Installed</title>
        <affected family="unix">
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package audit should be installed.</description>
      <reference ref_id="package_audit_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package audit is installed" test_ref="oval:ssg-test_package_audit_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_bind_removed:def:1" version="1">
      <metadata>
        <title>Package bind Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package bind should be removed.</description>
      <reference ref_id="package_bind_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package bind is removed" test_ref="oval:ssg-test_package_bind_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dhcp_removed:def:1" version="1">
      <metadata>
        <title>Package dhcp Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package dhcp should be removed.</description>
      <reference ref_id="package_dhcp_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package dhcp is removed" test_ref="oval:ssg-test_package_dhcp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dovecot_removed:def:1" version="1">
      <metadata>
        <title>Package dovecot Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package dovecot should be removed.</description>
      <reference ref_id="package_dovecot_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package dovecot is removed" test_ref="oval:ssg-test_package_dovecot_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dracut-fips_installed:def:1" version="1">
      <metadata>
        <title>Package dracut-fips Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package dracut-fips should be installed.</description>
      <reference ref_id="package_dracut-fips_installed" source="ssg"/></metadata>
      <criteria>
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <criterion comment="package dracut-fips is installed" test_ref="oval:ssg-test_package_dracut-fips_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_httpd_removed:def:1" version="1">
      <metadata>
        <title>Package httpd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package httpd should be removed.</description>
      <reference ref_id="package_httpd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package httpd is removed" test_ref="oval:ssg-test_package_httpd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_mcstrans_removed:def:1" version="1">
      <metadata>
        <title>Package mcstrans Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package mcstrans should be removed.</description>
      <reference ref_id="package_mcstrans_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package mcstrans is removed" test_ref="oval:ssg-test_package_mcstrans_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_net-snmp_removed:def:1" version="1">
      <metadata>
        <title>Package net-snmp Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package net-snmp should be removed.</description>
      <reference ref_id="package_net-snmp_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">
      <metadata>
        <title>Package ntp Installed</title>
        <affected family="unix">
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ntp should be installed.</description>
      <reference ref_id="package_ntp_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openldap-servers_removed:def:1" version="1">
      <metadata>
        <title>Package openldap-servers Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package openldap-servers should be removed.</description>
      <reference ref_id="package_openldap-servers_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package openldap-servers is removed" test_ref="oval:ssg-test_package_openldap-servers_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">
      <metadata>
        <title>Package openssh-server Removed</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package openssh-server should be removed.</description>
      <reference ref_id="package_openssh-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_prelink_removed:def:1" version="1">
      <metadata>
        <title>Package prelink Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package prelink should be removed.</description>
      <reference ref_id="package_prelink_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package prelink is removed" test_ref="oval:ssg-test_package_prelink_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsh-server_removed:def:1" version="1">
      <metadata>
        <title>Package rsh-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rsh-server should be removed.</description>
      <reference ref_id="package_rsh-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rsh-server is removed" test_ref="oval:ssg-test_package_rsh-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsh_removed:def:1" version="1">
      <metadata>
        <title>Package rsh Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rsh should be removed.</description>
      <reference ref_id="package_rsh_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rsh is removed" test_ref="oval:ssg-test_package_rsh_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">
      <metadata>
        <title>Package rsyslog Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rsyslog should be installed.</description>
      <reference ref_id="package_rsyslog_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_samba-common_installed:def:1" version="1">
      <metadata>
        <title>Package samba-common Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba-common should be installed.</description>
      <reference ref_id="package_samba-common_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package samba-common is installed" test_ref="oval:ssg-test_package_samba-common_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_samba-common_removed:def:1" version="1">
      <metadata>
        <title>Package samba-common Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba-common should be removed.</description>
      <reference ref_id="package_samba-common_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package samba-common is removed" test_ref="oval:ssg-test_package_samba-common_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_screen_installed:def:1" version="1">
      <metadata>
        <title>Package screen Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package screen should be installed.</description>
      <reference ref_id="package_screen_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package screen is installed" test_ref="oval:ssg-test_package_screen_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_sendmail_removed:def:1" version="1">
      <metadata>
        <title>Package sendmail Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package sendmail should be removed.</description>
      <reference ref_id="package_sendmail_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package sendmail is removed" test_ref="oval:ssg-test_package_sendmail_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_setroubleshoot_removed:def:1" version="1">
      <metadata>
        <title>Package setroubleshoot Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package setroubleshoot should be removed.</description>
      <reference ref_id="package_setroubleshoot_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package setroubleshoot is removed" test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_squid_removed:def:1" version="1">
      <metadata>
        <title>Package squid Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package squid should be removed.</description>
      <reference ref_id="package_squid_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package squid is removed" test_ref="oval:ssg-test_package_squid_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_talk-server_removed:def:1" version="2">
      <metadata>
        <title>Package talk-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package talk-server should be removed.</description>
      <reference ref_id="package_talk-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package talk-server is removed" test_ref="oval:ssg-test_package_talk-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_talk_removed:def:1" version="2">
      <metadata>
        <title>Package talk Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package talk should be removed.</description>
      <reference ref_id="package_talk_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package talk is removed" test_ref="oval:ssg-test_package_talk_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnet-server_removed:def:1" version="1">
      <metadata>
        <title>Package telnet-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package telnet-server should be removed.</description>
      <reference ref_id="package_telnet-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package telnet-server is removed" test_ref="oval:ssg-test_package_telnet-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnet_removed:def:1" version="1">
      <metadata>
        <title>Package telnet Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package telnet should be removed.</description>
      <reference ref_id="package_telnet_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package telnet is removed" test_ref="oval:ssg-test_package_telnet_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_tftp-server_removed:def:1" version="1">
      <metadata>
        <title>Package tftp-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package tftp-server should be removed.</description>
      <reference ref_id="package_tftp-server_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package tftp-server is removed" test_ref="oval:ssg-test_package_tftp-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_tftp_removed:def:1" version="1">
      <metadata>
        <title>Package tftp Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package tftp should be removed.</description>
      <reference ref_id="package_tftp_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package tftp is removed" test_ref="oval:ssg-test_package_tftp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_vsftpd_installed:def:1" version="1">
      <metadata>
        <title>Package vsftpd Installed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package vsftpd should be installed.</description>
      <reference ref_id="package_vsftpd_installed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package vsftpd is installed" test_ref="oval:ssg-test_package_vsftpd_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_vsftpd_removed:def:1" version="1">
      <metadata>
        <title>Package vsftpd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package vsftpd should be removed.</description>
      <reference ref_id="package_vsftpd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package vsftpd is removed" test_ref="oval:ssg-test_package_vsftpd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_xinetd_removed:def:1" version="1">
      <metadata>
        <title>Package xinetd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package xinetd should be removed.</description>
      <reference ref_id="package_xinetd_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package xinetd is removed" test_ref="oval:ssg-test_package_xinetd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ypbind_removed:def:1" version="1">
      <metadata>
        <title>Package ypbind Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ypbind should be removed.</description>
      <reference ref_id="package_ypbind_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ypbind is removed" test_ref="oval:ssg-test_package_ypbind_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ypserv_removed:def:1" version="1">
      <metadata>
        <title>Package ypserv Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ypserv should be removed.</description>
      <reference ref_id="package_ypserv_removed" source="ssg"/></metadata>
      <criteria>
        <criterion comment="package ypserv is removed" test_ref="oval:ssg-test_package_ypserv_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">
      <metadata>
        <title>Ensure /home Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>If user home directories will be stored locally, create a
      separate partition for /home. If /home will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
      <reference ref_id="partition_for_home" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_home_partition:tst:1" comment="/home on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">
      <metadata>
        <title>Ensure /tmp Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /tmp directory is a world-writable directory used for
      temporary file storage. Verify that it has its own partition or logical
      volume.</description>
      <reference ref_id="partition_for_tmp" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_tmp_partition:tst:1" comment="/tmp on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">
      <metadata>
        <title>Ensure /var Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Ensuring that /var is mounted on its own partition enables
      the setting of more restrictive mount options, which is used as temporary
      storage by many program, particularly system services such as daemons. It
      is not uncommon for the /var directory to contain world-writable
      directories, installed by other software packages.</description>
      <reference ref_id="partition_for_var" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_partition:tst:1" comment="/var on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">
      <metadata>
        <title>Ensure /var/log Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>System logs are stored in the /var/log directory. Ensure
      that it has its own partition or logical volume.</description>
      <reference ref_id="partition_for_var_log" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_partition:tst:1" comment="/var/log on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">
      <metadata>
        <title>Ensure /var/log/audit Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit logs are stored in the /var/log/audit directory.
      Ensure that it has its own partition or logical volume. Make absolutely
      certain that it is large enough to store all audit logs that will be
      created by the auditing daemon.</description>
      <reference ref_id="partition_for_var_log_audit" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-postfix_server_banner:def:1" version="1">
      <metadata>
        <title>Configure Postfix Against Unnecessary Release of Information</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Protect against unnecessary release of information.</description>
      <reference ref_id="postfix_server_banner" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="Limit release of information" test_ref="oval:ssg-test_postfix_server_banner:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1">
      <metadata>
        <title>Device Files for Removable Media Partitions Does Not Exist on the System</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Verify if device file representing removable partitions
      exist on the system</description>
      <reference ref_id="removable_partition_doesnt_exist" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" comment="Check if removable partition really exists on the system"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-require_smb_client_signing:def:1" version="1">
      <metadata>
        <title>Require Client SMB Packet Signing in smb.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require samba clients which use smb.conf, such as smbclient,
      to use packet signing. A Samba client should only communicate with
      servers who can support SMB packet signing.</description>
      <reference ref_id="require_smb_client_signing" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="package samba-common is not installed" definition_ref="oval:ssg-package_samba-common_removed:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="samba-common installed" definition_ref="oval:ssg-package_samba-common_installed:def:1"/>
          <criterion comment="check for client signing = mandatory in /etc/samba/smb.conf" test_ref="oval:ssg-test_require_smb_client_signing:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-restrict_serial_port_logins:def:1" version="1">
      <metadata>
        <title>Restrict Serial Port Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
      <reference ref_id="restrict_serial_port_logins" source="ssg"/></metadata>
      <criteria>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-root_path_no_dot:def:1" version="2">
      <metadata>
        <title>Ensure that No Dangerous Directories Exist in Root's Path</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The environment variable PATH should be set correctly for
      the root user.</description>
      <reference ref_id="root_path_no_dot" source="ssg"/></metadata>
      <criteria comment="environment variable PATH contains dangerous path" operator="AND">
        <criterion comment="environment variable PATH starts with : or ." test_ref="oval:ssg-test_env_var_begins:tst:1"/>
        <criterion comment="environment variable PATH contains : twice in a row" test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1"/>
        <criterion comment="environment variable PATH contains . twice in a row" test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1"/>
        <criterion comment="environment variable PATH ends with : or ." test_ref="oval:ssg-test_env_var_ends:tst:1"/>
        <criterion comment="environment variable PATH doesn't begin with a /" test_ref="oval:ssg-test_env_var_begins_slash:tst:1"/>
        <criterion comment="environment variable PATH doesn't contain relative paths" test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rpm_verify_hashes:def:1" version="3">
      <metadata>
        <title>Verify File Hashes with RPM</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>Verify the RPM digests of system binaries using the RPM database.</description>
      <reference ref_id="rpm_verify_hashes" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" comment="verify file md5 hashes"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rpm_verify_permissions:def:1" version="3">
      <metadata>
        <title>Verify File Ownership And Permissions Using RPM</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Verify the integrity of installed packages
      by comparing the installed files with information about the
      files taken from the package metadata stored in the RPM
      database.</description>
      <reference ref_id="rpm_verify_permissions" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_verify_all_rpms_user_ownership:tst:1" comment="user ownership of all files matches local rpm database"/>
        <criterion test_ref="oval:ssg-test_verify_all_rpms_group_ownership:tst:1" comment="group ownership of all files matches local rpm database"/>
        <criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" comment="mode of all files matches local rpm database"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_nolisten:def:1" version="2">
      <metadata>
        <title>Disable Rsyslogd from Accepting Remote Messages on Loghosts
      Only</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>rsyslogd should reject remote messages</description>
      <reference ref_id="rsyslog_nolisten" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_rsyslog_nolisten:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_remote_loghost:def:1" version="1">
      <metadata>
        <title>Send Logs to a Remote Loghost</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Syslog logs should be sent to a remote loghost</description>
      <reference ref_id="rsyslog_remote_loghost" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
        <criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-securetty_root_login_console_only:def:1" version="1">
      <metadata>
        <title>Restrict Virtual Console Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
      <reference ref_id="securetty_root_login_console_only" source="ssg"/></metadata>
      <criteria>
        <criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1">
      <metadata>
        <title>Device Files Have Proper SELinux Context</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>All device files in /dev should be assigned an SELinux security context other than 'device_t'.</description>
      <reference ref_id="selinux_all_devicefiles_labeled" source="ssg"/></metadata>
      <criteria>
        <criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_all_devicefiles_labeled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1">
      <metadata>
        <title>Ensure No Daemons are Unconfined by SELinux</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Wind River Linux 8</platform>
        </affected>
        <description>All pids in /proc should be assigned an SELinux security context other than 'initrc_t'.</description>
      <reference ref_id="selinux_confinement_of_daemons" source="ssg"/></metadata>
      <criteria>
        <criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_policytype:def:1" version="1">
      <metadata>
        <title>Enable SELinux</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The SELinux policy should be set appropriately.</description>
      <reference ref_id="selinux_policytype" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_state:def:1" version="1">
      <metadata>
        <title>SELinux Enforcing</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The SELinux state should be enforcing the local policy.</description>
      <reference ref_id="selinux_state" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion comment="enforce is disabled" test_ref="oval:ssg-test_etc_selinux_config:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1">
      <metadata>
        <title>Set SHA512 Password Hashing Algorithm in /etc/libuser.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</description>
      <reference ref_id="set_password_hashing_algorithm_libuserconf" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2">
      <metadata>
        <title>Set SHA512 Password Hashing Algorithm in /etc/login.defs</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description>
      <reference ref_id="set_password_hashing_algorithm_logindefs" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="1">
      <metadata>
        <title>Set Password Hashing Algorithm in /etc/pam.d/system-auth</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</description>
      <reference ref_id="set_password_hashing_algorithm_systemauth" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_not_default_password:def:1" version="2">
      <metadata>
        <title>SNMP default communities disabled</title>
        <affected family="unix">
        </affected>
        <description>SNMP default communities must be removed.</description>
      <reference ref_id="snmpd_not_default_password" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP communities" test_ref="oval:ssg-test_snmp_default_communities:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2">
      <metadata>
        <title>SNMP use newer protocols</title>
        <affected family="unix">
        </affected>
        <description>SNMP version 1 and 2c must not be enabled.</description>
      <reference ref_id="snmpd_use_newer_protocol" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1">
      <metadata>
        <title>Ensure Only Protocol 2 Connections Allowed</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The OpenSSH daemon should be running protocol 2.</description>
      <reference ref_id="sshd_allow_only_protocol2" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1">
      <metadata>
        <title>Disable Empty Passwords</title>
        <affected family="unix">
        </affected>
        <description>Remote connections from accounts with empty passwords should
      be disabled (and dependencies are met)</description>
      <reference ref_id="sshd_disable_empty_passwords" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitEmptyPasswords in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitemptypasswords_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_rhosts:def:1" version="1">
      <metadata>
        <title>Disable .rhosts Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Emulation of the rsh command through the ssh server should
      be disabled (and dependencies are met)</description>
      <reference ref_id="sshd_disable_rhosts" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check IgnoreRhosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_rsh_emulation_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for Rhosts RSA Authentication</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</description>
      <reference ref_id="sshd_disable_rhosts_rsa" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_root_login:def:1" version="1">
      <metadata>
        <title>Disable root Login via SSH</title>
        <affected family="unix">
        </affected>
        <description>Root login via SSH should be disabled (and dependencies are
      met)</description>
      <reference ref_id="sshd_disable_root_login" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitrootlogin_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for User Known Hosts</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow system users host-based authentication
to connect to systems if a cache of the remote systems public keys are available.
This should be disabled.</description>
      <reference ref_id="sshd_disable_user_known_hosts" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check IgnoreUserKnownHosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1">
      <metadata>
        <title>Do Not Allow Users to Set Environment Options</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>PermitUserEnvironment should be disabled</description>
      <reference ref_id="sshd_do_not_permit_user_env" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitUserEnvironment in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_no_user_envset:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_enable_warning_banner:def:1" version="1">
      <metadata>
        <title>Enable a Warning Banner</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>SSH warning banner should be enabled (and dependencies are
      met)</description>
      <reference ref_id="sshd_enable_warning_banner" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check Banner in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_banner_set:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_idle_timeout:def:1" version="1">
      <metadata>
        <title>Set OpenSSH Idle Timeout Interval</title>
        <affected family="unix">
        </affected>
        <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
      <reference ref_id="sshd_set_idle_timeout" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_keepalive:def:1" version="1">
      <metadata>
        <title>Set ClientAliveCountMax for User Logins</title>
        <affected family="unix">
        </affected>
        <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
      <reference ref_id="sshd_set_keepalive" source="ssg"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_use_approved_ciphers:def:1" version="1">
      <metadata>
        <title>Use Only Approved Ciphers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Limit the ciphers to those which are FIPS-approved and only
      use ciphers in counter (CTR) mode.</description>
      <reference ref_id="sshd_use_approved_ciphers" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <criteria comment="SSH is not being used or conditions are met" operator="OR">
          <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
          <criterion comment="Check the Cipers list in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_approved_ciphers:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_use_approved_macs:def:1" version="1">
      <metadata>
        <title>Use Only FIPS MACs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</description>
      <reference ref_id="sshd_use_approved_macs" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <criteria comment="SSH is not being used or conditions are met" operator="OR">
          <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
          <criterion comment="Check MACs in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_approved_macs:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysconfig_networking_bootproto_ifcfg:def:1" version="2">
      <metadata>
        <title>Disable DHCP Client</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>DHCP configuration should be static for all
      interfaces.</description>
      <reference ref_id="sysconfig_networking_bootproto_ifcfg" source="ssg"/></metadata>
      <criteria comment="Test for BOOTPROTO=(static|none) across all interfaces">
        <criterion test_ref="oval:ssg-test_sysconfig_networking_bootproto_ifcfg:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_64bit:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for 64-bit Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for 64-bit architectures to be used by other tests</description>
      <reference ref_id="system_info_architecture_64bit" source="ssg"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
        <extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for PPC and PPCLE Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for PPC PPC64LE architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_ppc_64" source="ssg"/></metadata>
      <criteria operator="OR">
        <criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
        <criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86 architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_x86" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86_64 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86_64 architecture to be used by other tests</description>
      <reference ref_id="system_info_architecture_x86_64" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-tftpd_uses_secure_mode:def:1" version="1">
      <metadata>
        <title>TFTP Daemon Uses Secure Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The TFTP daemon should use secure mode.</description>
      <reference ref_id="tftpd_uses_secure_mode" source="ssg"/></metadata>
      <criteria comment="package tftp-server removed or /etc/xinetd.d/tftp configured correctly" operator="OR">
        <extend_definition comment="rpm package tftp-server removed" definition_ref="oval:ssg-package_tftp-server_removed:def:1"/>
        <criterion comment="tftpd secure mode" test_ref="oval:ssg-test_tftpd_uses_secure_mode:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-umask_for_daemons:def:1" version="2">
      <metadata>
        <title>Set Daemon umask</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The daemon umask should be set as appropriate</description>
      <reference ref_id="umask_for_daemons" source="ssg"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-userowner_shadow_file:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/shadow file should be owned by the
      appropriate user.</description>
      <reference ref_id="userowner_shadow_file" source="ssg"/></metadata>
      <criteria>
        <criterion comment="Check file ownership of /etc/shadow" test_ref="oval:ssg-test_userowner_shadow_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1">
      <metadata>
        <title>Value of 'var_accounts_user_umask' variable represented as octal number</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Value of 'var_accounts_user_umask' variable represented as octal number</description>
      <reference ref_id="var_accounts_user_umask_as_number" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1">
      <metadata>
        <title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</description>
      <reference ref_id="var_removable_partition_is_cd_dvd_drive" source="ssg"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" comment="Check if removable partition value represents CD/DVD drive"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1">
      <metadata>
        <title>Value of 'var_umask_for_daemons' variable represented as octal number</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Value of 'var_umask_for_daemons' variable represented as octal number</description>
      <reference ref_id="var_umask_for_daemons_as_number" source="ssg"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-wireless_disable_interfaces:def:1" version="1">
      <metadata>
        <title>Deactivate Wireless Interfaces</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All wireless interfaces should be disabled.</description>
      <reference ref_id="wireless_disable_interfaces" source="ssg"/></metadata>
      <criteria>
        <criterion comment="query /proc/net/wireless" test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" comment="System log files are owned by root group">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" comment="System log files are owned by root">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" comment="Permissions of system log files are 0600">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_dcredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_dcredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_dcredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_difok:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_difok:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_difok:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_lcredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_lcredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_lcredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_maxrepeat:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_maxrepeat:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_maxrepeat:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_minclass:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_password_pam_cracklib_minclass:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_minclass:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth cracklib" id="oval:ssg-test_password_pam_minlen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_minlen:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_minlen:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_ocredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_ocredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_ocredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_retry:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_retry:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_retry:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_ucredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_ucredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_cracklib_ucredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification chmod x32" id="oval:ssg-test_audit_rules_dac_modification_chmod_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_chmod_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification chmod x64" id="oval:ssg-test_audit_rules_dac_modification_chmod_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_chmod_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification chown x32" id="oval:ssg-test_audit_rules_dac_modification_chown_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_chown_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification chown x64" id="oval:ssg-test_audit_rules_dac_modification_chown_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_chown_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchmod x32" id="oval:ssg-test_audit_rules_dac_modification_fchmod_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchmod_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchmod x64" id="oval:ssg-test_audit_rules_dac_modification_fchmod_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchmod_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchmodat x32" id="oval:ssg-test_audit_rules_dac_modification_fchmodat_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchmodat_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchmodat x64" id="oval:ssg-test_audit_rules_dac_modification_fchmodat_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchmodat_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchown x32" id="oval:ssg-test_audit_rules_dac_modification_fchown_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchown_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchown x64" id="oval:ssg-test_audit_rules_dac_modification_fchown_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchown_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchownat x32" id="oval:ssg-test_audit_rules_dac_modification_fchownat_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchownat_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fchownat x64" id="oval:ssg-test_audit_rules_dac_modification_fchownat_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fchownat_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fremovexattr x32" id="oval:ssg-test_audit_rules_dac_modification_fremovexattr_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fremovexattr_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fremovexattr x64" id="oval:ssg-test_audit_rules_dac_modification_fremovexattr_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fremovexattr_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fsetxattr x32" id="oval:ssg-test_audit_rules_dac_modification_fsetxattr_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fsetxattr_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification fsetxattr x64" id="oval:ssg-test_audit_rules_dac_modification_fsetxattr_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_fsetxattr_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification lchown x32" id="oval:ssg-test_audit_rules_dac_modification_lchown_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_lchown_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification lchown x64" id="oval:ssg-test_audit_rules_dac_modification_lchown_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_lchown_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification lremovexattr x32" id="oval:ssg-test_audit_rules_dac_modification_lremovexattr_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_lremovexattr_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification lremovexattr x64" id="oval:ssg-test_audit_rules_dac_modification_lremovexattr_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_lremovexattr_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification lsetxattr x32" id="oval:ssg-test_audit_rules_dac_modification_lsetxattr_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_lsetxattr_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification lsetxattr x64" id="oval:ssg-test_audit_rules_dac_modification_lsetxattr_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_lsetxattr_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification removexattr x32" id="oval:ssg-test_audit_rules_dac_modification_removexattr_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_removexattr_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification removexattr x64" id="oval:ssg-test_audit_rules_dac_modification_removexattr_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_removexattr_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification setxattr x32" id="oval:ssg-test_audit_rules_dac_modification_setxattr_x32:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_setxattr_x32:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="dac modification setxattr x64" id="oval:ssg-test_audit_rules_dac_modification_setxattr_x64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_dac_modification_setxattr_x64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit file delete" id="oval:ssg-test_audit_rules_file_deletion_events:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_file_deletion_events:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="immutable" id="oval:ssg-test_audit_rules_immutable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_immutable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit insmod" id="oval:ssg-test_audit_rule_kernel_module_loading_insmod:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_insmod:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit rmmod" id="oval:ssg-test_audit_rule_kernel_module_loading_rmmod:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_rmmod:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit modprobe" id="oval:ssg-test_audit_rule_kernel_module_loading_modprobe:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_modprobe:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit module syscalls" id="oval:ssg-test_audit_rule_kernel_module_loading_syscall:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_syscall:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="tallylog" id="oval:ssg-test_audit_rules_login_events_tallylog:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_login_events_tallylog:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="faillock" id="oval:ssg-test_audit_rules_login_events_faillock:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_login_events_faillock:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="lastlog" id="oval:ssg-test_audit_rules_login_events_lastlog:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_login_events_lastlog:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit changes selinux" id="oval:ssg-test_audit_rules_mac_modification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_mac_modification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit mount" id="oval:ssg-test_audit_rules_media_export:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_media_export:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="network modification syscall" id="oval:ssg-test_audit_rules_networkconfig_modification_syscall:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_networkconfig_modification_syscall:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="/etc/issue modification" id="oval:ssg-test_audit_rules_networkconfig_modification_etc_issue:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_networkconfig_modification_etc_issue:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="/etc/issue.net modification" id="oval:ssg-test_audit_rules_networkconfig_modification_etc_issue_net:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_networkconfig_modification_etc_issue_net:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="/etc/hosts modification" id="oval:ssg-test_audit_rules_networkconfig_modification_etc_hosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_networkconfig_modification_etc_hosts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="/etc/sysconfig/network modification" id="oval:ssg-test_audit_rules_networkconfig_modification_etc_sysconfig_network:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_networkconfig_modification_etc_sysconfig_network:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands:tst:1" check="all" check_existence="all_exist" comment="/etc/audit/audit.rules contains -a always,exit   -F path=path_to_binary -F perm=x -F auid&gt;=500 -F auid!=4294967295   -k privileged for each setuid or setgid binary on the system" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands:obj:1"/>
      <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_sets_dimension_match:tst:1" check="all" check_existence="all_exist" comment="check if count of found privileged commands on the system is equal   to count of audit.rules privileged commands definitions" version="1">
      <ind:object object_ref="oval:ssg-object_dimension_of_object_system_privileged_commands:obj:1"/>
      <ind:state state_ref="oval:ssg-state_set_dimension_match:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" comment="utmp" id="oval:ssg-test_audit_rules_session_events_utmp:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_session_events_utmp:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="btmp" id="oval:ssg-test_audit_rules_session_events_btmp:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_session_events_btmp:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="wtmp" id="oval:ssg-test_audit_rules_session_events_wtmp:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_session_events_wtmp:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S adjtime and key" id="oval:ssg-test_audit_rules_time_adjtimex_x86:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_adjtimex_x86:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 64bit -S adjtime and key" id="oval:ssg-test_audit_rules_time_adjtimex_x86_64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_adjtimex_x86_64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S clock_settime and key" id="oval:ssg-test_audit_rules_time_clock_settime_x86:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_clock_settime_x86:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 64bit -S clock_settime and key" id="oval:ssg-test_audit_rules_time_clock_settime_x86_64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_clock_settime_x86_64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S settimeofday and key" id="oval:ssg-test_audit_rules_time_settimeofday_x86:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_settimeofday_x86:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 64bit -S settimeofday and key" id="oval:ssg-test_audit_rules_time_settimeofday_x86_64:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_settimeofday_x86_64:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S stime and key" id="oval:ssg-test_audit_rules_time_stime_x86:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_stime_x86:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the for presence etc localtime file in the rules file" id="oval:ssg-test_audit_rules_time_watch_localtime:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_audit_rules_time_watch_localtime:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="32-bit audit file eacces" id="oval:ssg-test_32bit_audit_rules_unsuccessful_file_modification_eacces:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_audit_rules_unsuccessful_file_modification_eacces:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="32-bit audit file eperm" id="oval:ssg-test_32bit_audit_rules_unsuccessful_file_modification_eperm:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_audit_rules_unsuccessful_file_modification_eperm:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="64-bit audit file eacces" id="oval:ssg-test_64bit_audit_rules_unsuccessful_file_modification_eacces:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_audit_rules_unsuccessful_file_modification_eacces:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="64-bit audit file eperm" id="oval:ssg-test_64bit_audit_rules_unsuccessful_file_modification_eperm:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_audit_rules_unsuccessful_file_modification_eperm:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi TTL setting" id="oval:ssg-test_avahi_ttl_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_ttl_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi disable publishing" id="oval:ssg-test_avahi_disable_publishing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_disable_publishing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi IPv4 setting" id="oval:ssg-test_avahi_ipv4_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_ipv4_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi IPv6 setting" id="oval:ssg-test_avahi_ipv6_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_ipv6_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent Avahi Port Sharing" id="oval:ssg-test_avahi_port_sharing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_port_sharing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi Restrict User Publishing" id="oval:ssg-test_avahi_restrict_user_publishing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_restrict_user_publishing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi Restrict Address Publishing" id="oval:ssg-test_avahi_restrict_address_publishing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_restrict_address_publishing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi Restrict HW Publishing" id="oval:ssg-test_avahi_restrict_CPU_publishing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_restrict_CPU_publishing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi Restrict Workstation Publishing" id="oval:ssg-test_avahi_restrict_workstation_publishing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_restrict_workstation_publishing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Avahi Restrict Domain Publishing" id="oval:ssg-test_avahi_restrict_domain_publishing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_avahi_restrict_domain_publishing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_bootloader_audit_argument:tst:1" comment="check for audit=1 in /etc/grub.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_audit_argument:obj:1"/>
      <ind:state state_ref="oval:ssg-state_bootloader_audit_argument:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_bootloader_nousb_argument:tst:1" comment="look for argument 'nousb' in the kernel line in /etc/grub.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_nousb_argument:obj:1"/>
      <ind:state state_ref="oval:ssg-state_bootloader_nousb_argument:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /etc/grub.conf" id="oval:ssg-test_bootloader_password:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_password:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the domain-name settings" id="oval:ssg-test_dhcp_client_domain-named:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_domain-named:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the domain-name-servers settings" id="oval:ssg-test_dhcp_client_domain-name-servers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_domain-name-servers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the clients nis-domain settings" id="oval:ssg-test_dhcp_client_nis-domain:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_nis-domain:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the client nis-servers settings" id="oval:ssg-test_dhcp_client_nis-servers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_nis-servers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the client ntp-servers settings" id="oval:ssg-test_dhcp_client_ntp-servers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_ntp-servers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the client routers settings" id="oval:ssg-test_dhcp_client_routers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_routers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the client time-offset settings" id="oval:ssg-test_dhcp_client_time-offset:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_time-offset:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the client subnet-mask settings" id="oval:ssg-test_dhcp_client_subnet-mask:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_subnet-mask:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Checks the client broadcast-address settings" id="oval:ssg-test_dhcp_client_broadcast-address:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_client_broadcast-address:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that rsyslog is logging dhcp" id="oval:ssg-test_dhcp_server_configure_logging:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_server_configure_logging:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that bootp is disabled" id="oval:ssg-test_dhcp_server_disable_bootp:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_server_disable_bootp:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that deny is set to declines" id="oval:ssg-test_dhcp_server_deny_declines:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_server_deny_declines:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that ddns-update-style is set to none" id="oval:ssg-test_dhcp_server_disable_ddns:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_server_disable_ddns:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that domain-name is not set" id="oval:ssg-test_dhcp_domain-named_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_domain-named_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that domain-name-servers is not set" id="oval:ssg-test_dhcp_domain-name-servers_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_domain-name-servers_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that nis-domain is not set" id="oval:ssg-test_dhcp_nis-domain_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_nis-domain_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that nis-servers is not set" id="oval:ssg-test_dhcp_nis-servers_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_nis-servers_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that ntp-servers is not set" id="oval:ssg-test_dhcp_ntp-servers_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_ntp-servers_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that routers is not set" id="oval:ssg-test_dhcp_routers_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_routers_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests that time-offset is not set" id="oval:ssg-test_dhcp_time-offset_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dhcp_time-offset_info:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" comment="check for local directories that are world writable and have uid greater than or equal to 500" id="oval:ssg-test_dir_world_writable_uid_gt_500:tst:1" version="1">
      <unix:object object_ref="oval:ssg-all_local_directories:obj:1"/>
      <unix:state state_ref="oval:ssg-state_gid_is_user_and_world_writable:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Disable Ctrl-Alt-Del key sequence" id="oval:ssg-test_disable_ctrlaltdel:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_disable_ctrlaltdel:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_test_disable_ctrlaltdel_exists:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that PROMPT=no in /etc/sysconfig/init" id="oval:ssg-test_interactive_boot_disabled_in_sysconfig_init:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_interactive_boot_disabled_in_sysconfig_init:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check the presence of 'confirm' kernel boot argument in /etc/grub.conf. Fail if found." id="oval:ssg-test_confirm_kernel_boot_argument_not_present:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_confirm_kernel_boot_argument_not_present:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_display_login_attempts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the disable_plaintext_auth[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/dovecot.conf file" id="oval:ssg-test_dovecot_disable_plaintext_auth:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dovecot_disable_plaintext_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ssl[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/dovecot.conf file" id="oval:ssg-test_dovecot_enable_ssl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dovecot_enable_ssl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub.conf, fail if found" id="oval:ssg-test_selinux_grub:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_selinux_grub:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub/grub.conf owned by root" id="oval:ssg-test_file_group_owner_grub_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_group_owner_grub_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_group_owner_grub_conf:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="oval:ssg-test_file_group_owner_efi_grub_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_group_owner_efi_grub_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_group_owner_grub_conf:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing file permissions" id="oval:ssg-test_file_permissions_grub_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_grub_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_grub_conf:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="setgid files outside system RPMs" id="oval:ssg-check_setgid_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_sgid:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="setuid files outside system RPMs" id="oval:ssg-check_setuid_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_suid:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub/grub.conf owned by root" id="oval:ssg-test_file_user_owner_grub_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_user_owner_grub_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_user_owner_grub_conf:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="oval:ssg-test_file_user_owner_efi_grub_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_user_owner_efi_grub_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_user_owner_grub_conf:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Configure FTP firewall" id="oval:ssg-test_ftp_configure_firewall:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_configure_firewall:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable uploads" id="oval:ssg-test_ftp_disable_uploads:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ftp_disable_uploads:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable ftp user list" id="oval:ssg-test_ftp_user_list_enable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ftp_user_list_enable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set ftp user list file" id="oval:ssg-test_ftp_user_list_file:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ftp_user_list_file:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Use ftp user list" id="oval:ssg-test_ftp_user_list_deny:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ftp_user_list_deny:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable anonymous access" id="oval:ssg-test_ftp_restrict_to_anon:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ftp_restrict_to_anon:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:xmlfilecontent_test check="all" comment="checks for gconf-tree file" id="oval:ssg-test_tree_gconf_gdm_disable_user_list:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_gdm_disable_user_list_tree:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gdm_disable_user_list:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="checks for absent gconf-tree file" id="oval:ssg-test_no_tree_gconf_gdm_disable_user_list:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_gdm_disable_user_list_no_tree:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gdm_disable_user_list:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="stuff" id="oval:ssg-test_gconf_gdm_enable_warning_gui_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_banner_message_enable:obj:1"/>
      <ind:state state_ref="oval:ssg-state_banner_message_enable:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="checks for gconf-tree file" id="oval:ssg-test_tree_gconf_gdm_enable_warning_gui_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_banner_message_enable_tree:obj:1"/>
      <ind:state state_ref="oval:ssg-state_banner_message_enable:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="checks for absent gconf-tree file" id="oval:ssg-test_no_tree_gconf_gdm_enable_warning_gui_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_banner_message_enable_no_tree:obj:1"/>
      <ind:state state_ref="oval:ssg-state_banner_message_enable:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="test screensaver timeout period" id="oval:ssg-test_gconf_gdm_set_login_banner_text:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_gdm_set_login_banner_text:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gdm_set_login_banner_text:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="test screensaver timeout period" id="oval:ssg-test_no_tree_gconf_gdm_set_login_banner_text:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_tree_gconf_gdm_set_login_banner_text:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gdm_set_login_banner_text:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="test screensaver timeout period" id="oval:ssg-test_tree_gconf_gdm_set_login_banner_text:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_tree_gconf_gdm_set_login_banner_text:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gdm_set_login_banner_text:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="Disable automount in GNOME" id="oval:ssg-test_gconf_gnome_disable_automount:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gconf_gnome_disable_automount:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gnome_disable_automount:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="Disable automount in GNOME" id="oval:ssg-test_gconf_tree_gnome_disable_automount:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gconf_tree_gnome_disable_automount:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gnome_disable_automount:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="Disable autorun in GNOME" id="oval:ssg-test_gconf_gnome_disable_automount_autorun:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gconf_gnome_disable_automount_autorun:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gnome_disable_automount_autorun:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="Disable autorun in GNOME" id="oval:ssg-test_gconf_tree_gnome_disable_automount_autorun:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gconf_tree_gnome_disable_automount_autorun:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gnome_disable_automount_autorun:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="temperature is disabled" id="oval:ssg-test_disable_clock_temperature:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_disable_clock_temperature:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_clock_temperature:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="temperature is disabled" id="oval:ssg-test_gconf_tree_disable_clock_temperature:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_disable_clock_temperature:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_clock_temperature:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="weather is disabled" id="oval:ssg-test_disable_clock_weather:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_disable_clock_weather:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_clock_weather:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="weather is disabled" id="oval:ssg-test_gconf_tree_disable_clock_weather:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_disable_clock_weather:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_clock_weather:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="set Ctrl-Alt-Del key sequence to nothing" id="oval:ssg-test_gnome_disable_ctrlaltdel_reboot:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gnome_disable_ctrlaltdel_reboot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_disable_ctrlaltdel_reboot:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="set Ctrl-Alt-Del key sequence to nothing" id="oval:ssg-test_gconf_tree_gnome_disable_ctrlaltdel_reboot:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_gnome_disable_ctrlaltdel_reboot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_disable_ctrlaltdel_reboot:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="disable restart/shutdown buttons" id="oval:ssg-test_disable_restart_shutdown:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_disable_restart_shutdown:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_restart_shutdown:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="disable restart/shutdown buttons" id="oval:ssg-test_gconf_tree_disable_restart_shutdown:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_disable_restart_shutdown:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_restart_shutdown:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="Disable thumbnailers in GNOME" id="oval:ssg-test_gconf_gnome_disable_thumbnailers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gconf_gnome_disable_thumbnailers:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gnome_disable_thumbnailers:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="Disable thumbnailers in GNOME" id="oval:ssg-test_gconf_tree_gnome_disable_thumbnailers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gconf_tree_gnome_disable_thumbnailers:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gconf_gnome_disable_thumbnailers:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="wifi creation is disabled" id="oval:ssg-test_disable_wifi_create:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_disable_wifi_create:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_wifi_create:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="wifi creation is disabled" id="oval:ssg-test_gconf_tree_disable_wifi_create:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_disable_wifi_create:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_wifi_create:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="disable wifi disconnect" id="oval:ssg-test_disable_wifi_disconnect:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_disable_wifi_disconnect:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_wifi_disconnect:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="disable wifi disconnect" id="oval:ssg-test_gconf_tree_disable_wifi_disconnect:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_disable_wifi_disconnect:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_wifi_disconnect:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="wifi connection notification is disabled" id="oval:ssg-test_disable_wifi_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_disable_wifi_notification:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_wifi_notification:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="wifi connection notification is disabled" id="oval:ssg-test_gconf_tree_disable_wifi_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_disable_wifi_notification:obj:1"/>
      <ind:state state_ref="oval:ssg-state_disable_wifi_notification:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="gnome screensaver is activated on idle" id="oval:ssg-test_gnome_screensaver_idle_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gnome_screensaver_idle_activated:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_idle_activated:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="gnome screensaver is activated on idle" id="oval:ssg-test_gconf_tree_gnome_screensaver_idle_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_gnome_screensaver_idle_activated:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_idle_activated:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="oval:ssg-test_gnome_screensaver_idle_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gnome_screensaver_idle_delay:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_idle_delay:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="test screensaver timeout period" id="oval:ssg-test_gconf_tree_gnome_screensaver_idle_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_gnome_screensaver_idle_delay:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_idle_delay:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_screensaver_lock_enabled:obj:1"/>
      <ind:state state_ref="oval:ssg-state_screensaver_lock_enabled:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="screensaver lock is enabled" id="oval:ssg-test_gconf_tree_screensaver_lock_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_screensaver_lock_enabled:obj:1"/>
      <ind:state state_ref="oval:ssg-state_screensaver_lock_enabled:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="Force log off users" id="oval:ssg-test_gnome_screensaver_max_idle_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gnome_screensaver_max_idle_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_max_idle_action:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="Force log off users" id="oval:ssg-test_gconf_tree_gnome_screensaver_max_idle_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_gnome_screensaver_max_idle_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_max_idle_action:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="check value of max_idle_time in GCONF" id="oval:ssg-test_gnome_screensaver_max_idle_time:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gnome_screensaver_max_idle_time:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_max_idle_time:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="check value of max_idle_time in GCONF" id="oval:ssg-test_gconf_tree_gnome_screensaver_max_idle_time:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_gnome_screensaver_max_idle_time:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_max_idle_time:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="oval:ssg-test_gnome_screensaver_mode:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gnome_screensaver_mode:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_mode:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" comment="gnome screensaver set to blank screen" id="oval:ssg-test_gconf_tree_gnome_screensaver_mode:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_gconf_tree_gnome_screensaver_mode:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gnome_screensaver_mode:ste:1"/>
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test id="oval:ssg-test_grub_enable_fips_mode:tst:1" comment="check for fips=1 in /etc/grub.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_grub_enable_fips_mode:obj:1"/>
      <ind:state state_ref="oval:ssg-state_grub_enable_fips_mode:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for port 22 access over ipv4" id="oval:ssg-test_iptables_sshd_disabled_ipv4:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_iptables_sshd_disabled_ipv4:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for port 22 access over ipv6" id="oval:ssg-test_iptables_sshd_disabled_ipv6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_iptables_sshd_disabled_ipv6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernel_disable_entropy_contribution_for_solid_state_drives:tst:1" comment="Verify there doesn't exist SSD drive on system with 'add_random' set to '1'" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_kernel_disable_entropy_contribution_for_solid_state_drives:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" comment="kernel module freevxfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" comment="kernel module hfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" comment="kernel module hfsplus disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" comment="ipv6 disabled any modprobe conf file">
      <ind:object object_ref="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" comment="kernel module jffs2 disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" comment="kernel module rds disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_rds_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_disabled:tst:1" version="1" check="all" comment="kernel module sctp disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_modprobeconf:tst:1" version="1" check="all" comment="kernel module sctp disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" comment="kernel module tipc disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_tipc_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the value of the ssl start_tls setting in the /etc/pam_ldap.conf file" id="oval:ssg-test_ldap_client_start_tls_ssl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ldap_client_start_tls_ssl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the value of the tls_cacertdir setting in the /etc/pam_ldap.conf file" id="oval:ssg-test_ldap_client_tls_cacertdir:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ldap_client_tls_cacertdir:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the value of the tls_cacertfile setting in the /etc/pam_ldap.conf file" id="oval:ssg-test_ldap_client_tls_cacertfile:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ldap_client_tls_cacertfile:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Define default gateways" id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_default_gateway:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable privacy extensions on each interface" id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set static IPv6 address on each interface" id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_static_address:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-test_ntp_remote_server:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ntp_remote_server:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" comment="package GConf2 is installed">
      <linux:object object_ref="oval:ssg-obj_package_GConf2_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt_removed:tst:1" version="1" comment="package abrt is removed">
      <linux:object object_ref="oval:ssg-obj_package_abrt_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_at_removed:tst:1" version="1" comment="package at is removed">
      <linux:object object_ref="oval:ssg-obj_package_at_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_autofs_removed:tst:1" version="1" comment="package autofs is removed">
      <linux:object object_ref="oval:ssg-obj_package_autofs_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_avahi_installed:tst:1" version="1" comment="package avahi is installed">
      <linux:object object_ref="oval:ssg-obj_package_avahi_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_bluez_removed:tst:1" version="1" comment="package bluez is removed">
      <linux:object object_ref="oval:ssg-obj_package_bluez_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_cpuspeed_removed:tst:1" version="1" comment="package cpuspeed is removed">
      <linux:object object_ref="oval:ssg-obj_package_cpuspeed_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cronie_installed:tst:1" version="1" comment="package cronie is installed">
      <linux:object object_ref="oval:ssg-obj_package_cronie_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_cups_removed:tst:1" version="1" comment="package cups is removed">
      <linux:object object_ref="oval:ssg-obj_package_cups_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_cyrus-sasl_removed:tst:1" version="1" comment="package cyrus-sasl is removed">
      <linux:object object_ref="oval:ssg-obj_package_cyrus-sasl_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_dbus_removed:tst:1" version="1" comment="package dbus is removed">
      <linux:object object_ref="oval:ssg-obj_package_dbus_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_esc_installed:tst:1" version="1" comment="package esc is installed">
      <linux:object object_ref="oval:ssg-obj_package_esc_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_gdm_installed:tst:1" version="1" comment="package gdm is installed">
      <linux:object object_ref="oval:ssg-obj_package_gdm_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_hal_removed:tst:1" version="1" comment="package hal is removed">
      <linux:object object_ref="oval:ssg-obj_package_hal_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_iptables-ipv6_installed:tst:1" version="1" comment="package iptables-ipv6 is installed">
      <linux:object object_ref="oval:ssg-obj_package_iptables-ipv6_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_iptables_installed:tst:1" version="1" comment="package iptables is installed">
      <linux:object object_ref="oval:ssg-obj_package_iptables_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_iputils_removed:tst:1" version="1" comment="package iputils is removed">
      <linux:object object_ref="oval:ssg-obj_package_iputils_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_irqbalance_installed:tst:1" version="1" comment="package irqbalance is installed">
      <linux:object object_ref="oval:ssg-obj_package_irqbalance_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_kexec-tools_removed:tst:1" version="1" comment="package kexec-tools is removed">
      <linux:object object_ref="oval:ssg-obj_package_kexec-tools_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_libcgroup_removed:tst:1" version="1" comment="package libcgroup is removed">
      <linux:object object_ref="oval:ssg-obj_package_libcgroup_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_mdadm_removed:tst:1" version="1" comment="package mdadm is removed">
      <linux:object object_ref="oval:ssg-obj_package_mdadm_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
      <linux:object object_ref="oval:ssg-obj_package_nfs-utils_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" comment="package ntpdate is removed">
      <linux:object object_ref="oval:ssg-obj_package_ntpdate_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_oddjob_removed:tst:1" version="1" comment="package oddjob is removed">
      <linux:object object_ref="oval:ssg-obj_package_oddjob_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openswan_installed:tst:1" version="1" comment="package openswan is installed">
      <linux:object object_ref="oval:ssg-obj_package_openswan_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" comment="package pam_ldap is removed">
      <linux:object object_ref="oval:ssg-obj_package_pam_ldap_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_pam_pkcs11_installed:tst:1" version="1" comment="package pam_pkcs11 is installed">
      <linux:object object_ref="oval:ssg-obj_package_pam_pkcs11_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" comment="package pcsc-lite is installed">
      <linux:object object_ref="oval:ssg-obj_package_pcsc-lite_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" comment="package policycoreutils is installed">
      <linux:object object_ref="oval:ssg-obj_package_policycoreutils_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_portreserve_removed:tst:1" version="1" comment="package portreserve is removed">
      <linux:object object_ref="oval:ssg-obj_package_portreserve_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_postfix_installed:tst:1" version="1" comment="package postfix is installed">
      <linux:object object_ref="oval:ssg-obj_package_postfix_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_psacct_installed:tst:1" version="1" comment="package psacct is installed">
      <linux:object object_ref="oval:ssg-obj_package_psacct_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_qpid-cpp-server_removed:tst:1" version="1" comment="package qpid-cpp-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_qpid-cpp-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_quota_removed:tst:1" version="1" comment="package quota is removed">
      <linux:object object_ref="oval:ssg-obj_package_quota_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rhnsd_removed:tst:1" version="1" comment="package rhnsd is removed">
      <linux:object object_ref="oval:ssg-obj_package_rhnsd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rpcbind_removed:tst:1" version="1" comment="package rpcbind is removed">
      <linux:object object_ref="oval:ssg-obj_package_rpcbind_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_samba_removed:tst:1" version="1" comment="package samba is removed">
      <linux:object object_ref="oval:ssg-obj_package_samba_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_smartmontools_removed:tst:1" version="1" comment="package smartmontools is removed">
      <linux:object object_ref="oval:ssg-obj_package_smartmontools_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_subscription-manager_removed:tst:1" version="1" comment="package subscription-manager is removed">
      <linux:object object_ref="oval:ssg-obj_package_subscription-manager_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sysstat_removed:tst:1" version="1" comment="package sysstat is removed">
      <linux:object object_ref="oval:ssg-obj_package_sysstat_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" comment="package xorg-x11-server-common is removed">
      <linux:object object_ref="oval:ssg-obj_package_xorg-x11-server-common_removed:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test id="oval:ssg-test_postfix_network_listening_disabled:tst:1" check="all" check_existence="at_least_one_exists" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" version="1">
      <ind:object object_ref="oval:ssg-obj_postfix_network_listening_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that the SINGLE variable in the /etc/sysconfig/init file is set to /sbin/sulogin, to ensure that a password must be entered to access single user mode" id="oval:ssg-test_require_singleuser_auth:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_require_singleuser_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_abrtd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_abrtd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_abrtd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_acpid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_acpid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_acpid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_atd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_atd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_atd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_auditd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_auditd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_auditd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_autofs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_autofs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_autofs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_avahi-daemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_avahi-daemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_avahi-daemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_bluetooth:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_bluetooth:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_bluetooth_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_certmonger:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_certmonger:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_certmonger_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_cgconfig:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_cgconfig:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgconfig_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_cgred:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_cgred:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cgred_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_cpuspeed:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_cpuspeed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cpuspeed_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_crond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_crond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_crond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_cups:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_cups:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_cups_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_dhcpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_dhcpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dhcpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_dovecot:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_dovecot:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_dovecot_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_haldaemon:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_haldaemon:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_haldaemon_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_httpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_httpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_ip6tables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_ip6tables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ip6tables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_iptables:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_iptables:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_iptables_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_irqbalance:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_irqbalance:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_irqbalance_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_kdump:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_kdump:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_kdump_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_mdmonitor:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_mdmonitor:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_mdmonitor_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_messagebus:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_messagebus:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_messagebus_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_named:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_named:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_named_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_netconsole:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_netconsole:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netconsole_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_netfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_netfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_netfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_nfs:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_nfs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfs_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_nfslock:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_nfslock:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nfslock_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_ntpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_ntpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_ntpdate:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_ntpdate:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ntpdate_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_oddjobd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_oddjobd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_oddjobd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_pcscd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_pcscd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_pcscd_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_portreserve:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_portreserve:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_portreserve_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_postfix:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_postfix:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_postfix_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_psacct:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_psacct:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_psacct_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_qpidd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_qpidd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_qpidd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_quota_nld:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_quota_nld:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_quota_nld_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rdisc:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rdisc:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rdisc_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_restorecond:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_restorecond:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_restorecond_on:ste:1"/>
    </unix:runlevel_test>
    <ind:textfilecontent54_test check="all" comment="rexec disabled" id="oval:ssg-test_etc_xinetd_rexec_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_xinetd_rexec_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rhnsd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rhnsd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhnsd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rhsmcertd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rhsmcertd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rhsmcertd_off:ste:1"/>
    </unix:runlevel_test>
    <ind:textfilecontent54_test check="all" comment="rlogin disabled" id="oval:ssg-test_etc_xinetd_rlogin_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_xinetd_rlogin_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rpcbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rpcbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rpcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rpcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rpcidmapd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rpcidmapd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcidmapd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rpcsvcgssd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rpcsvcgssd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rpcsvcgssd_off:ste:1"/>
    </unix:runlevel_test>
    <ind:textfilecontent54_test check="all" comment="rsh disabled" id="oval:ssg-test_etc_xinetd_rsh_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_xinetd_rsh_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_rsyslog:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_rsyslog:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_rsyslog_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_saslauthd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_saslauthd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_saslauthd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_smartd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_smartd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smartd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_smb:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_smb:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_smb_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_snmpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_snmpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_snmpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_squid:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_squid:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_squid_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_sshd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_sshd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sshd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_sysstat:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_sysstat:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_sysstat_off:ste:1"/>
    </unix:runlevel_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Disable Telnet Service" id="oval:ssg-test_service_telnetd_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_service_telnetd_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_tftp:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_tftp:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_tftp_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_vsftpd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_vsftpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_vsftpd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_xinetd:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_xinetd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_xinetd_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_ypbind:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_ypbind:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_ypbind_off:ste:1"/>
    </unix:runlevel_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/ip6tables for line :INPUT DROP [0:0]" id="oval:ssg-test_ip6tables_input_drop:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ip6tables_input_drop:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/ip6tables for line :INPUT ACCEPT [0:0]" id="oval:ssg-test_ip6tables_input_accept:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ip6tables_input_accept:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/iptables for line :INPUT DROP [0:0]" id="oval:ssg-test_iptables_input_drop:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_iptables_input_drop:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/iptables for line :INPUT ACCEPT [0:0]" id="oval:ssg-test_iptables_input_accept:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_iptables_input_accept:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/iptables for line :FORWARD DROP [0:0]" id="oval:ssg-test_iptables_forward_drop:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_iptables_forward_drop:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/iptables for line :FORWARD ACCEPT [0:0]" id="oval:ssg-test_iptables_forward_accept:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_iptables_forward_accept:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test ocsp_on in /etc/pam_pkcs11/pkcs11.conf" version="1">
      <ind:object object_ref="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1"/>
      <ind:state state_ref="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is enabled in /etc/pam.d/system-auth file" version="1">
      <ind:object object_ref="oval:ssg-object_smart_card_enabled_system_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/system-auth file" version="1">
      <ind:object object_ref="oval:ssg-object_smart_card_required_system_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/smartcard-auth file" version="1">
      <ind:object object_ref="oval:ssg-object_smart_card_required_smartcard_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_fs_suid_dumpable:tst:1" check="all" check_existence="all_exist" comment="Check fs.suid_dumpable kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_fs_suid_dumpable:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_fs_suid_dumpable:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_kernel_dmesg_restrict:tst:1" check="all" check_existence="all_exist" comment="Check kernel.dmesg_restrict kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_kernel_dmesg_restrict:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_kernel_dmesg_restrict:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_kernel_exec_shield:tst:1" check="all" check_existence="all_exist" comment="Check kernel.exec-shield kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_kernel_exec_shield:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_kernel_exec_shield:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_kernel_randomize_va_space:tst:1" check="all" check_existence="all_exist" comment="Check kernel.randomize_va_space kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_kernel_randomize_va_space:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_kernel_randomize_va_space:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_all_accept_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.all.accept_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_all_accept_source_route:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.all.accept_source_route kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_all_log_martians:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.all.log_martians kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_all_log_martians:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_all_log_martians:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_all_rp_filter:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.all.rp_filter kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_all_rp_filter:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_all_rp_filter:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_all_secure_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.all.secure_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_all_send_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.all.send_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_all_send_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_all_send_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_default_accept_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.default.accept_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_default_accept_source_route:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.default.accept_source_route kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_default_rp_filter:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.default.rp_filter kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_default_rp_filter:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_default_rp_filter:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_default_secure_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.default.secure_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_conf_default_send_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.conf.default.send_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_conf_default_send_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_conf_default_send_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.icmp_echo_ignore_broadcasts kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.icmp_ignore_bogus_error_responses kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_ip_forward:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.ip_forward kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_ip_forward:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_ip_forward:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv4_tcp_syncookies:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv4.tcp_syncookies kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv4_tcp_syncookies:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv4_tcp_syncookies:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_all_accept_ra:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.all.accept_ra kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_all_accept_ra:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_all_accept_ra:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_all_accept_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.all.accept_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_all_accept_source_route:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.all.accept_source_route kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_all_forwarding:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.all.forwarding kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_all_forwarding:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_all_forwarding:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_default_accept_ra:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.default.accept_ra kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_default_accept_ra:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_default_accept_ra:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_default_accept_redirects:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.default.accept_redirects kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_net_ipv6_conf_default_accept_source_route:tst:1" check="all" check_existence="all_exist" comment="Check net.ipv6.conf.default.accept_source_route kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_fs_suid_dumpable:tst:1" check="all" check_existence="only_one_exists" comment="Check fs.suid_dumpable static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_fs_suid_dumpable:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_fs_suid_dumpable:tst:1" check="all" comment="Check fs.suid_dumpable static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_fs_suid_dumpable:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_fs_suid_dumpable_not_used:tst:1" check="all" check_existence="none_exist" comment="Check fs.suid_dumpable is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_fs_suid_dumpable object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_dmesg_restrict:tst:1" check="all" check_existence="only_one_exists" comment="Check kernel.dmesg_restrict static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_dmesg_restrict:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_kernel_dmesg_restrict:tst:1" check="all" comment="Check kernel.dmesg_restrict static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_kernel_dmesg_restrict:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_dmesg_restrict_not_used:tst:1" check="all" check_existence="none_exist" comment="Check kernel.dmesg_restrict is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_kernel_dmesg_restrict object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_exec_shield:tst:1" check="all" check_existence="only_one_exists" comment="Check kernel.exec-shield static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_exec_shield:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_exec_shield:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_kernel_exec_shield:tst:1" check="all" comment="Check kernel.exec-shield static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_kernel_exec_shield:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_exec_shield:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_exec_shield_not_used:tst:1" check="all" check_existence="none_exist" comment="Check kernel.exec-shield is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_kernel_exec_shield object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_exec_shield:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_randomize_va_space:tst:1" check="all" check_existence="only_one_exists" comment="Check kernel.randomize_va_space static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_randomize_va_space:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_kernel_randomize_va_space:tst:1" check="all" comment="Check kernel.randomize_va_space static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_kernel_randomize_va_space:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_randomize_va_space_not_used:tst:1" check="all" check_existence="none_exist" comment="Check kernel.randomize_va_space is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_kernel_randomize_va_space object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" check="all" comment="Check net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.all.accept_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_all_accept_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" check="all" comment="Check net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_accept_source_route_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.all.accept_source_route is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_all_accept_source_route object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_log_martians:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_log_martians:tst:1" check="all" comment="Check net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_log_martians_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.all.log_martians is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_all_log_martians object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_rp_filter:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_rp_filter:tst:1" check="all" comment="Check net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_rp_filter_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.all.rp_filter is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_all_rp_filter object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" check="all" comment="Check net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_secure_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.all.secure_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_all_secure_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_send_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_all_send_redirects:tst:1" check="all" comment="Check net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_all_send_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.all.send_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_all_send_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" check="all" comment="Check net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.default.accept_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_default_accept_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" check="all" comment="Check net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_accept_source_route_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.default.accept_source_route is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_default_accept_source_route object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_rp_filter:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_rp_filter:tst:1" check="all" comment="Check net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_rp_filter_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.default.rp_filter is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_default_rp_filter object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" check="all" comment="Check net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_secure_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.default.secure_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_default_secure_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_send_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_conf_default_send_redirects:tst:1" check="all" comment="Check net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_conf_default_send_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.conf.default.send_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_conf_default_send_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" check="all" comment="Check net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.icmp_echo_ignore_broadcasts is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" check="all" comment="Check net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.icmp_ignore_bogus_error_responses is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_ip_forward:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.ip_forward static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_ip_forward:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_ip_forward:tst:1" check="all" comment="Check net.ipv4.ip_forward static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_ip_forward:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_ip_forward_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.ip_forward is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_ip_forward object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_ip_forward:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_tcp_syncookies:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv4_tcp_syncookies:tst:1" check="all" comment="Check net.ipv4.tcp_syncookies static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv4_tcp_syncookies_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv4.tcp_syncookies is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv4_tcp_syncookies object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_ra:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_accept_ra:tst:1" check="all" comment="Check net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_accept_ra:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_ra_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.all.accept_ra is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_all_accept_ra object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_ra:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_accept_redirects:tst:1" check="all" comment="Check net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.all.accept_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_all_accept_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_source_route:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_accept_source_route:tst:1" check="all" comment="Check net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_accept_source_route_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.all.accept_source_route is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_all_accept_source_route object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_source_route:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_forwarding:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.all.forwarding static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_forwarding:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_all_forwarding:tst:1" check="all" comment="Check net.ipv6.conf.all.forwarding static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_forwarding:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_all_forwarding_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.all.forwarding is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_all_forwarding object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_all_forwarding:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_ra:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_default_accept_ra:tst:1" check="all" comment="Check net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_ra_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.default.accept_ra is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_default_accept_ra object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" check="all" comment="Check net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_redirects_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.default.accept_redirects is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_default_accept_redirects object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_source_route:tst:1" check="all" check_existence="only_one_exists" comment="Check net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_net_ipv6_conf_default_accept_source_route:tst:1" check="all" comment="Check net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_net_ipv6_conf_default_accept_source_route_not_used:tst:1" check="all" check_existence="none_exist" comment="Check net.ipv6.conf.default.accept_source_route is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_net_ipv6_conf_default_accept_source_route object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_source_route:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="default runlevel is 3" id="oval:ssg-test_etc_inittab_default_runlevel:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_inittab_default_runlevel:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
      <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user name entries in /etc/passwd" version="1">
      <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" id="oval:ssg-test_maxlogins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
      <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
      <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:password_test check="all" comment="password hashes are shadowed" id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
    </unix:password_test>
    <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check preauth maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check authfail maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check authfail maximum failed login attempts allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check preauth maximum failed login attempts allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="Check if there aren't directories in root's path having write permission set for group or other" id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile" id="oval:ssg-test_etc_profile_tmout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile.d/*.sh" id="oval:ssg-test_etc_profiled_tmout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_bashrc:tst:1" version="1" check="all" comment="Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_bashrc:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_bashrc:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1" version="1" check="all" comment="Test the retrieved /etc/csh.cshrc umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_csh_cshrc:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_csh_cshrc:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
    </ind:variable_test>
    <unix:file_test id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of new aide database file" version="1">
      <unix:object object_ref="oval:ssg-object_aide_build_new_database_absolute_path:obj:1"/>
    </unix:file_test>
    <unix:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of operational aide database file" version="1">
      <unix:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="oval:ssg-test_aide_crond_checking:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron.(daily|weekly|monthly)" id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="notify personnel when aide completes" id="oval:ssg-test_aide_scan_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_aide_scan_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="notify personnel when aide completes" id="oval:ssg-test_aide_var_cron_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_aide_var_cron_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="notify personnel when aide completes in cron.(daily|weekly|monthly)" id="oval:ssg-test_aide_crontabs_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_aide_crontabs_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_non_fips_hashes:tst:1" comment="Verify non-FIPS hashes are not configured in /etc/aide.conf" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_non_fips_hashes:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_use_fips_hashes:tst:1" comment="Verify FIPS hashes are configured in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_use_fips_hashes:obj:1"/>
      <ind:state state_ref="oval:ssg-state_aide_use_fips_hashes:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_acls:tst:1" comment="acl is set in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_verify_acls:obj:1"/>
      <ind:state state_ref="oval:ssg-state_aide_verify_acls:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_ext_attributes:tst:1" comment="xattrs is set in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_verify_ext_attributes:obj:1"/>
      <ind:state state_ref="oval:ssg-state_aide_verify_ext_attributes:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audispd syslog plugin activated" id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" check="all" check_existence="none_exist" comment="log_group = root" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="email account for actions" id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf" id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="max log file size" id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="correct banner in /etc/issue" id="oval:ssg-test_banner_etc_issue:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable Browsing" id="oval:ssg-test_cups_disable_browsing_browsing_off:tst:1" version="2">
      <ind:object object_ref="oval:ssg-obj_cups_disable_browsing_browsing_off:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Do not allow incoming printer information packets" id="oval:ssg-test_cups_disable_browsing_browseallow:tst:1" version="2">
      <ind:object object_ref="oval:ssg-obj_cups_disable_browsing_browseallow:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Disable the more general port directive" id="oval:ssg-test_cups_disable_printserver_disable_port:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_cups_disable_printserver_disable_port:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Listen only at the localhost level" id="oval:ssg-test_cups_disable_printserver_use_listen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_cups_disable_printserver_use_listen:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing directory permissions" id="oval:ssg-test_dir_perms_etc_httpd_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_dir_perms_etc_httpd_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_dir_perms_etc_httpd_conf:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing directory permissions" id="oval:ssg-test_dir_perms_var_log_httpd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_dir_perms_var_log_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_dir_perms_var_log_httpd:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="all local world-writable directories have sticky bit set" id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_only_local_directories:obj:1"/>
      <unix:state state_ref="oval:ssg-state_world_writable_and_not_sticky:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="sshd HostbasedAuthentication" id="oval:ssg-test_sshd_hostbasedauthentication:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_hostbasedauthentication:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests whether prelinking is disabled" id="oval:ssg-test_prelinking_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_prelinking_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
      <ind:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/yum.conf" id="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files" id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the presence of daily setting in /etc/logrotate.conf file" id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1" version="1" comment="Red Hat release key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-fd431d51-4ae0493b:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-2fa658e0-45700c69_installed:tst:1" version="1" comment="Red Hat auxiliary key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-2fa658e0-45700c69:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-f4a80eb5-53a7ff4b_installed:tst:1" version="1" comment="CentOS7 key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-f4a80eb5-53a7ff4b:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-c105b9de-4e0fd3a3_installed:tst:1" version="1" comment="CentOS6 key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-c105b9de-4e0fd3a3:ste:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership" id="oval:ssg-test_file_groupowner_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_groupowner_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_groupowner_etc_group:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_groupowner_etc_gshadow:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="oval:ssg-test_file_groupowner_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_groupowner_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_groupowner_etc_passwd:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="oval:ssg-test_file_owner_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_owner_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_owner_etc_group:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="oval:ssg-test_file_owner_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_owner_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_owner_etc_gshadow:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="oval:ssg-test_file_owner_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_owner_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_owner_etc_passwd:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="binary directories uid root" id="oval:ssg-test_ownership_binary_directories:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="binary files uid root" id="oval:ssg-test_ownership_binary_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library directories uid root" id="oval:ssg-test_ownership_lib_dir:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_lib_dir:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library files uid root" id="oval:ssg-test_ownership_lib_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_lib_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="binary files go-w" id="oval:ssg-test_perms_binary_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="oval:ssg-test_file_permissions_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_etc_group:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="oval:ssg-test_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_mode_0000:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/passwd mode and ownership" id="oval:ssg-test_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_mode_0644_or_stronger:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/shadow mode and ownership" id="oval:ssg-test_etc_shadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_shadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_mode_0000:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_home_dirs_wrong_perm:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/httpd/conf/* permissions" id="oval:ssg-test_file_permissions_httpd_server_conf_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_httpd_server_conf_files:obj:1"/>
      <unix:state state_ref="oval:ssg-state_wrong_file_permissions_httpd_server_conf_files:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library directories go-w" id="oval:ssg-test_perms_lib_dir:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_lib_dir:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library files go-w" id="oval:ssg-test_perms_lib_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_lib_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="world writable files" id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" comment="files with no group owner" check_existence="none_exist" id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1">
      <!-- OVAL 5.11 rc-2 within the effort to add oval-def:NotesType construct also to variables
         moved NotesType construct to the oval-common-schema:
         [1] https://github.com/OVALProject/Language/issues/6
         [2] https://github.com/OVALProject/Language/commit/c34abb871ee446d9fd9e50a8ccbc8a8e2af5db20
         But this change broke backward-compatibility as reported in:
         [3] https://github.com/OVALProject/Language/issues/237
         [4] http://making-security-measurable.1364806.n2.nabble.com/5-11-backwards-incompatibility-issue-Suspect-the-fix-for-issue-6-was-the-culprit-tp7586190.html
         Therefore as a temporary workaround to have both OVAL 5.10 and also OVAL 5.11 valid content,
         temporarily comment out the <notes> construct below till the issue [3] is fixed in OVAL 5.11.1
         version.
    <notes>
      <note>This will enumerate all files on local partitions</note>
    </notes> -->
      <unix:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0640" id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_var_log_audit_files-non_root:obj:1"/>
      <unix:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0600" id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_var_log_audit_files:obj:1"/>
      <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_enable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_format:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Banner for FTP Users" id="oval:ssg-test_ftp_present_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_present_banner:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" check="all" check_existence="all_exist" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group" version="1">
      <ind:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Automatic Login" id="oval:ssg-test_disable_automatic_login:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Guest Login" id="oval:ssg-test_disable_guest_login:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_guest_login:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership /etc/shadow" id="oval:ssg-test_groupowner_etc_shadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_groupowner_shadow_file:obj:1"/>
      <unix:state state_ref="oval:ssg-state_groupowner_shadow_file:ste:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" comment="AntiVirus package is installed">
      <linux:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" comment="Runtime Libraries package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" comment="Agent package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee ACCM installed" id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_hbss_hips_installed:tst:1" version="1" comment="McAfee IPS is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee Policy Auditor installed" id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="fedora-release RPM package is installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
      <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 6" id="oval:ssg-test_rhel_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 6" id="oval:ssg-test_rhel_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 6" id="oval:ssg-test_rhel_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_computenode:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_unix_wrlinux:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_wrlinux:ste:1"/>
    </ind:family_test>
    <unix:file_test check_existence="at_least_one_exists" version="1" id="oval:ssg-test_wrlinux:tst:1" check="all" comment="Test presence of /etc/wrlinux-release.">
      <unix:object object_ref="oval:ssg-obj_test_wrlinux:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logwatch_configured_hostlimit:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logwatch_configured_splithosts:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_dev_shm:tst:1" version="1" comment="nodev on /dev/shm">
      <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev:obj:1"/>
      <linux:state state_ref="oval:ssg-state_dev_shm_nodev:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_noexec_dev_shm:tst:1" version="1" comment="noexec on /dev/shm">
      <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec:obj:1"/>
      <linux:state state_ref="oval:ssg-state_dev_shm_noexec:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nosuid_dev_shm:tst:1" version="1" comment="nosuid on /dev/shm">
      <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid:obj:1"/>
      <linux:state state_ref="oval:ssg-state_dev_shm_nosuid:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" comment="nodev on local filesystems">
      <linux:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
      <linux:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="all nfs has nodev" id="oval:ssg-test_nfs_nodev_etc_fstab:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nfs_nodev_etc_fstab:obj:1"/>
      <ind:state state_ref="oval:ssg-state_remote_filesystem_nodev:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="no nfs" id="oval:ssg-test_no_nfs_defined_etc_fstab_nodev:tst:1" version="1">
      <!-- this test returns 'true' if /etc/fstab does not contain nfs/nfs4 mounts -->
      <ind:object object_ref="oval:ssg-object_no_nfs_defined_etc_fstab_nodev:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nodev_runtime_cd_dvd_drive:tst:1" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nodev_runtime_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nodev_runtime_not_cd_dvd_drive:tst:1" check="all" check_existence="all_exist" comment="'nodev' mount option used for removable partition in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nodev_runtime_not_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_noexec_runtime_cd_dvd_drive:tst:1" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_noexec_runtime_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_noexec_runtime_not_cd_dvd_drive:tst:1" check="all" check_existence="all_exist" comment="'noexec' mount option used for removable partition in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_noexec_runtime_not_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="all nfs has nosuid" id="oval:ssg-test_nfs_nosuid_etc_fstab:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nfs_nosuid_etc_fstab:obj:1"/>
      <ind:state state_ref="oval:ssg-state_remote_filesystem_nosuid:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="no nfs" id="oval:ssg-test_no_nfs_defined_etc_fstab_nosuid:tst:1" version="1">
      <!-- this test returns 'true' if /etc/fstab does not contain nfs/nfs4 mounts -->
      <ind:object object_ref="oval:ssg-object_no_nfs_defined_etc_fstab_nosuid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nosuid_runtime_cd_dvd_drive:tst:1" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nosuid_runtime_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nosuid_runtime_not_cd_dvd_drive:tst:1" check="all" check_existence="all_exist" comment="'nosuid' mount option used for removable partition in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nosuid_runtime_not_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for no cifs in /etc/fstab" id="oval:ssg-test_20340111:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340111:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for sec=krb5i or sec=ntlmv2i in /etc/fstab" id="oval:ssg-test_20340112:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340111:obj:1"/>
      <ind:state state_ref="oval:ssg-state_20340112:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for no cifs in /etc/mtab" id="oval:ssg-test_20340113:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340112:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for sec=krb5i or sec=ntlmv2i in /etc/mtab" id="oval:ssg-test_20340114:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340112:obj:1"/>
      <ind:state state_ref="oval:ssg-state_20340112:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_tmp:tst:1" version="1" comment="nodev on /tmp">
      <linux:object object_ref="oval:ssg-object_tmp_nodev_partition:obj:1"/>
      <linux:state state_ref="oval:ssg-state_tmp_nodev:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_noexec_tmp:tst:1" version="1" comment="noexec on /tmp">
      <linux:object object_ref="oval:ssg-object_tmp_noexec_partition:obj:1"/>
      <linux:state state_ref="oval:ssg-state_tmp_noexec:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nosuid_tmp:tst:1" version="1" comment="nosuid on /tmp">
      <linux:object object_ref="oval:ssg-object_tmp_nosuid_partition:obj:1"/>
      <linux:state state_ref="oval:ssg-state_tmp_nosuid:ste:1"/>
    </linux:partition_test>
    <linux:partition_test id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" comment="Ensure /var/tmp is mounted" check="all">
      <linux:object object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure bind mount option is on /var/tmp" id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_mount_option_var_tmp_bind:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check NOZEROCONF=yes in /etc/sysconfig/network" id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for udp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for tcp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:interface_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_promisc_interfaces:tst:1" version="1" comment="random">
      <unix:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
      <unix:state state_ref="oval:ssg-state_promisc:ste:1"/>
    </unix:interface_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/securetty file exists" id="oval:ssg-test_etc_securetty_exists:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="no entries in /etc/securetty" id="oval:ssg-test_no_direct_root_logins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="oval:ssg-test_no_empty_passwords:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="Check user ids on all files on the system" id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1">
      <unix:object object_ref="oval:ssg-file_permissions_unowned_object:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the insecure locks in /etc/exports" id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="oval:ssg-test_no_netrc_files_home:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts or .shosts in /root" id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts or .shosts in /home" id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for /etc/hosts.equiv or /etc/shosts.equiv" id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
    </unix:file_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_default_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_default_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="SYS_UID_MIN not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="SYS_UID_MAX not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_reserved_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_reserved_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1"/>
    </ind:variable_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_aide_installed:tst:1" version="1" comment="package aide is installed">
      <linux:object object_ref="oval:ssg-obj_package_aide_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audit_installed:tst:1" version="1" comment="package audit is installed">
      <linux:object object_ref="oval:ssg-obj_package_audit_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_bind_removed:tst:1" version="1" comment="package bind is removed">
      <linux:object object_ref="oval:ssg-obj_package_bind_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_dhcp_removed:tst:1" version="1" comment="package dhcp is removed">
      <linux:object object_ref="oval:ssg-obj_package_dhcp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_dovecot_removed:tst:1" version="1" comment="package dovecot is removed">
      <linux:object object_ref="oval:ssg-obj_package_dovecot_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dracut-fips_installed:tst:1" version="1" comment="package dracut-fips is installed">
      <linux:object object_ref="oval:ssg-obj_package_dracut-fips_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_httpd_removed:tst:1" version="1" comment="package httpd is removed">
      <linux:object object_ref="oval:ssg-obj_package_httpd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" comment="package mcstrans is removed">
      <linux:object object_ref="oval:ssg-obj_package_mcstrans_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" comment="package net-snmp is removed">
      <linux:object object_ref="oval:ssg-obj_package_net-snmp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
      <linux:object object_ref="oval:ssg-obj_package_ntp_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openldap-servers_removed:tst:1" version="1" comment="package openldap-servers is removed">
      <linux:object object_ref="oval:ssg-obj_package_openldap-servers_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_openssh-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_prelink_removed:tst:1" version="1" comment="package prelink is removed">
      <linux:object object_ref="oval:ssg-obj_package_prelink_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rsh-server_removed:tst:1" version="1" comment="package rsh-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_rsh-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rsh_removed:tst:1" version="1" comment="package rsh is removed">
      <linux:object object_ref="oval:ssg-obj_package_rsh_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
      <linux:object object_ref="oval:ssg-obj_package_rsyslog_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_samba-common_installed:tst:1" version="1" comment="package samba-common is installed">
      <linux:object object_ref="oval:ssg-obj_package_samba-common_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" comment="package samba-common is removed">
      <linux:object object_ref="oval:ssg-obj_package_samba-common_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_screen_installed:tst:1" version="1" comment="package screen is installed">
      <linux:object object_ref="oval:ssg-obj_package_screen_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" comment="package sendmail is removed">
      <linux:object object_ref="oval:ssg-obj_package_sendmail_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" comment="package setroubleshoot is removed">
      <linux:object object_ref="oval:ssg-obj_package_setroubleshoot_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_squid_removed:tst:1" version="1" comment="package squid is removed">
      <linux:object object_ref="oval:ssg-obj_package_squid_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_talk-server_removed:tst:1" version="1" comment="package talk-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_talk-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_talk_removed:tst:1" version="1" comment="package talk is removed">
      <linux:object object_ref="oval:ssg-obj_package_talk_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnet-server_removed:tst:1" version="1" comment="package telnet-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnet-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnet_removed:tst:1" version="1" comment="package telnet is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnet_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_tftp-server_removed:tst:1" version="1" comment="package tftp-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_tftp-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_tftp_removed:tst:1" version="1" comment="package tftp is removed">
      <linux:object object_ref="oval:ssg-obj_package_tftp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" comment="package vsftpd is installed">
      <linux:object object_ref="oval:ssg-obj_package_vsftpd_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" comment="package vsftpd is removed">
      <linux:object object_ref="oval:ssg-obj_package_vsftpd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_xinetd_removed:tst:1" version="1" comment="package xinetd is removed">
      <linux:object object_ref="oval:ssg-obj_package_xinetd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ypbind_removed:tst:1" version="1" comment="package ypbind is removed">
      <linux:object object_ref="oval:ssg-obj_package_ypbind_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ypserv_removed:tst:1" version="1" comment="package ypserv is removed">
      <linux:object object_ref="oval:ssg-obj_package_ypserv_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_home_partition:tst:1" version="1" comment="/home on own partition">
      <linux:object object_ref="oval:ssg-object_mount_home_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition:tst:1" version="1" comment="/tmp on own partition">
      <linux:object object_ref="oval:ssg-object_own_tmp_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition:tst:1" version="1" comment="/var on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition:tst:1" version="1" comment="/var/log on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition:tst:1" version="1" comment="check for /var/log/audit partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_audit_own_partition:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set banner" id="oval:ssg-test_postfix_server_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_postfix_server_banner:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" check="all" check_existence="none_exist" comment="Check if expected removable partitions truly exist on the system" version="1">
      <unix:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for client signing = mandatory in /etc/samba/smb.conf" id="oval:ssg-test_require_smb_client_signing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_require_smb_client_signing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with : or ." id="oval:ssg-test_env_var_begins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row" id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row" id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH ends with : or ." id="oval:ssg-test_env_var_ends:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with an absolute path /" id="oval:ssg-test_env_var_begins_slash:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains relative paths" id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
    </ind:environmentvariable58_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check="all" comment="verify file md5 hashes">
      <linux:object object_ref="oval:ssg-object_files_fail_md5_hash:obj:1"/>
    </linux:rpmverifyfile_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_user_ownership:tst:1" version="1" check="all" comment="user ownership of all files matches local rpm database">
      <linux:object object_ref="oval:ssg-object_files_fail_user_ownership:obj:1"/>
    </linux:rpmverifyfile_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_group_ownership:tst:1" version="1" check="all" comment="group ownership of all files matches local rpm database">
      <linux:object object_ref="oval:ssg-object_files_fail_group_ownership:obj:1"/>
    </linux:rpmverifyfile_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check="all" comment="mode of all files matches local rpm database">
      <linux:object object_ref="oval:ssg-object_files_fail_mode:obj:1"/>
    </linux:rpmverifyfile_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun" id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_rsyslog_nolisten:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="oval:ssg-test_selinux_all_devicefiles_labeled:tst:1" version="2">
      <linux:object object_ref="oval:ssg-object_selinux_all_devicefiles_labeled:obj:1"/>
      <linux:state state_ref="oval:ssg-state_selinux_all_devicefiles_labeled:ste:1"/>
    </linux:selinuxsecuritycontext_test>
    <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2">
      <linux:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
      <linux:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
    </linux:selinuxsecuritycontext_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" id="oval:ssg-test_selinux_policy:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
      <ind:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_etc_selinux_config:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_encrypt_method_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_encrypt_method_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-test_pam_unix_sha512:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_pam_unix_sha512:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_default_communities:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_versions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitEmptyPasswords[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitemptypasswords_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the IgnoreRhosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_rsh_emulation_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_rsh_emulation_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitRootLogin[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitrootlogin_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitrootlogin_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the IgnoreUserKnownHosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check value of PermitUserEnvironment in /etc/ssh/sshd_config" id="oval:ssg-test_sshd_no_user_envset:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_no_user_envset:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the Banner[\s]+/etc/issue setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_banner_set:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_banner_set:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_approved_ciphers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_use_approved_ciphers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of MACs setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_approved_macs:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_use_approved_macs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/network-scripts/ifcfg-.* file" id="oval:ssg-test_sysconfig_networking_bootproto_ifcfg:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sysconfig_networking_bootproto_ifcfg:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sysconfig_networking_bootproto_ifcfg:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="32 bit architecture" id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
    </unix:uname_test>
    <ind:textfilecontent54_test check="all" comment="tftpd secure mode" id="oval:ssg-test_tftpd_uses_secure_mode:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_tftpd_uses_secure_mode:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" comment="Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement">
      <ind:object object_ref="oval:ssg-obj_umask_for_daemons:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_umask_for_daemons:ste:1"/>
    </ind:variable_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/shadow" id="oval:ssg-test_userowner_shadow_file:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_etc_shadow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_etc_shadow_uid_root:ste:1"/>
    </unix:file_test>
    <ind:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" comment="Verify the existence of var_accounts_user_umask_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
      <ind:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" check="all" comment="Check if removable partition variable value represents CD/DVD drive" version="1">
      <ind:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" comment="Verify the existence of var_umask_for_daemons_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
      <ind:object object_ref="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="query /proc/net/wireless" id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_wireless_disable_interfaces:obj:1"/>
    </ind:textfilecontent54_test>
  </tests>
  <objects>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_dcredit:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*dcredit=(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_difok:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*difok=(\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_lcredit:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*lcredit=(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_maxrepeat:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*maxrepeat=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_password_pam_cracklib_minclass:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_minlen:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*minlen=(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_ocredit:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*ocredit=(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_retry:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*retry=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_ucredit:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*ucredit=(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_chmod_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the chmod syscall.  
         Assume user id's start above 500 and watch for any chmod by them
         Watch for chmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_chmod_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the chmod syscall.  
         Assume user id's start above 500 and watch for any chmod by them
         Watch for chmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_chown_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the chown syscall.  
         Assume user id's start above 500 and watch for chowns by them
         Watch for chowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_chown_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the chown syscall.  
         Assume user id's start above 500 and watch for chowns by them
         Watch for chowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchmod_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchmod syscall.  
         Assume user id's start above 500 and watch for fchmods by them
         Watch for fchmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchmod_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the fchmod syscall.  
         Assume user id's start above 500 and watch for fchmods by them
         Watch for fchmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchmodat_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchmodat syscall.  
         Assume user id's start above 500 and watch for fchmodats by them
         Watch for fchmodats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchmodat_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the fchmodat syscall.  
         Assume user id's start above 500 and watch for fchmodats by them
         Watch for fchmodats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchown_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchown syscall.  
         Assume user id's start above 500 and watch for fchowns by them
         Watch for fchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchown_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the fchown syscall.  
         Assume user id's start above 500 and watch for fchowns by them
         Watch for fchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchownat_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchownat syscall.  
         Assume user id's start above 500 and watch for fchownats by them
         Watch for fchownats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fchownat_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the fchownat syscall.  
         Assume user id's start above 500 and watch for fchownats by them
         Watch for fchownats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fremovexattr_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fremovexattr syscall.  
         Assume user id's start above 500 and watch for any fremovexattr by them
         Watch for fremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fremovexattr_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the fremovexattr syscall.  
         Assume user id's start above 500 and watch for any fremovexattr by them
         Watch for fremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fsetxattr_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fsetxattr syscall.  
         Assume user id's start above 500 and watch for any fsetxattr by them
         Watch for fsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_fsetxattr_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the fsetxattr syscall.  
         Assume user id's start above 500 and watch for any fsetxattr by them
         Watch for fsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_lchown_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lchown syscall.  
         Assume user id's start above 500 and watch for lchowns by them
         Watch for lchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_lchown_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the lchown syscall.  
         Assume user id's start above 500 and watch for lchowns by them
         Watch for lchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_lremovexattr_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lremovexattr syscall.  
         Assume user id's start above 500 and watch for any lremovexattr by them
         Watch for lremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_lremovexattr_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the lremovexattr syscall.  
         Assume user id's start above 500 and watch for any lremovexattr by them
         Watch for lremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_lsetxattr_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lsetxattr syscall.  
         Assume user id's start above 500 and watch for lsetxattr by them
         Watch for lsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_lsetxattr_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the lsetxattr syscall.  
         Assume user id's start above 500 and watch for lsetxattr by them
         Watch for lsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_removexattr_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the removexattr syscall.  
         Assume user id's start above 500 and watch for any removexattr by them
         Watch for removexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_removexattr_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the removexattr syscall.  
         Assume user id's start above 500 and watch for any removexattr by them
         Watch for removexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_setxattr_x32:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the setxattr syscall.  
         Assume user id's start above 500 and watch for setxattrs by them
         Watch for setxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_dac_modification_setxattr_x64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the setxattr syscall.  
         Assume user id's start above 500 and watch for setxattrs by them
         Watch for setxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_file_deletion_events:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+rmdir\s+\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_immutable:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_insmod:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/sbin/insmod[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_rmmod:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/sbin/rmmod[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_modprobe:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/sbin/modprobe[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_syscall:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+init_module\s+\-S\s+delete_module\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_login_events_tallylog:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/tallylog\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_login_events_faillock:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/run/faillock/\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_login_events_lastlog:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/lastlog\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_mac_modification:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_media_export:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+mount\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_networkconfig_modification_syscall:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_networkconfig_modification_etc_issue:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_networkconfig_modification_etc_issue_net:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_networkconfig_modification_etc_hosts:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_networkconfig_modification_etc_sysconfig_network:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_system_privileged_commands:obj:1" comment="system files with setuid or setgid permission set" version="1">
      <unix:behaviors recurse_file_system="local"/>
      <!-- Skip selected directories (like /dev, /proc, and /sys) when traversing
         filesystem hierarchy, since:
         * these directories don't contain executables, but
         * can contain lot of symbolic link entries, possibly leading this OVAL
         rule scan to return 'error' on systems with not enough memory. Fixes:
         https://github.com/OpenSCAP/scap-security-guide/issues/841 -->
      <unix:path operation="pattern match">\/(?:(?!dev|proc|sys).)+</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <!-- Select only those rows containing the expected rule form, but different paths,
         IOW allow the /etc/audit/audit.rules to contain also other definitions -->
      <ind:pattern operation="pattern match">^[\s]*(-a always,exit -F path=[^\n]+ -F perm=x -F auid&gt;=500 -F auid!=4294967295 -k privileged)[\s]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
      <!-- But exclude from the set of found instances those where the executable
         listed after the -F path= argument isn't from the list of setuid / setgid
         ones - we require all setuid / setgid binaries to have such rule. But if
         there's custom rule for non setuid / setgid binary, allow the test to pass
         also in this case -->
      <filter action="exclude">oval:ssg-state_proper_always_exit_rule_but_for_unprivileged_command:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_dimension_of_object_system_privileged_commands:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_dimension_of_object_system_privileged_commands:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_session_events_utmp:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_session_events_btmp:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_session_events_wtmp:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_adjtimex_x86:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_adjtimex_x86_64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_clock_settime_x86:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)time-change[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_clock_settime_x86_64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)time-change[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_settimeofday_x86:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_settimeofday_x86_64:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_stime_x86:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_audit_rules_time_watch_localtime:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_audit_rules_unsuccessful_file_modification_eacces:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b32\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EACCES\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_audit_rules_unsuccessful_file_modification_eperm:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b32\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EPERM\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_audit_rules_unsuccessful_file_modification_eacces:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b64\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EACCES\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_audit_rules_unsuccessful_file_modification_eperm:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b64\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EPERM\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi TTL setting" id="oval:ssg-object_avahi_ttl_setting:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*check\-response\-ttl=yes$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi disable publishing" id="oval:ssg-object_avahi_disable_publishing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*disable\-publishing=yes$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi IPv4 setting" id="oval:ssg-object_avahi_ipv4_setting:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*use\-ipv4=yes$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi IPv6 setting" id="oval:ssg-object_avahi_ipv6_setting:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*use\-ipv6=yes$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Prevent Avahi Port Sharing" id="oval:ssg-object_avahi_port_sharing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*disallow\-other\-stacks=yes$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi Restrict User Publishing" id="oval:ssg-object_avahi_restrict_user_publishing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*disable\-user\-service\-publishing=yes$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi Restrict Address Publishing" id="oval:ssg-object_avahi_restrict_address_publishing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*publish\-addresses=no$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi Restrict HW Publishing" id="oval:ssg-object_avahi_restrict_CPU_publishing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*publish\-hinfo=no$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi Restrict Workstation Publishing" id="oval:ssg-object_avahi_restrict_workstation_publishing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*publish\-workstation=no$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Avahi Restrict Domain Publishing" id="oval:ssg-object_avahi_restrict_domain_publishing:obj:1" version="1">
      <ind:filepath>/etc/avahi/avahi-daemon.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*publish\-domain=no$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_audit_argument:obj:1" version="1">
      <ind:filepath>/etc/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*kernel\s/vmlinuz(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_nousb_argument:obj:1" version="1">
      <ind:filepath>/etc/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*kernel\s/vmlinuz(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_password:obj:1" version="1">
      <ind:filepath>/etc/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*password[\s]+--encrypted[\s]+.*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_domain-named:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+domain\-name[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_domain-name-servers:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+domain\-name\-servers[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_nis-domain:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+nis\-domain[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_nis-servers:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+nis\-servers[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_ntp-servers:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+ntp\-servers[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_routers:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+routers[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_time-offset:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+time\-offset[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_subnet-mask:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+subnet\-mask[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_client_broadcast-address:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhcp/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(request|require|supersede)[\s]+broadcast\-address[\s]*.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_server_configure_logging:obj:1" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*daemon\.\*[\s]+\/var\/log\/daemon\.log$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_server_disable_bootp:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*deny[\s]+bootp\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_server_deny_declines:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*deny[\s]+declines\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_server_disable_ddns:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*ddns\-update\-style[\s]+none\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_domain-named_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+domain\-name[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_domain-name-servers_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+domain\-name\-servers[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_nis-domain_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+nis\-domain[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_nis-servers_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+nis\-servers[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_ntp-servers_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+ntp\-servers[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_routers_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+routers[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dhcp_time-offset_info:obj:1" version="1">
      <ind:filepath>/etc/dhcp/dhcpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*option[\s]+time\-offset[\s]+.*\;[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_gid_is_user_and_world_writable:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object comment="Disable Ctrl-Alt-Del key sequence" id="oval:ssg-object_test_disable_ctrlaltdel:obj:1" version="1">
      <ind:filepath>/etc/init/control-alt-delete.override</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*exec[\s]*/sbin/shutdown[\s]*\-r[\s]*now.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-object_test_disable_ctrlaltdel_exists:obj:1" version="1">
      <unix:filepath>/etc/init/control-alt-delete.override</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_interactive_boot_disabled_in_sysconfig_init:obj:1" version="2">
      <ind:filepath>/etc/sysconfig/init</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*PROMPT=no[\s]+</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_confirm_kernel_boot_argument_not_present:obj:1" version="1">
      <ind:filepath>/etc/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel[\s]+.*confirm.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*session\s+(required|requisite)?\s+pam_lastlog.so[\s\w\d\=]+showfailed</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dovecot_disable_plaintext_auth:obj:1" version="1">
      <ind:filepath>/etc/dovecot/conf.d/10-auth.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dovecot_enable_ssl:obj:1" version="1">
      <ind:filepath>/etc/dovecot/conf.d/10-ssl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*ssl[\s]*=[\s]*(yes|required)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub:obj:1" comment="check value selinux|enforcing=0 in /etc/grub.conf, fail if found" version="1">
      <ind:filepath>/etc/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel[\s]+.*(selinux|enforcing)=0.*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/boot/grub/grub.conf" id="oval:ssg-object_file_group_owner_grub_conf:obj:1" version="1">
      <unix:filepath>/boot/grub/grub.conf</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="oval:ssg-object_file_group_owner_efi_grub_conf:obj:1" version="1">
      <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/grub/grub.conf" id="oval:ssg-object_file_permissions_grub_conf:obj:1" version="2">
      <unix:filepath>/boot/grub/grub.conf</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="files with sgid set" id="oval:ssg-object_file_permissions_unauthorized_sgid:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid:ste:1</filter>
      <filter action="exclude">oval:ssg-state_sgid_whitelist:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="files with suid set" id="oval:ssg-object_file_permissions_unauthorized_suid:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_file_permissions_unauthorized_suid:ste:1</filter>
      <filter action="exclude">oval:ssg-state_suid_whitelist:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/boot/grub/grub.conf" id="oval:ssg-object_file_user_owner_grub_conf:obj:1" version="1">
      <unix:filepath>/boot/grub/grub.conf</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="oval:ssg-object_file_user_owner_efi_grub_conf:obj:1" version="1">
      <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object comment="Configure FTP firewall" id="oval:ssg-object_configure_firewall:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/iptables-config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*IPTABLES_MODULES=\".*ip_conntrack_ftp.*\"$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Disable uploads" id="oval:ssg-object_ftp_disable_uploads:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*write_enable=NO$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Enable ftp user list" id="oval:ssg-object_ftp_user_list_enable:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*userlist_enable=YES$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Set ftp user list file" id="oval:ssg-object_ftp_user_list_file:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*userlist_file=\/etc\/vsftp\.ftpusers$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Use ftp user list" id="oval:ssg-object_ftp_user_list_deny:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*userlist_deny=NO$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Disable anonymous access" id="oval:ssg-object_ftp_restrict_to_anon:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*local_enable=NO$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_gdm_disable_user_list_tree:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='disable_user_list']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_gdm_disable_user_list_no_tree:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='disable_user_list']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_banner_message_enable:obj:1" version="1">
      <ind:filepath>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='banner_message_enable']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_banner_message_enable_tree:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='banner_message_enable']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_banner_message_enable_no_tree:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='banner_message_enable']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_gdm_set_login_banner_text:obj:1" version="1">
      <ind:filepath>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='banner_message_text']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_no_tree_gconf_gdm_set_login_banner_text:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='banner_message_text']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_tree_gconf_gdm_set_login_banner_text:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='banner_message_text']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-obj_gconf_gnome_disable_automount:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='media_automount']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-obj_gconf_tree_gnome_disable_automount:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='media_automount']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-obj_gconf_gnome_disable_automount_autorun:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nautilus/preferences/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='media_autorun_never']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-obj_gconf_tree_gnome_disable_automount_autorun:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='media_autorun_never']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_disable_clock_temperature:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/panel/applets/clock/prefs/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='show_temperature']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_disable_clock_temperature:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/dir/dir/entry[@name='show_temperature']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_disable_clock_weather:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/panel/applets/clock/prefs/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='show_weather']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_disable_clock_weather:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/dir/dir/entry[@name='show_weather']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gnome_disable_ctrlaltdel_reboot:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome_settings_daemon/keybindings/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='power']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_gnome_disable_ctrlaltdel_reboot:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='power']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_disable_restart_shutdown:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='disable_restart_buttons']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_disable_restart_shutdown:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='disable_restart_buttons']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-obj_gconf_gnome_disable_thumbnailers:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/thumbnailers/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='disable_all']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-obj_gconf_tree_gnome_disable_thumbnailers:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='disable_all']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_disable_wifi_create:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nm-applet/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='disable-wifi-create']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_disable_wifi_create:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/entry[@name='disable-wifi-create']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_disable_wifi_disconnect:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nm-applet/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='disable-disconnected-notifications']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_disable_wifi_disconnect:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/entry[@name='disable-disconnected-notifications']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_disable_wifi_notification:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/nm-applet/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='disable-connected-notifications']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_disable_wifi_notification:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/entry[@name='disable-connected-notifications']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gnome_screensaver_idle_activated:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_gnome_screensaver_idle_activated:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/entry[@name='idle_activation_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gnome_screensaver_idle_delay:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/session/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='idle_delay']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_gnome_screensaver_idle_delay:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='idle_delay']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_screensaver_lock_enabled:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='lock_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_screensaver_lock_enabled:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/entry[@name='lock_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gnome_screensaver_max_idle_action:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/session/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='max_idle_action']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_gnome_screensaver_max_idle_action:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='max_idle_action']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gnome_screensaver_max_idle_time:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/desktop/gnome/session/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='max_idle_time']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_gnome_screensaver_max_idle_time:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/dir/entry[@name='max_idle_time']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gnome_screensaver_mode:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath>/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_gconf_tree_gnome_screensaver_mode:obj:1" version="1">
      <ind:filepath>/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath>/gconf/dir/dir/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:textfilecontent54_object id="oval:ssg-object_grub_enable_fips_mode:obj:1" version="1">
      <ind:filepath>/etc/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*kernel\s/vmlinuz(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Test for port 22 access over ipv4" id="oval:ssg-obj_iptables_sshd_disabled_ipv4:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/iptables</ind:filepath>
      <ind:pattern operation="pattern match">^-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Test for port 22 access over ipv6" id="oval:ssg-obj_iptables_sshd_disabled_ipv6:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/ip6tables</ind:filepath>
      <ind:pattern operation="pattern match">^-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_system_block_devices:obj:1" comment="Block device names on the system" version="1">
      <!-- Traverse /sys/block directory hierarchy only one level to optimize efficiency -->
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" max_depth="1"/>
      <unix:path operation="equals">/sys/block/</unix:path>
      <unix:filename operation="pattern match">[^\/]+</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_system_ssd_drives:obj:1" version="1">
      <ind:filepath var_ref="oval:ssg-variable_system_block_devices_rotational_paths:var:1" var_check="at least one"/>
      <ind:pattern operation="pattern match">^0$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_kernel_disable_entropy_contribution_for_solid_state_drives:obj:1" version="1">
      <ind:filepath var_ref="oval:ssg-variable_system_solid_state_drives_paths:var:1" var_check="at least one" datatype="string"/>
      <ind:pattern operation="pattern match">^1$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of bluetooth">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of cramfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of dccp">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1" version="1" comment="kernel module freevxfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of freevxfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_disabled:obj:1" version="1" comment="kernel module hfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of hfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1" version="1" comment="kernel module hfsplus disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of hfsplus">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1" version="1" comment="ipv6 disabled any modprobe conf file">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*options\s+ipv6\s+.*disable=1.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_disabled:obj:1" version="1" comment="kernel module jffs2 disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of jffs2">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_disabled:obj:1" version="1" comment="kernel module rds disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of rds">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_disabled:obj:1" version="1" comment="kernel module sctp disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of sctp">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of squashfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" comment="kernel module tipc disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of tipc">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of udf">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1" version="1" comment="Check depricated /etc/modprobe.conf for disablement of usb-storage">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ldap_client_start_tls_ssl:obj:1" version="1">
      <ind:filepath>/etc/pam_ldap.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*ssl[\s]+start_tls[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ldap_client_tls_cacertdir:obj:1" version="1">
      <ind:filepath>/etc/pam_ldap.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*tls_cacertdir[\s]+/etc/pki/tls/CA$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ldap_client_tls_cacertfile:obj:1" version="1">
      <ind:filepath>/etc/pam_ldap.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*tls_cacertfile[\s]+/etc/pki/tls/CA/.*\.(pem|crt)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Define default gateways" id="oval:ssg-obj_network_ipv6_default_gateway:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^IPV6_DEFAULTGW=.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Enable privacy extensions on each interface" id="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^IPV6_PRIVACY=rfc3041$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Set static IPv6 address on each interface" id="oval:ssg-obj_network_ipv6_static_address:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^IPV6ADDR=.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1">
      <ind:filepath>/etc/ntp.conf</ind:filepath>
      <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-obj_ntp_remote_server:obj:1" version="1">
      <ind:filepath>/etc/ntp.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_GConf2_installed:obj:1" version="1">
      <linux:name>GConf2</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_abrt_removed:obj:1" version="1">
      <linux:name>abrt</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_at_removed:obj:1" version="1">
      <linux:name>at</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_autofs_removed:obj:1" version="1">
      <linux:name>autofs</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_avahi_installed:obj:1" version="1">
      <linux:name>avahi</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_bluez_removed:obj:1" version="1">
      <linux:name>bluez</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cpuspeed_removed:obj:1" version="1">
      <linux:name>cpuspeed</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cronie_installed:obj:1" version="1">
      <linux:name>cronie</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cups_removed:obj:1" version="1">
      <linux:name>cups</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cyrus-sasl_removed:obj:1" version="1">
      <linux:name>cyrus-sasl</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dbus_removed:obj:1" version="1">
      <linux:name>dbus</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_esc_installed:obj:1" version="1">
      <linux:name>esc</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_gdm_installed:obj:1" version="1">
      <linux:name>gdm</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_hal_removed:obj:1" version="1">
      <linux:name>hal</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_iptables-ipv6_installed:obj:1" version="1">
      <linux:name>iptables-ipv6</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_iptables_installed:obj:1" version="1">
      <linux:name>iptables</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_iputils_removed:obj:1" version="1">
      <linux:name>iputils</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_irqbalance_installed:obj:1" version="1">
      <linux:name>irqbalance</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_kexec-tools_removed:obj:1" version="1">
      <linux:name>kexec-tools</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_libcgroup_removed:obj:1" version="1">
      <linux:name>libcgroup</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_mdadm_removed:obj:1" version="1">
      <linux:name>mdadm</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_nfs-utils_removed:obj:1" version="1">
      <linux:name>nfs-utils</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ntpdate_removed:obj:1" version="1">
      <linux:name>ntpdate</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_oddjob_removed:obj:1" version="1">
      <linux:name>oddjob</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_openswan_installed:obj:1" version="1">
      <linux:name operation="pattern match">^(open|libre)swan$</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_pam_ldap_removed:obj:1" version="1">
      <linux:name>pam_ldap</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_pam_pkcs11_installed:obj:1" version="1">
      <linux:name>pam_pkcs11</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_pcsc-lite_installed:obj:1" version="1">
      <linux:name>pcsc-lite</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_policycoreutils_installed:obj:1" version="1">
      <linux:name>policycoreutils</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_portreserve_removed:obj:1" version="1">
      <linux:name>portreserve</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_postfix_installed:obj:1" version="1">
      <linux:name>postfix</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_psacct_installed:obj:1" version="1">
      <linux:name>psacct</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_qpid-cpp-server_removed:obj:1" version="1">
      <linux:name>qpid-cpp-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_quota_removed:obj:1" version="1">
      <linux:name>quota</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rhnsd_removed:obj:1" version="1">
      <linux:name>rhnsd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rpcbind_removed:obj:1" version="1">
      <linux:name>rpcbind</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_samba_removed:obj:1" version="1">
      <linux:name>samba</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_smartmontools_removed:obj:1" version="1">
      <linux:name>smartmontools</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_subscription-manager_removed:obj:1" version="1">
      <linux:name>subscription-manager</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_sysstat_removed:obj:1" version="1">
      <linux:name>sysstat</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_xorg-x11-server-common_removed:obj:1" version="1">
      <linux:name>xorg-x11-server-common</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_postfix_network_listening_disabled:obj:1" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" version="1">
      <ind:filepath>/etc/postfix/main.cf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*inet_interfaces[\s]*=[\s]*localhost[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_require_singleuser_auth:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/init</ind:filepath>
      <ind:pattern operation="pattern match">^SINGLE=/sbin/sulogin[\s]*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_abrtd:obj:1" version="1">
      <unix:service_name>abrtd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_acpid:obj:1" version="1">
      <unix:service_name>acpid</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_atd:obj:1" version="1">
      <unix:service_name>atd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_auditd:obj:1" version="1">
      <unix:service_name>auditd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_autofs:obj:1" version="1">
      <unix:service_name>autofs</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_avahi-daemon:obj:1" version="1">
      <unix:service_name>avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_bluetooth:obj:1" version="1">
      <unix:service_name>bluetooth</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_certmonger:obj:1" version="1">
      <unix:service_name>certmonger</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_cgconfig:obj:1" version="1">
      <unix:service_name>cgconfig</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_cgred:obj:1" version="1">
      <unix:service_name>cgred</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_cpuspeed:obj:1" version="1">
      <unix:service_name>cpuspeed</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_crond:obj:1" version="1">
      <unix:service_name>crond</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_cups:obj:1" version="1">
      <unix:service_name>cups</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_dhcpd:obj:1" version="1">
      <unix:service_name>dhcpd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_dovecot:obj:1" version="1">
      <unix:service_name>dovecot</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_haldaemon:obj:1" version="1">
      <unix:service_name>haldaemon</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_httpd:obj:1" version="1">
      <unix:service_name>httpd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_ip6tables:obj:1" version="1">
      <unix:service_name>ip6tables</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_iptables:obj:1" version="1">
      <unix:service_name>iptables</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_irqbalance:obj:1" version="1">
      <unix:service_name>irqbalance</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_kdump:obj:1" version="1">
      <unix:service_name>kdump</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_mdmonitor:obj:1" version="1">
      <unix:service_name>mdmonitor</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_messagebus:obj:1" version="1">
      <unix:service_name>messagebus</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_named:obj:1" version="1">
      <unix:service_name>named</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_netconsole:obj:1" version="1">
      <unix:service_name>netconsole</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_netfs:obj:1" version="1">
      <unix:service_name>netfs</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_nfs:obj:1" version="1">
      <unix:service_name>nfs</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_nfslock:obj:1" version="1">
      <unix:service_name>nfslock</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_ntpd:obj:1" version="1">
      <unix:service_name>ntpd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_ntpdate:obj:1" version="1">
      <unix:service_name>ntpdate</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_oddjobd:obj:1" version="1">
      <unix:service_name>oddjobd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_pcscd:obj:1" version="1">
      <unix:service_name>pcscd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_portreserve:obj:1" version="1">
      <unix:service_name>portreserve</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_postfix:obj:1" version="1">
      <unix:service_name>postfix</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_psacct:obj:1" version="1">
      <unix:service_name>psacct</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_qpidd:obj:1" version="1">
      <unix:service_name>qpidd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_quota_nld:obj:1" version="1">
      <unix:service_name>quota_nld</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rdisc:obj:1" version="1">
      <unix:service_name>rdisc</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_restorecond:obj:1" version="1">
      <unix:service_name>restorecond</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_xinetd_rexec_disabled:obj:1" version="1">
      <!-- the rpm package rsh-server installs a xinetd config file in /etc/xinetd.d which controls rexec -->
      <!-- in this case /sbin/chkconfig edits /etc/xinetd.d/rexec to enable/disable this service which is why we check it this way -->
      <ind:filepath>/etc/xinetd.d/rexec</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rhnsd:obj:1" version="1">
      <unix:service_name>rhnsd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rhsmcertd:obj:1" version="1">
      <unix:service_name>rhsmcertd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_xinetd_rlogin_disabled:obj:1" version="1">
      <!-- the rpm package rsh-server installs a xinetd config file in /etc/xinetd.d which controls rlogin -->
      <!-- in this case /sbin/chkconfig edits /etc/xinetd.d/rlogin to enable/disable this service which is why we check it this way -->
      <ind:filepath>/etc/xinetd.d/rlogin</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rpcbind:obj:1" version="1">
      <unix:service_name>rpcbind</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rpcgssd:obj:1" version="1">
      <unix:service_name>rpcgssd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rpcidmapd:obj:1" version="1">
      <unix:service_name>rpcidmapd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rpcsvcgssd:obj:1" version="1">
      <unix:service_name>rpcsvcgssd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_xinetd_rsh_disabled:obj:1" version="1">
      <!-- the rpm package rsh-server installs a xinetd config file in /etc/xinetd.d which controls rsh -->
      <!-- in this case /sbin/chkconfig edits /etc/xinetd.d/rsh to enable/disable this service which is why we check it this way -->
      <ind:filepath>/etc/xinetd.d/rsh</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_rsyslog:obj:1" version="1">
      <unix:service_name>rsyslog</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_saslauthd:obj:1" version="1">
      <unix:service_name>saslauthd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_smartd:obj:1" version="1">
      <unix:service_name>smartd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_smb:obj:1" version="1">
      <unix:service_name>smb</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_snmpd:obj:1" version="1">
      <unix:service_name>snmpd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_squid:obj:1" version="1">
      <unix:service_name>squid</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_sshd:obj:1" version="1">
      <unix:service_name>sshd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_sysstat:obj:1" version="1">
      <unix:service_name>sysstat</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object comment="Disable Telnet Service" id="oval:ssg-obj_service_telnetd_disabled:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/telnet</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+no\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_tftp:obj:1" version="1">
      <unix:service_name>tftp</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_vsftpd:obj:1" version="1">
      <unix:service_name>vsftpd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_xinetd:obj:1" version="1">
      <unix:service_name>xinetd</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_ypbind:obj:1" version="1">
      <unix:service_name>ypbind</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ip6tables_input_drop:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/ip6tables</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*:INPUT\sDROP\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ip6tables_input_accept:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/ip6tables</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*:INPUT\sACCEPT\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_iptables_input_drop:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/iptables</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*:INPUT\sDROP\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_iptables_input_accept:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/iptables</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*:INPUT\sACCEPT\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_iptables_forward_drop:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/iptables</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*:FORWARD\sDROP\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_iptables_forward_accept:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/iptables</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*:FORWARD\sACCEPT\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1" version="1">
      <ind:filepath>/etc/pam_pkcs11/pam_pkcs11.conf</ind:filepath>
      <!-- PKCS #11 module can be either CoolKey or OpenSC. Check cert_policy for all of them. -->
      <!-- On RHEL-6 'cert_policy' key isn't separated by space from '=' sign yet -->
      <ind:pattern operation="pattern match">^[\s]*cert_policy=(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_smart_card_enabled_system_auth:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_enabled_system_auth:var:1" var_check="at least one"/>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_system_auth:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_system_auth:var:1" var_check="at least one"/>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_smartcard_auth:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/smartcard-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" var_check="at least one"/>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_fs_suid_dumpable:obj:1" version="1">
      <unix:name>fs.suid_dumpable</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_kernel_dmesg_restrict:obj:1" version="1">
      <unix:name>kernel.dmesg_restrict</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_kernel_exec_shield:obj:1" version="1">
      <unix:name>kernel.exec-shield</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_kernel_randomize_va_space:obj:1" version="1">
      <unix:name>kernel.randomize_va_space</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.log_martians</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.rp_filter</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.send_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.rp_filter</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.send_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_ip_forward:obj:1" version="1">
      <unix:name>net.ipv4.ip_forward</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv4_tcp_syncookies:obj:1" version="1">
      <unix:name>net.ipv4.tcp_syncookies</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.accept_ra</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.accept_source_route</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.forwarding</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <unix:name>net.ipv6.conf.default.accept_ra</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv6.conf.default.accept_source_route</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_fs_suid_dumpable:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last fs.suid_dumpable directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*fs.suid_dumpable[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_fs_suid_dumpable:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last fs.suid_dumpable directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*fs.suid_dumpable[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last kernel.dmesg_restrict directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.dmesg_restrict[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_kernel_dmesg_restrict:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last kernel.dmesg_restrict directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.dmesg_restrict[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_kernel_exec_shield:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last kernel.exec-shield directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.exec-shield[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_kernel_exec_shield:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last kernel.exec-shield directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.exec-shield[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last kernel.randomize_va_space directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.randomize_va_space[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last kernel.randomize_va_space directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.randomize_va_space[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.all.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.all.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.all.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.all.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.all.log_martians directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.all.log_martians directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.all.rp_filter directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.all.rp_filter directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.all.secure_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.all.secure_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.all.send_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.all.send_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.default.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.default.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.default.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.default.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.default.rp_filter directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.default.rp_filter directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.default.secure_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.default.secure_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.conf.default.send_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.conf.default.send_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.icmp_echo_ignore_broadcasts directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.icmp_echo_ignore_broadcasts directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.icmp_ignore_bogus_error_responses directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.icmp_ignore_bogus_error_responses directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.ip_forward directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.ip_forward directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.ip_forward[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv4.tcp_syncookies directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv4.tcp_syncookies directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.all.accept_ra directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.all.accept_ra directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.all.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.all.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.all.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.all.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.all.forwarding directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.all.forwarding directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.default.accept_ra directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.default.accept_ra directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.default.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.default.accept_redirects directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last net.ipv6.conf.default.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last net.ipv6.conf.default.accept_source_route directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_inittab_default_runlevel:obj:1" version="1">
      <ind:filepath>/etc/inittab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*id:3:initdefault:[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
      <ind:filepath>/etc/default/useradd</ind:filepath>
      <ind:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <!-- User names from /etc/passwd (1-th column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
      <ind:filepath>/etc/security/limits.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
      <ind:path>/etc/security/limits.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
      <ind:path>/etc/security/limits.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MAX_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MAX_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
      <unix:username operation="pattern match">.*</unix:username>
    </unix:password_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_LEN directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_LEN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_WARN_AGE directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_WARN_AGE directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/password-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
      <ind:pid xsi:nil="true" datatype="int"/>
      <ind:name>PATH</ind:name>
    </ind:environmentvariable58_object>
    <unix:file_object comment="root's path directories with wrong group / other write permissions" id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1">
      <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</filter>
      <filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="1">
      <ind:filepath>/etc/profile</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*TMOUT[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="1">
      <ind:path>/etc/profile.d</ind:path>
      <ind:filename operation="pattern match">^.*\.sh$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*TMOUT[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_bashrc:obj:1" comment="Umask value from /etc/bashrc" version="1">
      <ind:filepath>/etc/bashrc</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_bashrc:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_bashrc_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1" comment="Umask value from /etc/csh.cshrc" version="1">
      <ind:filepath>/etc/csh.cshrc</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_csh_cshrc:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" comment="Umask value from /etc/login.defs" version="1">
      <ind:filepath>/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" comment="Umask value from /etc/profile" version="1">
      <ind:filepath>/etc/profile</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind:pattern>
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_build_new_database_filename:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^database_out=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
      <!-- From aide.conf(5) - "If there are multiple database_out lines, then the first one is used" =>
         therefore we will retrieve only the first instance -->
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
      <!-- From aide.conf(5) - "If there are multiple database_out lines, then the first one is used" =>
                  therefore we will retrieve only the first instance -->
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_aide_build_new_database_absolute_path:obj:1" version="1">
      <unix:filepath var_ref="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
      <unix:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object comment="run aide daily with cron" id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1">
      <ind:filepath>/etc/crontab</ind:filepath>
      <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="run aide daily with cron" id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1">
      <ind:path>/etc/cron.d</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="run aide daily with cron" id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1">
      <ind:filepath>/var/spool/cron/root</ind:filepath>
      <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*(root|)/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="run aide daily with cron.(daily|weekly|monthly)" id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1">
      <ind:path operation="pattern match">/etc/cron.(daily|weekly|monthly)</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\s*/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="notify personnel when aide completes" id="oval:ssg-object_test_aide_scan_notification:obj:1" version="1">
      <ind:filepath>/etc/crontab</ind:filepath>
      <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="notify personnel when aide completes" id="oval:ssg-object_aide_var_cron_notification:obj:1" version="1">
      <ind:filepath>/var/spool/cron/root</ind:filepath>
      <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" id="oval:ssg-object_aide_crontabs_notification:obj:1" version="1">
      <ind:path operation="pattern match">/etc/cron.(d|daily|weekly|monthly)</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_non_fips_hashes:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[A-Z]*[\s]*=[\s]*.*(sha1|rmd160|sha256|whirlpool|tiger|haval|gost|crc32).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_use_fips_hashes:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[A-Z]*[\s]*=[\s]*([a-z0-9\+]*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_acls:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^(?!ALLXTRAHASHES)[A-Z]*[\s]*=[\s]*([a-z0-9\+]*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_ext_attributes:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^(?!ALLXTRAHASHES)[A-Z]*[\s]*=[\s]*([a-z0-9\+]*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
      <ind:filepath>/etc/audisp/plugins.d/syslog.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" comment="log_group = root" version="1">
      <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
      <ind:filepath>/etc/issue</ind:filepath>
      <ind:pattern var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_browsing_browsing_off:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*Browsing[\s]+(?:Off|No)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_browsing_browseallow:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*BrowseAllow[\s]+(?:none)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_printserver_disable_port:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*Port[\s]+(\d)+</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_printserver_use_listen:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*Listen[\s]+(?:localhost|127\.0\.0\.1|::1):(\d)+</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/etc/httpd/conf/" id="oval:ssg-object_dir_perms_etc_httpd_conf:obj:1" version="1">
      <unix:path>/etc/httpd/conf</unix:path>
      <unix:filename xsi:nil="true"/>
    </unix:file_object>
    <unix:file_object comment="/var/log/httpd/" id="oval:ssg-object_dir_perms_var_log_httpd:obj:1" version="1">
      <unix:path>/var/log/httpd</unix:path>
      <unix:filename xsi:nil="true"/>
    </unix:file_object>
    <unix:file_object comment="only local directories" id="oval:ssg-object_only_local_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_world_writable_and_not_sticky:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_hostbasedauthentication:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_prelinking_disabled:obj:1" version="2">
      <ind:filepath>/etc/sysconfig/prelink</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*PRELINKING=no[\s]*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
      <ind:filepath>/etc/security/limits.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/dnf/dnf.conf" version="1">
      <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
      <ind:path>/etc/yum.repos.d</ind:path>
      <ind:filename operation="pattern match">.*</ind:filename>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
      <!-- Read whole /etc/logrotate.conf at once (as single line) -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/logrotate.conf</ind:filepath>
      <!-- From the content extract the text chunk after the last (uncommented)
         occurrence of 'daily' keyword till the EOF (including the 'daily'
         string itself) -->
      <ind:pattern operation="pattern match">(?:daily)*.*(?=[\n][\s]*daily)(.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
      <!-- From the found object exclude that one containing some (uncommented)
         occurrence of (weekly / monthly / yearly) outside the {} block section
         of /etc/logrotate.conf -->
      <filter action="exclude">oval:ssg-state_another_rotate_interval_after_daily:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
      <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s]*/etc/logrotate.conf(?:.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1">
      <linux:name>gpg-pubkey</linux:name>
    </linux:rpminfo_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_file_groupowner_etc_group:obj:1" version="1">
      <unix:filepath>/etc/group</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_groupowner_etc_gshadow:obj:1" version="1">
      <unix:filepath>/etc/gshadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_groupowner_etc_passwd:obj:1" version="1">
      <unix:filepath>/etc/passwd</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_file_owner_etc_group:obj:1" version="1">
      <unix:filepath>/etc/group</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_owner_etc_gshadow:obj:1" version="1">
      <unix:filepath>/etc/gshadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_owner_etc_passwd:obj:1" version="1">
      <unix:filepath>/etc/passwd</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="binary directories" id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1">
      <!-- Check that /bin, /sbin, /usr/sbin, /usr/sbin, /usr/local/bin,
         /usr/local/sbin, and /usr/libexec directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="binary files" id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1">
      <!-- Check that files within /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
         /usr/local/sbin, and /usr/libexec directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="library directories" id="oval:ssg-object_file_ownership_lib_dir:obj:1" version="1">
      <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="library files" id="oval:ssg-object_file_ownership_lib_files:obj:1" version="1">
      <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="binary files" id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1">
      <!-- Check that binary files under /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
         /usr/local/sbin, and /usr/libexec directories have safe permissions (go-w) -->
      <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</filter>
      <filter action="exclude">oval:ssg-state_perms_binary_files_symlink:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_file_permissions_etc_group:obj:1" version="1">
      <unix:filepath>/etc/group</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_etc_gshadow:obj:1" version="1">
      <unix:filepath>/etc/gshadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_etc_passwd:obj:1" version="1">
      <unix:filepath>/etc/passwd</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_etc_shadow:obj:1" version="1">
      <unix:filepath>/etc/shadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="home directories" id="oval:ssg-object_file_permissions_home_dirs:obj:1" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="exclude">oval:ssg-state_home_dirs_home_itself:ste:1</filter>
      <filter action="include">oval:ssg-state_home_dirs_wrong_perm:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/etc/httpd/conf/* permissions" id="oval:ssg-object_file_permissions_httpd_server_conf_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/etc/httpd/conf</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="library directories" id="oval:ssg-object_file_permissions_lib_dir:obj:1" version="1">
      <!-- Check that /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
      <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</filter>
      <filter action="exclude">oval:ssg-perms_state_symlink:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="library files" id="oval:ssg-object_file_permissions_lib_files:obj:1" version="1">
      <!-- Check the files within /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
      <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</filter>
      <filter action="exclude">oval:ssg-perms_state_symlink:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="world writable" id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</filter>
      <!-- don't search /proc, /sys, and some special files from /selinux -->
      <filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1</filter>
      <filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1</filter>
      <filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="all local files" id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="1">
      <!-- We can't traverse symlinks here since e.g. /sys file system might contain symlink loops
         resulting into excessive memory use by the scanner process & possible subsequent OOM killer
         termination of it. See e.g.: https://www.redhat.com/archives/open-scap-list/2014-May/msg00005.html
         Therefore traverse only directories -->
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
      <unix:path>/</unix:path>
      <unix:filename operation="pattern match">.*</unix:filename>
      <filter action="exclude">oval:ssg-state_file_permissions_ungroupowned:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-etc_group_object:obj:1" version="1">
      <ind:filepath>/etc/group</ind:filepath>
      <ind:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_not_mode_0640:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_not_mode_0600:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_enable:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*xferlog_enable[\s]*=[\s]*YES$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_format:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*xferlog_std_format[\s]*=[\s]*NO$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*log_ftp_protocol[\s]*=[\s]*YES$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Banner for FTP Users" id="oval:ssg-object_test_ftp_present_banner:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*banner_file[\s]*=[\s]*/etc/issue*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
      <ind:filepath>/etc/group</ind:filepath>
      <!-- Group ID (GID) from /etc/group (3-rd column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^.*:x:([0-9]+):</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <!-- Group ID (GID) from /etc/passwd (4-th column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^.*:[0-9]+:([0-9]+):</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
      <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_guest_login:obj:1" version="1">
      <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?TimedLoginEnable=[Ff]alse$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_groupowner_shadow_file:obj:1" version="1">
      <unix:filepath>/etc/shadow</unix:filepath>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
      <linux:name>McAfeeVSEForLinux</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
      <linux:name>MFErt</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
      <linux:name>MFEcma</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/accm/bin</unix:path>
      <unix:filename>accm</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1" version="1">
      <linux:name>MFEhiplsm</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/auditengine/bin</unix:path>
      <unix:filename>auditmanager</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
      <linux:name>fedora-release</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
      <ind:filepath>/etc/system-release-cpe</ind:filepath>
      <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_unix_wrlinux:obj:1" version="1"/>
    <unix:file_object version="1" id="oval:ssg-obj_test_wrlinux:obj:1">
      <unix:filepath>/etc/wrlinux-release</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_hostlimit:obj:1" version="1">
      <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_splithosts:obj:1" version="1">
      <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_dev_shm_partition_nodev:obj:1" version="1">
      <linux:mount_point>/dev/shm</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_dev_shm_partition_noexec:obj:1" version="1">
      <linux:mount_point>/dev/shm</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_dev_shm_partition_nosuid:obj:1" version="1">
      <linux:mount_point>/dev/shm</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
      <!-- look at all partitions except root -->
      <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point>
      <filter action="include">oval:ssg-state_local_nodev:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nfs_nodev_etc_fstab:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
      <!-- the "not equal" operation essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_nfs_defined_etc_fstab_nodev:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+.*$</ind:pattern>
      <!-- the "not equal" operation below essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nodev_runtime_cd_dvd_drive:obj:1" version="1">
      <!-- CD / DVD drive can be mounted under any mount_point. We don't know ahead its exact name.
         => Capture all & filter out only the relevant ones via the corresponding state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- Therefore from all the captured mount points select only those having
         device set to some CD / DVD drive alternative name and simultaneously
         having 'nodev' mount option used -->
      <filter action="include">oval:ssg-state_nodev_runtime_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nodev_runtime_not_cd_dvd_drive:obj:1" version="1">
      <!-- Removable partition can be mounted under any mount point. We don't know it's
         exact name ahead => capture all & filter out only those relevant later via state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- From all the captured mount points select only those having device equal
         to 'var_removable_partition' variable value and simultaneously having
         'nodev' mount option set -->
      <filter action="include">oval:ssg-state_nodev_runtime_not_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_noexec_runtime_cd_dvd_drive:obj:1" version="1">
      <!-- CD / DVD drive can be mounted under any mount_point. We don't know ahead its exact name.
         => Capture all & filter out only the relevant ones via the corresponding state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- Therefore from all the captured mount points select only those having
         device set to some CD / DVD drive alternative name and simultaneously
         having 'noexec' mount option used -->
      <filter action="include">oval:ssg-state_noexec_runtime_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_noexec_runtime_not_cd_dvd_drive:obj:1" version="1">
      <!-- Removable partition can be mounted under any mount point. We don't know it's
         exact name ahead => Capture all & filter out only those relevant later via state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- From all the captured mount points select only those having device equal
         to 'var_removable_partition' variable value and simultaneously having
         'noexec' mount option set -->
      <filter action="include">oval:ssg-state_noexec_runtime_not_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nfs_nosuid_etc_fstab:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
      <!-- the "not equal" operation essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_nfs_defined_etc_fstab_nosuid:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+.*$</ind:pattern>
      <!-- the "not equal" operation below essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nosuid_runtime_cd_dvd_drive:obj:1" version="1">
      <!-- CD / DVD drive can be mounted under any mount_point. We don't know ahead its exact name.
         => Capture all & filter out only the relevant ones via the corresponding state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- Therefore from all the captured mount points select only those having
         device set to some CD / DVD drive alternative name and simultaneously
         having 'nosuid' mount option used -->
      <filter action="include">oval:ssg-state_nosuid_runtime_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nosuid_runtime_not_cd_dvd_drive:obj:1" version="1">
      <!-- Removable partition can be mounted under any mount point. We don't know it's
         exact name ahead => capture all & filter out only those relevant later via state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- From all the captured mount points select only those having device equal
         to 'var_removable_partition' variable value and simultaneously having
         'nosuid' mount option set -->
      <filter action="include">oval:ssg-state_nosuid_runtime_not_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_20340111:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+[\S]+[\s]+cifs[\s]+([\S]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_20340112:obj:1" version="1">
      <ind:filepath>/etc/mtab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+[\S]+[\s]+cifs[\s]+([\S]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_tmp_nodev_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_tmp_noexec_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_tmp_nosuid_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_option_var_tmp:obj:1" version="1">
      <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab" id="oval:ssg-object_mount_option_var_tmp_bind:obj:1" version="1">
      <ind:filepath>/etc/mtab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">
    1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/network</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Test for udp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1" version="1">
      <ind:filepath>/etc/netconfig</ind:filepath>
      <ind:pattern operation="pattern match">^udp6\s+tpi_clts\s+v\s+inet6\s+udp\s+-\s+-$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Test for tcp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1" version="1">
      <ind:filepath>/etc/netconfig</ind:filepath>
      <ind:pattern operation="pattern match">^tcp6\s+tpi_cots_ord\s+v\s+inet6\s+tcp\s+-\s+-$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
      <unix:name operation="pattern match">^.*$</unix:name>
      <filter action="include">oval:ssg-state_promisc:ste:1</filter>
    </unix:interface_object>
    <ind:textfilecontent54_object comment="/etc/securetty file exists" id="oval:ssg-object_etc_securetty_exists:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="no entries /etc/securetty" id="oval:ssg-object_no_direct_root_logins:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="all local files" id="oval:ssg-file_permissions_unowned_object:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
      <unix:path>/</unix:path>
      <unix:filename operation="pattern match">.*</unix:filename>
      <filter action="exclude">oval:ssg-file_permissions_unowned_userid_list_match:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
      <ind:filepath>/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="look for .netrc in /home" id="oval:ssg-object_no_netrc_files_home:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename operation="pattern match">^\.netrc$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for .rhosts or .shosts in /root" id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1">
      <unix:path operation="equals">/root</unix:path>
      <unix:filename operation="pattern match">^\.(r|s)hosts$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for .rhosts or .shosts in /home" id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename operation="pattern match">^\.(r|s)hosts$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for /etc/hosts.equiv or /etc/shosts.equiv" id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1">
      <unix:path operation="equals">/etc</unix:path>
      <unix:filename operation="pattern match">^s?hosts\.equiv$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance od UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n(?!#|SYS_)(UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MAX directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MAX[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_default_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_default_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_reserved_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_reserved_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_dynalloc_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_aide_installed:obj:1" version="1">
      <linux:name>aide</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_audit_installed:obj:1" version="1">
      <linux:name>audit</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_bind_removed:obj:1" version="1">
      <linux:name>bind</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dhcp_removed:obj:1" version="1">
      <linux:name>dhcp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dovecot_removed:obj:1" version="1">
      <linux:name>dovecot</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dracut-fips_installed:obj:1" version="1">
      <linux:name>dracut-fips</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_httpd_removed:obj:1" version="1">
      <linux:name>httpd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_mcstrans_removed:obj:1" version="1">
      <linux:name>mcstrans</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_net-snmp_removed:obj:1" version="1">
      <linux:name>net-snmp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ntp_installed:obj:1" version="1">
      <linux:name>ntp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_openldap-servers_removed:obj:1" version="1">
      <linux:name>openldap-servers</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_openssh-server_removed:obj:1" version="1">
      <linux:name>openssh-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_prelink_removed:obj:1" version="1">
      <linux:name>prelink</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rsh-server_removed:obj:1" version="1">
      <linux:name>rsh-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rsh_removed:obj:1" version="1">
      <linux:name>rsh</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rsyslog_installed:obj:1" version="1">
      <linux:name>rsyslog</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_samba-common_installed:obj:1" version="1">
      <linux:name>samba-common</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_samba-common_removed:obj:1" version="1">
      <linux:name>samba-common</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_screen_installed:obj:1" version="1">
      <linux:name>screen</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_sendmail_removed:obj:1" version="1">
      <linux:name>sendmail</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_setroubleshoot_removed:obj:1" version="1">
      <linux:name>setroubleshoot</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_squid_removed:obj:1" version="1">
      <linux:name>squid</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_talk-server_removed:obj:1" version="1">
      <linux:name>talk-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_talk_removed:obj:1" version="1">
      <linux:name>talk</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_telnet-server_removed:obj:1" version="1">
      <linux:name>telnet-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_telnet_removed:obj:1" version="1">
      <linux:name>telnet</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_tftp-server_removed:obj:1" version="1">
      <linux:name>tftp-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_tftp_removed:obj:1" version="1">
      <linux:name>tftp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_vsftpd_installed:obj:1" version="1">
      <linux:name>vsftpd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_vsftpd_removed:obj:1" version="1">
      <linux:name>vsftpd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_xinetd_removed:obj:1" version="1">
      <linux:name>xinetd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ypbind_removed:obj:1" version="1">
      <linux:name>ypbind</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ypserv_removed:obj:1" version="1">
      <linux:name>ypserv</linux:name>
    </linux:rpminfo_object>
    <linux:partition_object id="oval:ssg-object_mount_home_own_partition:obj:1" version="1">
      <linux:mount_point>/home</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_own_tmp_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_own_partition:obj:1" version="1">
      <linux:mount_point>/var</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_audit_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log/audit</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_postfix_server_banner:obj:1" version="1">
      <ind:filepath>/etc/postfix/main.cf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*smtpd_banner[\s]*=[\s]*\$myhostname[\s]+ESMTP[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
      <unix:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_require_smb_client_signing:obj:1" version="1">
      <ind:filepath>/etc/samba/smb.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*client[\s]+signing[\s]*=[\s]*mandatory</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
      <ind:pid xsi:nil="true" datatype="int"/>
      <ind:name>PATH</ind:name>
    </ind:environmentvariable58_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="false"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">^.*bin/.*$</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_md5_hash:ste:1</filter>
    </linux:rpmverifyfile_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_user_ownership:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="true" noghostfiles="true"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">.*</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_user_ownership:ste:1</filter>
    </linux:rpmverifyfile_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_group_ownership:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="true" noghostfiles="true"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">.*</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_group_ownership:ste:1</filter>
    </linux:rpmverifyfile_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_mode:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="true" noghostfiles="true"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">.*</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_mode:ste:1</filter>
    </linux:rpmverifyfile_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten:obj:1" version="2">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*\$(?:Input(?:TCP|RELP)|UDP)ServerRun</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
      <ind:path>/etc/rsyslog.d</ind:path>
      <ind:filename operation="pattern match">.*</ind:filename>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="oval:ssg-object_selinux_all_devicefiles_labeled:obj:1" version="1">
      <linux:behaviors recurse_direction="down"/>
      <linux:path>/dev</linux:path>
      <linux:filename operation="pattern match">^.*$</linux:filename>
      <filter action="include">oval:ssg-state_selinux_all_devicefiles_labeled:ste:1</filter>
    </linux:selinuxsecuritycontext_object>
    <linux:selinuxsecuritycontext_object comment="none satisfy initrc_t in /proc" id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1">
      <linux:behaviors max_depth="1" recurse_direction="down"/>
      <linux:path>/proc</linux:path>
      <linux:filename operation="pattern match">^.*$</linux:filename>
      <filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</filter>
    </linux:selinuxsecuritycontext_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
      <ind:filepath>/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*SELINUXTYPE[\s]*=[\s]*([^\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
      <ind:filepath>/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1" version="1">
      <ind:filepath>/etc/libuser.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last ENCRYPT_METHOD directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of ENCRYPT_METHOD directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-object_pam_unix_sha512:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity|createUser).*(public|private)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_rsh_emulation_disabled:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreRhosts(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitrootlogin_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreUserKnownHosts(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_no_user_envset:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitUserEnvironment(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_banner_set:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_approved_ciphers:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_approved_macs:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+hmac-sha2-512,hmac-sha2-256,hmac-sha1[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sysconfig_networking_bootproto_ifcfg:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*BOOTPROTO[\s]*=[\s"]*([^#"\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
    <unix:uname_object comment="32 bit architecture" id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1"/>
    <ind:textfilecontent54_object id="oval:ssg-object_tftpd_uses_secure_mode:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/tftp</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*server_args[\s]+=[\s]+\-s[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" comment="Umask value from /etc/init.d/functions" version="1">
      <ind:filepath>/etc/init.d/functions</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_umask_for_daemons:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_init_d_functions_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_etc_shadow:obj:1" version="1">
      <unix:filepath>/etc/shadow</unix:filepath>
    </unix:file_object>
    <ind:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_removable_partition:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_umask_for_daemons_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_wireless_disable_interfaces:obj:1" version="1">
      <ind:filepath>/proc/net/wireless</ind:filepath>
      <ind:pattern operation="pattern match">^\s*[-\w]+:</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
  </objects>
  <states>
    <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_dcredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_dcredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_difok:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_difok:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_lcredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_lcredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_maxrepeat:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_minclass:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minclass:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minlen:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minlen:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_ocredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ocredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_retry:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_retry:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_cracklib_ucredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ucredit:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_proper_always_exit_rule_but_for_unprivileged_command:ste:1" version="1">
      <ind:subexpression operation="not equal" datatype="string" var_ref="oval:ssg-variable_audit_rules_privileged_commands_full_form:var:1" var_check="all"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state version="1" id="oval:ssg-state_audit_rules_privileged_commands:ste:1">
      <ind:subexpression operation="pattern match" datatype="string" var_ref="oval:ssg-variable_audit_rules_privileged_commands_full_form:var:1" var_check="at least one"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_set_dimension_match:ste:1" version="1">
      <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_dimension_of_object_audit_rules_privileged_commands:var:1" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_bootloader_audit_argument:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^.*audit=1.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_bootloader_nousb_argument:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^.*nousb.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state comment="uid greater than or equal to 500 and world writable" id="oval:ssg-state_gid_is_user_and_world_writable:ste:1" version="1">
      <unix:user_id datatype="int" operation="greater than or equal">500</unix:user_id>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_group_owner_grub_conf:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_grub_conf:ste:1" version="2">
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid:ste:1" version="1">
      <unix:sgid datatype="boolean">true</unix:sgid>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_sgid_whitelist:ste:1" version="1">
      <unix:filepath var_ref="oval:ssg-var_sgid_whitelist:var:1" var_check="at least one"/>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid:ste:1" version="1">
      <unix:suid datatype="boolean">true</unix:suid>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_suid_whitelist:ste:1" version="1">
      <unix:filepath var_ref="oval:ssg-var_suid_whitelist:var:1" var_check="at least one"/>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_user_owner_grub_conf:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gconf_gdm_disable_user_list:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_banner_message_enable:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state comment="login_banner_text" id="oval:ssg-state_gconf_gdm_set_login_banner_text:ste:1" version="1">
      <ind:value_of datatype="string" operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1"/>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gconf_gnome_disable_automount:ste:1" version="1">
      <ind:value_of datatype="string">false</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gconf_gnome_disable_automount_autorun:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_disable_clock_temperature:ste:1" version="1">
      <ind:value_of datatype="string">false</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_disable_clock_weather:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gnome_disable_ctrlaltdel_reboot:ste:1" version="1">
      <ind:value_of datatype="string"/>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_disable_restart_shutdown:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gconf_gnome_disable_thumbnailers:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_disable_wifi_create:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_disable_wifi_disconnect:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_disable_wifi_notification:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gnome_screensaver_idle_activated:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state comment="idle timeout" id="oval:ssg-state_gnome_screensaver_idle_delay:ste:1" version="1">
      <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-inactivity_timeout_value:var:1"/>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_screensaver_lock_enabled:ste:1" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gnome_screensaver_max_idle_action:ste:1" version="1">
      <ind:value_of datatype="string">forced-logout</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state comment="idle timeout" id="oval:ssg-state_gnome_screensaver_max_idle_time:ste:1" version="1">
      <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-inactivity_timeout_value:var:1"/>
    </ind:xmlfilecontent_state>
    <ind:xmlfilecontent_state id="oval:ssg-state_gnome_screensaver_mode:ste:1" version="1">
      <ind:value_of datatype="string">blank-only</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:textfilecontent54_state id="oval:ssg-state_grub_enable_fips_mode:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^.*fips=1.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_abrtd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_acpid_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_atd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_auditd_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_autofs_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_avahi-daemon_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_bluetooth_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_certmonger_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_cgconfig_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_cgred_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_cpuspeed_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_crond_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_cups_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_dhcpd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_dovecot_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_haldaemon_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_httpd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_ip6tables_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_iptables_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_irqbalance_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_kdump_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_mdmonitor_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_messagebus_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_named_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_netconsole_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_netfs_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_nfs_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_nfslock_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_ntpd_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_ntpdate_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_oddjobd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_pcscd_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_portreserve_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_postfix_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_psacct_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_qpidd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_quota_nld_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rdisc_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_restorecond_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rhnsd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rhsmcertd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rpcbind_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rpcgssd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rpcidmapd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_rpcsvcgssd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_rsyslog_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_saslauthd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_smartd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_smb_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_snmpd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_squid_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_sshd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_sysstat_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_tftp_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_vsftpd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_xinetd_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state comment="not configured to start" id="oval:ssg-state_service_ypbind_off:ste:1" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <ind:textfilecontent54_state id="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*ocsp_on.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_fs_suid_dumpable:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_kernel_dmesg_restrict:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_kernel_exec_shield:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_kernel_randomize_va_space:ste:1" version="1">
      <unix:value datatype="int" operation="equals">2</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_all_log_martians:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_all_rp_filter:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_all_send_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_default_rp_filter:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_conf_default_send_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_ip_forward:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv4_tcp_syncookies:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_all_accept_ra:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_all_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_all_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_all_forwarding:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_default_accept_ra:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_net_ipv6_conf_default_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_exec_shield:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1">
      <ind:subexpression operation="greater than" datatype="int">-1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
      <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
      <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
      <unix:password>x</unix:password>
    </unix:password_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_remember:var:1"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_system-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_password-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state comment="group or other has write privilege" id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state comment="symbolic link" id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than or equal" var_check="all" var_ref="oval:ssg-var_accounts_tmout:var:1"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_bashrc:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_csh_cshrc:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_aide_use_fips_hashes:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*sha512.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_aide_verify_acls:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*acl.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_aide_verify_ext_attributes:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*xattrs.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_max_log_file:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_num_logs:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_dir_perms_etc_httpd_conf:ste:1" operator="AND" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_dir_perms_var_log_httpd:ste:1" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_world_writable_and_not_sticky:ste:1" version="1">
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1">
      <ind:subexpression operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_another_rotate_interval_after_daily:ste:1" version="1">
      <!-- if some of (weekly / monthly / yearly) uncommented setting is found
         (in the previously selected chunk of text) in one of the following
         parts:
         * before the first '{' character,
         * somewhere after '}' character and before another '{' character,
         * after final '}' character and before end of the chunk
         exclude such object from the found ones (since in that case earlier
         daily setting would be replaced with the found setting) -->
      <ind:subexpression datatype="string" operation="pattern match">}[^{]+[\n][\s]*(weekly|monthly|yearly)|[\n][\s]*(weekly|monthly|yearly)[^}]+{</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-fd431d51-4ae0493b:ste:1" version="1">
      <linux:release>4ae0493b</linux:release>
      <linux:version>fd431d51</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-2fa658e0-45700c69:ste:1" version="1">
      <linux:release>45700c69</linux:release>
      <linux:version>2fa658e0</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-f4a80eb5-53a7ff4b:ste:1" version="1">
      <linux:release>53a7ff4b</linux:release>
      <linux:version>f4a80eb5</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-c105b9de-4e0fd3a3:ste:1" version="1">
      <linux:release>4e0fd3a3</linux:release>
      <linux:version>c105b9de</linux:version>
    </linux:rpminfo_state>
    <unix:file_state id="oval:ssg-state_file_groupowner_etc_group:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_groupowner_etc_gshadow:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_groupowner_etc_passwd:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_owner_etc_group:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_owner_etc_gshadow:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_owner_etc_passwd:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_libraries_not_root:ste:1" version="1">
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_etc_group:ste:1" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_mode_0000:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">false</unix:uread>
      <unix:uwrite datatype="boolean">false</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_mode_0644_or_stronger:ste:1" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_mode_0000:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">false</unix:uread>
      <unix:uwrite datatype="boolean">false</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_home_itself:ste:1" version="1">
      <!-- Exclude /home directory itself from the check. Check /home/* directories only. -->
      <unix:path operation="equals">/home</unix:path>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_wrong_perm:ste:1" version="1" operator="OR">
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_wrong_file_permissions_httpd_server_conf_files:ste:1" version="2" operator="AND">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-perms_state_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1" version="1">
      <unix:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1" version="1">
      <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1" version="1">
      <unix:filepath operation="pattern match">^/sys/.*$</unix:filepath>
    </unix:file_state>
    <unix:file_state comment="Files that are owned by a group." id="oval:ssg-state_file_permissions_ungroupowned:ste:1" version="1">
      <unix:group_id datatype="int" var_ref="oval:ssg-variable_file_permissions_ungroupowned:var:1" var_check="at least one"/>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
      <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:uexec datatype="boolean">true</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:gexec datatype="boolean">true</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_not_mode_0640:ste:1" version="1" operator="OR">
      <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:uexec datatype="boolean">true</unix:uexec>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:gexec datatype="boolean">true</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one" datatype="string"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_groupowner_shadow_file:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_server:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_wrlinux:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:partition_state id="oval:ssg-state_dev_shm_nodev:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_dev_shm_noexec:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_dev_shm_nosuid:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1">
      <!-- this check defines a local partition as one which has a device node in /dev -->
      <linux:device operation="pattern match">^/dev/.*$</linux:device>
      <linux:mount_options datatype="string" entity_check="all" operation="not equal">nodev</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_nodev:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*nodev.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nodev_runtime_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nodev_runtime_not_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_noexec_runtime_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_noexec_runtime_not_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_nosuid:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*nosuid.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nosuid_runtime_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nosuid_runtime_not_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_20340112:ste:1" version="1">
      <ind:instance datatype="int">2</ind:instance>
      <ind:subexpression operation="pattern match">sec=(krb5i|ntlmv2i)</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_tmp_nodev:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_tmp_noexec:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_tmp_nosuid:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <unix:interface_state id="oval:ssg-state_promisc:ste:1" version="1">
      <unix:flag datatype="string" entity_check="at least one" operation="equals">PROMISC</unix:flag>
    </unix:interface_state>
    <unix:file_state id="oval:ssg-file_permissions_unowned_userid_list_match:ste:1" version="1">
      <unix:user_id var_check="at least one" var_ref="oval:ssg-file_permissions_unowned_userid_list:var:1" datatype="int"/>
    </unix:file_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_default_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_reserved_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:environmentvariable58_state comment="starts with colon or period" id="oval:ssg-state_begins_colon_period:ste:1" version="1">
      <ind:value operation="pattern match">^[:\.]</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="colon twice in a row" id="oval:ssg-state_contains_double_colon:ste:1" version="1">
      <ind:value operation="pattern match">::</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="period twice in a row" id="oval:ssg-state_contains_double_period:ste:1" version="1">
      <ind:value operation="pattern match">\.\.</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="ends with colon or period" id="oval:ssg-state_ends_colon_period:ste:1" version="1">
      <ind:value operation="pattern match">[:\.]$</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="begins with a slash" id="oval:ssg-state_begins_slash:ste:1" version="1">
      <ind:value operation="pattern match">^[^/]</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="elements begin with a slash" id="oval:ssg-state_contains_relative_path:ste:1" version="1">
      <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
    </ind:environmentvariable58_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_md5_hash:ste:1" version="1" operator="AND">
      <linux:md5_differs>fail</linux:md5_differs>
      <!-- <linux:configuration_file datatype="boolean">false</linux:configuration_file> -->
      <!-- <linux:documentation_file datatype="boolean">false</linux:documentation_file> -->
      <!-- <linux:ghost_file datatype="boolean">false</linux:ghost_file> -->
      <!-- <linux:license_file datatype="boolean">false</linux:license_file> -->
      <!-- <linux:readme_file datatype="boolean">false</linux:readme_file> -->
    </linux:rpmverifyfile_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_user_ownership:ste:1" version="1">
      <linux:ownership_differs>fail</linux:ownership_differs>
    </linux:rpmverifyfile_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_group_ownership:ste:1" version="1">
      <linux:group_differs>fail</linux:group_differs>
    </linux:rpmverifyfile_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_mode:ste:1" version="1">
      <linux:mode_differs>fail</linux:mode_differs>
    </linux:rpmverifyfile_state>
    <linux:selinuxsecuritycontext_state comment="do it" id="oval:ssg-state_selinux_all_devicefiles_labeled:ste:1" version="1">
      <linux:type datatype="string" operation="equals">device_t</linux:type>
    </linux:selinuxsecuritycontext_state>
    <linux:selinuxsecuritycontext_state comment="do it" id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1">
      <linux:type datatype="string" operation="equals">initrc_t</linux:type>
    </linux:selinuxsecuritycontext_state>
    <ind:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_policy_name:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1">
      <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_state:var:1"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_last_encrypt_method_instance_value:ste:1" version="1">
      <ind:value operation="equals" datatype="string">SHA512</ind:value>
    </ind:variable_state>
    <ind:textfilecontent54_state comment="upper bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state comment="lower bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
      <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_sysconfig_networking_bootproto_ifcfg:ste:1" version="2">
      <ind:subexpression operation="pattern match">^(static|none)$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64le</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="32 bit architecture" id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1">
      <unix:processor_type operation="equals">i686</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1">
      <unix:processor_type operation="equals">x86_64</unix:processor_type>
    </unix:uname_state>
    <ind:variable_state id="oval:ssg-ste_umask_for_daemons:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_umask_for_daemons_umask_as_number:var:1"/>
    </ind:variable_state>
    <unix:file_state id="oval:ssg-state_etc_shadow_uid_root:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1">
      <ind:value operation="equals">/dev/cdrom</ind:value>
    </ind:variable_state>
  </states>
  <variables>
    <local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfg_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfg_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfo_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfo_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfp_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfp_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_log_files_paths:obj:1"/>
    </local_variable>
    <external_variable comment="External variable for pam_cracklib dcredit" datatype="int" id="oval:ssg-var_password_pam_dcredit:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib difok" datatype="int" id="oval:ssg-var_password_pam_difok:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib lcredit" datatype="int" id="oval:ssg-var_password_pam_lcredit:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib maxrepeat" datatype="int" id="oval:ssg-var_password_pam_maxrepeat:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib minclass" datatype="int" id="oval:ssg-var_password_pam_minclass:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib minlen" datatype="int" id="oval:ssg-var_password_pam_minlen:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib ocredit" datatype="int" id="oval:ssg-var_password_pam_ocredit:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib retry" datatype="int" id="oval:ssg-var_password_pam_retry:var:1" version="1"/>
    <external_variable comment="External variable for pam_cracklib ucredit" datatype="int" id="oval:ssg-var_password_pam_ucredit:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_audit_rules_privileged_commands_full_form:var:1" comment="full for of audit rules for privileged commands" datatype="string" version="1">
      <concat>
        <literal_component>-a always,exit -F path=</literal_component>
        <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
        <literal_component> -F perm=x -F auid&gt;=500 -F auid!=4294967295 -k privileged</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_dimension_of_object_system_privileged_commands:var:1" comment="cardinality of system privileged commands set" datatype="int" version="1">
      <count>
        <object_component item_field="filepath" object_ref="oval:ssg-object_system_privileged_commands:obj:1"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_dimension_of_object_audit_rules_privileged_commands:var:1" comment="cardinality of audit.rules privileged commands having expected rule definition set" datatype="int" version="1">
      <count>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_audit_rules_privileged_commands:obj:1"/>
      </count>
    </local_variable>
    <constant_variable id="oval:ssg-var_sgid_whitelist:var:1" version="1" datatype="string" comment="sgid whitelist">
      <value>/bin/cgclassify</value>
      <value>/bin/cgexec</value>
      <value>/sbin/netreport</value>
      <value>/usr/bin/crontab</value>
      <value>/usr/bin/gnomine</value>
      <value>/usr/bin/iagno</value>
      <value>/usr/bin/locate</value>
      <value>/usr/bin/lockfile</value>
      <value>/usr/bin/same-gnome</value>
      <value>/usr/bin/screen</value>
      <value>/usr/bin/ssh-agent</value>
      <value>/usr/bin/wall</value>
      <value>/usr/bin/write</value>
      <value>/usr/lib64/vte/gnome-pty-helper</value>
      <value>/usr/libexec/kde4/kdesud</value>
      <value>/usr/libexec/utempter/utempter</value>
      <value>/usr/lib/mailman/cgi-bin/admindb</value>
      <value>/usr/lib/mailman/cgi-bin/admin</value>
      <value>/usr/lib/mailman/cgi-bin/confirm</value>
      <value>/usr/lib/mailman/cgi-bin/create</value>
      <value>/usr/lib/mailman/cgi-bin/edithtml</value>
      <value>/usr/lib/mailman/cgi-bin/listinfo</value>
      <value>/usr/lib/mailman/cgi-bin/options</value>
      <value>/usr/lib/mailman/cgi-bin/private</value>
      <value>/usr/lib/mailman/cgi-bin/rmlist</value>
      <value>/usr/lib/mailman/cgi-bin/roster</value>
      <value>/usr/lib/mailman/cgi-bin/subscribe</value>
      <value>/usr/lib/mailman/mail/mailman</value>
      <value>/usr/lib/vte/gnome-pty-helper</value>
      <value>/usr/sbin/lockdev</value>
      <value>/usr/sbin/postdrop</value>
      <value>/usr/sbin/postqueue</value>
      <value>/usr/sbin/sendmail.sendmail</value>
    </constant_variable>
    <constant_variable id="oval:ssg-var_suid_whitelist:var:1" version="1" datatype="string" comment="suid whitelist">
      <value>/bin/fusermount</value>
      <value>/bin/mount</value>
      <value>/bin/ping6</value>
      <value>/bin/ping</value>
      <value>/bin/su</value>
      <value>/bin/umount</value>
      <value>/lib64/dbus-1/dbus-daemon-launch-helper</value>
      <value>/lib/dbus-1/dbus-daemon-launch-helper</value>
      <value>/sbin/mount.ecryptfs_private</value>
      <value>/sbin/mount.nfs</value>
      <value>/sbin/pam_timestamp_check</value>
      <value>/sbin/unix_chkpwd</value>
      <value>/usr/bin/abrt-action-install-debuginfo-to-abrt-cache</value>
      <value>/usr/bin/at</value>
      <value>/usr/bin/chage</value>
      <value>/usr/bin/chfn</value>
      <value>/usr/bin/chsh</value>
      <value>/usr/bin/crontab</value>
      <value>/usr/bin/gpasswd</value>
      <value>/usr/bin/kgrantpty</value>
      <value>/usr/bin/kpac_dhcp_helper</value>
      <value>/usr/bin/ksu</value>
      <value>/usr/bin/newgrp</value>
      <value>/usr/bin/newrole</value>
      <value>/usr/bin/passwd</value>
      <value>/usr/bin/pkexec</value>
      <value>/usr/bin/rcp</value>
      <value>/usr/bin/rlogin</value>
      <value>/usr/bin/rsh</value>
      <value>/usr/bin/sperl5.10.1</value>
      <value>/usr/bin/staprun</value>
      <value>/usr/bin/sudoedit</value>
      <value>/usr/bin/sudo</value>
      <value>/usr/bin/Xorg</value>
      <value>/usr/lib64/amanda/calcsize</value>
      <value>/usr/lib64/amanda/dumper</value>
      <value>/usr/lib64/amanda/killpgrp</value>
      <value>/usr/lib64/amanda/planner</value>
      <value>/usr/lib64/amanda/rundump</value>
      <value>/usr/lib64/amanda/runtar</value>
      <value>/usr/lib64/nspluginwrapper/plugin-config</value>
      <value>/usr/lib/amanda/calcsize</value>
      <value>/usr/lib/amanda/dumper</value>
      <value>/usr/lib/amanda/killpgrp</value>
      <value>/usr/lib/amanda/planner</value>
      <value>/usr/lib/amanda/rundump</value>
      <value>/usr/lib/amanda/runtar</value>
      <value>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</value>
      <value>/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper</value>
      <value>/usr/libexec/mc/cons.saver</value>
      <value>/usr/libexec/openssh/ssh-keysign</value>
      <value>/usr/libexec/polkit-1/polkit-agent-helper-1</value>
      <value>/usr/libexec/pt_chown</value>
      <value>/usr/libexec/pulse/proximity-helper</value>
      <value>/usr/lib/nspluginwrapper/plugin-config</value>
      <value>/usr/sbin/amcheck</value>
      <value>/usr/sbin/seunshare</value>
      <value>/usr/sbin/suexec</value>
      <value>/usr/sbin/userhelper</value>
      <value>/usr/sbin/usernetctl</value>
    </constant_variable>
    <external_variable comment="login_banner_text" datatype="string" id="oval:ssg-login_banner_text:var:1" version="1"/>
    <external_variable comment="inactivity timeout variable" datatype="int" id="oval:ssg-inactivity_timeout_value:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_system_block_devices_rotational_paths:var:1" datatype="string" comment="Path to 'rotational' tunable for all block devices on the system" version="1">
      <concat>
        <object_component item_field="filepath" object_ref="oval:ssg-object_system_block_devices:obj:1"/>
        <literal_component>/queue/rotational</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_system_solid_state_drives_paths:var:1" datatype="string" comment="Path to 'add_random' tunable for all SSD drives on system" version="1">
      <concat>
        <object_component item_field="path" object_ref="oval:ssg-object_system_ssd_drives:obj:1"/>
        <literal_component>/add_random</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_smart_card_enabled_system_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is enabled in /etc/pam.d/system-auth" version="1">
      <concat>
        <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
        <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
        <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
        <literal_component>\nauth[\s]+\[success=done[\s]authinfo_unavail=ignore[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
        <literal_component>pam_pkcs11.so[\s]card_only\n</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_smart_card_required_system_auth:var:1" datatype="string" comment="Regular expressiion to check if smartcard authentication is required in /etc/pam.d/system-auth" version="1">
      <concat>
        <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
        <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
        <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
        <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
        <literal_component>pam_pkcs11.so[\s]wait_for_card[\s]card_only\n</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is required in /etc/pam.d/smartcard-auth" version="1">
      <concat>
        <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
        <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
        <literal_component>pam_pkcs11.so[\s]wait_for_card[\s]card_only\n.*</literal_component>
        <literal_component>\npassword[\s]+required[\s]+pam_pkcs11.so\n</literal_component>
      </concat>
    </local_variable>
    <external_variable comment="External variable for net.ipv4.conf.all.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.log_martians" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.rp_filter" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.secure_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.rp_filter" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.secure_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts" datatype="int" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses" datatype="int" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.tcp_syncookies" datatype="int" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.accept_ra" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.forwarding" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.default.accept_ra" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.default.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.default.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="inactive days expiration" datatype="int" id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
      <count>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of unique username rows retrieved from /etc/passwd">
      <count>
        <unique>
          <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
        </unique>
      </count>
    </local_variable>
    <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Maximum password age" datatype="int" id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Minimum password age in days" datatype="int" id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Password minimum length" datatype="int" id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1"/>
    <external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg-var_password_pam_unix_remember:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="password expiration warning age in days" datatype="int" id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1"/>
    <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" version="2"/>
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" version="2"/>
    <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1">
      <split delimiter=":">
        <object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
      </split>
    </local_variable>
    <external_variable comment="external variable for TMOUT" datatype="int" id="oval:ssg-var_accounts_tmout:var:1" version="1"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_bashrc:var:1" comment="First octal digit of umask from /etc/bashrc" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_bashrc:var:1" comment="Second octal digit of umask from /etc/bashrc" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_bashrc:var:1" comment="Third octal digit of umask from /etc/bashrc" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_bashrc_umask_as_number:var:1" comment="/etc/bashrc umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_bashrc:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_bashrc:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_bashrc:var:1"/>
      </arithmetic>
    </local_variable>
    <external_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" comment="Required umask converted from string to octal number" datatype="int" version="1"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_csh_cshrc:var:1" comment="First octal digit of umask from /etc/csh.cshrc" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_csh_cshrc:var:1" comment="Second octal digit of umask from /etc/csh.cshrc" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_csh_cshrc:var:1" comment="Third octal digit of umask from /etc/csh.cshrc" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1" comment="/etc/csh.cshrc umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_csh_cshrc:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_csh_cshrc:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_csh_cshrc:var:1"/>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" comment="First octal digit of umask from /etc/login.defs" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" comment="Second octal digit of umask from /etc/login.defs" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" comment="Third octal digit of umask from /etc/login.defs" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" comment="/etc/login.defs umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" comment="First octal digit of umask from /etc/profile" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" comment="Second octal digit of umask from /etc/profile" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" comment="Third octal digit of umask from /etc/profile" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" comment="/etc/profile umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
      <concat>
        <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
        <literal_component>/</literal_component>
        <object_component object_ref="oval:ssg-object_aide_build_new_database_filename:obj:1" item_field="subexpression"/>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
      <concat>
        <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
        <literal_component>/</literal_component>
        <object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
      </concat>
    </local_variable>
    <external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1"/>
    <external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1"/>
    <external_variable comment="audit flush setting" datatype="string" id="oval:ssg-var_auditd_flush:var:1" version="1"/>
    <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg-var_auditd_max_log_file:var:1" version="1"/>
    <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1"/>
    <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg-var_auditd_num_logs:var:1" version="1"/>
    <external_variable comment="audit space_left_action setting" datatype="string" id="oval:ssg-var_auditd_space_left_action:var:1" version="2"/>
    <local_variable id="oval:ssg-variable_file_permissions_ungroupowned:var:1" datatype="int" version="1" comment="all GIDs on the target system">
      <object_component object_ref="oval:ssg-etc_group_object:obj:1" item_field="subexpression"/>
    </local_variable>
    <local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" comment="GIDs from /etc/group" datatype="string" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1"/>
    </local_variable>
    <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
      <value>/dev/cdrom</value>
      <value>/dev/dvd</value>
      <value>/dev/scd0</value>
      <value>/dev/sr0</value>
    </constant_variable>
    <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
      <concat>
        <literal_component>^[\s]*</literal_component>
        <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1"/>
        <!-- Capture the mount options field (4-th column of /etc/fstab) -->
        <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
      <concat>
        <literal_component>^[\s]*</literal_component>
        <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
        <!-- Capture the mount options field (4-th column of /etc/fstab) -->
        <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
      </concat>
    </local_variable>
    <external_variable comment="removable partition" datatype="string" id="oval:ssg-var_removable_partition:var:1" version="1"/>
    <local_variable id="oval:ssg-file_permissions_unowned_userid_list:var:1" comment="List of valid user ids" datatype="int" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-file_permissions_unowned_userid_list_object:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uids_etc_passwd:var:1" datatype="int" comment="UIDs retrieved from /etc/passwd" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_uid_min_value:var:1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_default_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - (UID_MIN - 1)) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Get (x - (UID_MIN -1)) result -->
        <arithmetic arithmetic_operation="add">
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get -1 * (UID_MIN - 1) result -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <!-- Get (UID_MIN -1) result -->
            <arithmetic arithmetic_operation="add">
              <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
              <variable_component var_ref="oval:ssg-variable_uid_min_value:var:1"/>
              <literal_component datatype="int">-1</literal_component>
            </arithmetic>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_reserved_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - SYS_UID_MIN) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_dynalloc_range_quad_expr:var:1" datatype="int" comment="Construct (x - SYS_UID_MIN) * (x - SYS_UID_MAX) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
        <!-- Construct (x - SYS_UID_MAX) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MAX -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg-var_selinux_policy_name:var:1" version="1"/>
    <external_variable comment="external variable for selinux state" datatype="string" id="oval:ssg-var_selinux_state:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs" version="1">
      <regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="timeout value" datatype="int" id="oval:ssg-sshd_idle_timeout_value:var:1" version="1"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1" comment="First octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1" comment="Second octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1" comment="Third octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_init_d_functions_umask_as_number:var:1" comment="/etc/init.d/functions umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1"/>
      </arithmetic>
    </local_variable>
    <external_variable id="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" comment="Required umask converted from string to octal number" datatype="int" version="1"/>
    <external_variable id="oval:ssg-var_accounts_user_umask:var:1" datatype="string" version="1" comment="Value of var_accounts_user_umask (the required umask) as string"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" comment="First octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Second octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Third octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
      </substring>
    </local_variable>
    <external_variable id="oval:ssg-var_umask_for_daemons:var:1" datatype="string" version="1" comment="Value of var_umask_for_daemons (the required umask) as string"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1" comment="First octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Second octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Third octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
      </substring>
    </local_variable>
  </variables>
</oval_definitions>