Changeset 179

Timestamp:

04/02/08 09:11:17 (8 months ago)

Author:

slawrence

Message:

Backport RHEL5.1 STIG's and kickstart to RHEL4

Files:

• trunk/RHEL4/kickstart/clip.ks (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/CLIPUserPassword (deleted)
• trunk/RHEL4/scripts/stig-fix/cat1/gen002040.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat1/gen002700.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat1/gen004640.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat1/gen005500.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat1/lnx00580.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/CLIPUserPassword (deleted)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000020.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000400.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000460.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000600.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000700.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000800.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen000920.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001020.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001120.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001260.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001560.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001720.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001740.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen001760.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002120.sh (modified) (2 diffs)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002320.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002340.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002360.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002660.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002720.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002740.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002760.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002780.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002800.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002820.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen002840.sh (added)
• trunk/RHEL4/scripts/stig-fix/cat2/gen003600.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen003740.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen003960.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen003980.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen004000.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat2/gen006620.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat3/gen001280.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat3/gen001780.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat3/gen003500.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat3/gen003520.sh (modified) (1 diff)
• trunk/RHEL4/scripts/stig-fix/cat4/gen004440.sh (modified) (1 diff)

trunk/RHEL4/kickstart/clip.ks

@@ -1 @@
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-install
+
+# Perform the kickstart install in Text Mode.  Installs are
+# performed in graphical mode by default.
-text
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-rootpw 123)(*qweASD
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-%packages --resolvedeps
-@base
+#policycoreutils-newrole        #DNE
+#aide   #DNE
+sysstat
+setools
-audit
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-%post
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-do
-
-
+
+
-done
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-do
-    echo $servic
-
+       rm -f $fil
+
-done
+
+## (GEN002120: CAT II) (Previously – G069) The SA will ensure the /etc/shells
+## (or equivalent) file exits.
+cat <<-EOF > /etc/shells
+/bin/sh
+/bin/bash
+/sbin/nologin
+/bin/tcsh
+/bin/csh
+/bin/ksh
+EOF
+
+## (GEN002160: CAT I) (Previously – G072) The SA will ensure no shell has the
+## suid bit set.
+for SHELL in `cat /etc/shells`; do
+        chmod u-s $SHELL
+done
+
+## (GEN002180: CAT II) (Previously – G073) The SA will ensure no shell has the
+## sgid bit set.
+for SHELL in `cat /etc/shells`; do
+        chmod g-s $SHELL
+done
+
+## (GEN002200: CAT II) (Previously – G074) The SA will ensure the owner of all
+## shells is root or bin.
+for SHELL in `cat /etc/shells`; do
+        chown root $SHELL
+done
+
+## (GEN002220: CAT II) (Previously – G075) The SA will ensure all shells
+## (excluding /dev/null and sdshell) have permissions of 755, or more
+## restrictive.
+for SHELL in `cat /etc/shells`; do
+        chmod 755 $SHELL
+done
+
+## (GEN002320: CAT II) (Previously – G501) The SA will ensure the audio devices
+## have permissions of 644, or more restrictive.
+sed -i -r "/sound|snd|mixer/ d" /etc/security/console.perms
+echo "SUBSYSTEM==\"sound|snd\", OWNER=\"root\", GROUP=\"root\", MODE=\"0644\"" > /etc/udev/rules.d/55-audio-perms.rules
+
+## (GEN002340: CAT II) (Previously – G502) The SA will ensure the owner of
+## audio devices is root.
+# see GEN002320
+
+## (GEN002360: CAT II) (Previously – G504) The SA will ensure the group owner
+## of audio devices is root, sys, or bin.
+# see GEN002320
+
+## (GEN002420: CAT II) (Previously – G086) The SA will ensure user filesystems,
+## removable media, and remote filesystems will be mounted with the nosuid
+## option.
+FSTAB=/etc/fstab
+SED=/bin/sed
+#nosuid and acl on /home
+if [ $(grep " \/home " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then
+        MNT_OPTS=$(grep " \/home " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/home.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB}
+fi
+#nosuid and acl on /sys
+if [ $(grep " \/sys " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then
+        MNT_OPTS=$(grep " \/sys " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/sys.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB}
+fi
+#nosuid and acl on /boot
+if [ $(grep " \/boot " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then
+        MNT_OPTS=$(grep " \/boot " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/boot.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB}
+fi
+#nodev and acl on /usr
+if [ $(grep " \/usr " ${FSTAB} | grep -c "nodev") -eq 0 ]; then
+        MNT_OPTS=$(grep " \/usr " ${FSTAB} | awk '{print $4}')
+                ${SED} -i "s/\( \/usr.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB}
+fi
+#nodev and acl on /home
+if [ $(grep " \/home " ${FSTAB} | grep -c "nodev") -eq 0 ]; then
+        MNT_OPTS=$(grep " \/home " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/home.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB}
+fi
+#nodev and acl on /usr/local
+if [ $(grep " \/usr\/local " ${FSTAB} | grep -c "nodev") -eq 0 ]; then
+        MNT_OPTS=$(grep " \/usr\/local " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/usr\/local.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB}
+fi
+
+## (GEN002560: CAT II) (Previously – G089) The SA will ensure the system and
+## user umask is 077.
+echo "umask 077" >> /etc/bashrc
+
+## (GEN002640: CAT II) (Previously – G092) The SA will ensure logon capability
+## to default system accounts (e.g., bin, lib, uucp, news, sys, guest, daemon,
+## and any default account not normally logged onto) will be disabled by
+## making the default shell /bin/false, /usr/bin/false, /sbin/false,
+## /sbin/nologin, or /dev/null, and by locking the password.
+for NAME in `cut -d: -f1 /etc/passwd`; do
+        NAMEID=`id -u $NAME`
+        if [ $NAMEID -lt 500 -a $NAME != 'root' ]; then
+                /usr/sbin/usermod -L -s /dev/null $NAME
+        fi
+done
+
+## (GEN002660: CAT II) (Previously – G093) The SA will configure and implement
+## auditing.
+chkconfig auditd on
+cat <<-EOF > /etc/audit.rules
+        # Remove any existing rules
+        -D
+        # Increase buffer size to handle the increased number of messages.
+        -b 8192
+EOF
+
+## (GEN002680: CAT II) (Previously – G094) The SA will ensure audit data files
+## and directories will be readable only by personnel authorized by the IAO.
+chmod 700 /var/log/audit
+
+## (GEN002700: CAT I) (Previously – G095) The SA will ensure audit data files
+## have permissions of 640, or more restrictive.
+touch /var/log/audit/audit.log
+chmod 640 /var/log/audit/*
+chmod 640 /etc/audit.rules
+
+## (GEN002720: CAT II) The SA will configure the auditing system to audit
+## logon (unsuccessful and successful) and logout (successful)
+cat <<-EOF >> /etc/audit.rules
+        -w /bin/login -p x
+        -w /bin/logout -p x 
+EOF
+
+## (GEN002740: CAT II) The SA will configure the auditing system to audit
+## discretionary access control permission modification (unsuccessful and
+## successful use of chown/chmod)
+cat <<-EOF >> /etc/audit.rules
+        -a exit,always -S chmod
+        -a exit,always -S chown
+        -a exit,always -S chown32
+        -a exit,always -S fchmod
+        -a exit,always -S fchown
+        -a exit,always -S fchown32
+        -a exit,always -S lchown
+        -a exit,always -S lchown32
+EOF
+
+## (GEN002760: CAT II) The SA will configure the auditing system to audit
+## unauthorized access attempts to files (unsuccessful)
+cat <<-EOF >> /etc/audit.rules
+        -a exit,always -S open -F success=0
+        -a exit,always -S mknod -F success=0
+        -a exit,always -S pipe -F success=0
+        -a exit,always -S mkdir -F success=0
+        -a exit,always -S creat -F success=0
+        -a exit,always -S truncate -F success=0
+        -a exit,always -S truncate64 -F success=0
+        -a exit,always -S ftruncate -F success=0
+        -a exit,always -S ftruncate64 -F success=0
+EOF
+
+## (GEN002780: CAT II) The SA will configure the auditing system to audit
+## use of privileged commands (unsuccessful and successful)
+cat <<-EOF >> /etc/audit.rules
+        -a exit,always -S chroot
+        -a exit,always -S mount
+        -a exit,always -S umount
+        -a exit,always -S umount2
+        -a exit,always -S adjtimex
+        -a exit,always -S kill
+        -w /usr/sbin/pwck
+        -w /bin/chgrp
+        -w /usr/bin/newgrp
+        -w /usr/sbin/groupadd
+        -w /usr/sbin/groupmod
+        -w /usr/sbin/groupdel
+        -w /usr/sbin/useradd
+        -w /usr/sbin/userdel
+        -w /usr/sbin/usermod
+        -w /usr/bin/chage
+        -w /usr/bin/setfacl
+        -w /usr/bin/chacl
+EOF
+
+## (GEN002800: CAT II) The SA will configure the auditing system to audit
+## files and programs deleted by the user (successful and unsuccessful)
+cat <<-EOF >> /etc/audit.rules
+        -a exit,always -S unlink
+        -a exit,always -S rmdir
+EOF
+
+## (GEN002820: CAT II) The SA will configure the auditing system to audit
+## all system administration actions
+cat <<-EOF >> /etc/audit.rules
+        -w /var/log/audit/
+        -w /etc/auditd.conf
+        -w /etc/audit.rules
+        -a exit,always -S acct
+        -a exit,always -S reboot
+        -a exit,always -S sched_setparam
+        -a exit,always -S sched_setscheduler
+        -a exit,always -S setdomainname
+        -a exit,always -S setrlimit
+        -a exit,always -S settimeofday
+        -a exit,always -S stime
+        -a exit,always -S swapon
+EOF
+
+## (GEN002840: CAT II) The SA will configure the auditing system to audit
+## all security personnel actions
+cat <<-EOF >> /etc/audit.rules
+        -a exit,always -S init_module
+        -a exit,always -S delete_module
+        -w /bin/su
+EOF
+
+## (GEN002860: CAT II) (Previously – G674) The SA and/or IAO will ensure old
+## audit logs are closed and new audit logs are started daily.
+cat <<-EOF > /etc/logrotate.d/audit
+        /var/log/audit/audit.log
+        {
+            daily
+            notifempty
+            missingok
+            postrotate
+            /sbin/service auditd restart 2> /dev/null > /dev/null || true
+            endscript
+        }
+EOF
+
+## (GEN002980: CAT II) The SA will ensure the cron.allow
+## file has permissions of 600, or more restrictive.
+chmod 600 /etc/cron.allow
+
+## (GEN003040: CAT II) The SA will ensure the owner of crontabs is root or the
+## crontab creator.
+chown root /etc/cron.hourly/*
+chown root /etc/cron.daily/*
+chown root /etc/cron.weekly/*
+chown root /etc/cron.monthly/*
+chown root /etc/cron.d/*
+chown root /var/spool/cron/*
+
+## (GEN003060: CAT II) The SA will ensure default system accounts (with the
+## possible exception of root) will not be listed in the cron.allow file. If
+## there is only a cron.deny file, the default accounts (with the possible
+## exception of root) will be listed there.
+echo 'root' > /etc/cron.allow
+awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny
+
+## (GEN003080: CAT II) (Previously – G205) The SA will ensure crontabs have
+## permissions of 600, or more restrictive, (700 for some Linux crontabs, which
+## is detailed in the UNIX Checklist).
+chmod -R 600 /etc/cron.daily
+chmod -R 600 /etc/cron.hourly
+chmod -R 600 /etc/cron.weekly
+chmod -R 600 /etc/cron.monthly
+chmod 600 /etc/crontab
+chmod -R 600 /etc/cron.d
+
+## (GEN003100: CAT II) (Previously – G206) The SA will ensure cron and crontab
+## directories have permissions of 755, or more restrictive.
+chmod 755 /etc/cron.hourly
+chmod 755 /etc/cron.daily
+chmod 755 /etc/cron.weekly
+chmod 755 /etc/cron.monthly
+chmod 755 /etc/cron.d
+chmod 755 /var/spool/cron
+
+## (GEN003120: CAT II) (Previously – G207) The SA will ensure the owner of the
+## cron and crontab directories is root or bin.
+chown root /etc/cron.hourly
+chown root /etc/cron.daily
+chown root /etc/cron.weekly
+chown root /etc/cron.monthly
+chown root /etc/cron.d
+chown root /var/spool/cron
+
+## (GEN003140: CAT II) (Previously – G208) The SA will ensure the group owner
+## of the cron and crontab directories is root, sys, or bin.
+chgrp root /etc/cron.hourly
+chgrp root /etc/cron.daily
+chgrp root /etc/cron.weekly
+chgrp root /etc/cron.monthly
+chgrp root /etc/cron.d
+chgrp root /var/spool/cron
+
+## (GEN003180: CAT II) (Previously – G210) The SA will ensure cron logs have
+## permissions of 600, or more restrictive.
+touch /var/log/cron
+chmod 600 /var/log/cron
+
+## (GEN003200: CAT II)  The SA will ensure the cron.deny
+## file has permissions of 600, or more restrictive.
+chmod 600 /etc/cron.deny
+
+## (GEN003240: CAT II) The SA will ensure the owner and
+## group owner of the cron.allow file is root.
+chown root:root /etc/cron.allow
+
+## (GEN003260: CAT II) The SA will ensure the owner and
+## group owner of the cron.deny file is root.
+chown root:root /etc/cron.deny
+
+## (GEN003300: CAT II) (Previously – G212) The SA will ensure the at.deny file
+## is not empty.
+awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/at.deny
+
+## (GEN003320: CAT II) (Previously – G213) The SA will ensure default system
+## accounts (with the possible exception of root) are not listed in the
+## at.allow file. If there is only an at.deny file, the default accounts
+## (with the possible exception of root) will be listed there.
+echo "root" > /etc/at.allow
+
+## (GEN003340: CAT II) (Previously – G214) The SA will ensure the at.allow and
+## at.deny files have permissions of 600, or more restrictive.
+chmod 600 /etc/at.allow
+chmod 600 /etc/at.deny
+
+## (GEN003400: CAT II) (Previously – G625) The SA will ensure the at (or
+## equivalent) directory has permissions of 755, or more restrictive.
+chmod 755 /var/spool/at/spool
+
+## (GEN003420: CAT II) (Previously – G626) The SA will ensure the owner and
+## group owner of the at (or equivalent) directory is root, sys, bin, or daemon.
+chown root:root /var/spool/at/spool
+
+## (GEN003460: CAT II) (Previously – G629) The SA will ensure the owner and
+## group owner of the at.allow file is root.
+chown root:root /etc/at.allow
+
+## (GEN003480: CAT II) (Previously – G630) The SA will ensure the owner and
+## group owner of the at.deny file is root.
+chown root:root /etc/at.deny
+
+## (GEN003500: CAT III) The SA will ensure core dumps are disabled or
+## restricted.
+echo "* - core 0" >> /etc/security/limits.conf
+
+## (GEN003520: CAT III) The SA will ensure the owner and group owner of the
+## core dump  data directory is root with permissions of 700, or more
+## restrictive.
+chown root:root /var/crash
+chmod -R 700 /var/crash
+
+## (GEN003600: CAT II) The SA will ensure network parameters are securely set.
+sed -i "/net\.ipv4\.conf\.default\.rp_filter/ c\net.ipv4.conf.default.rp_filter = 1" /etc/sysctl.conf
+sed -i "/net\.ipv4\.conf\.default\.accept_source_route/ c\net.ipv4.conf.default.accept_source_route = 0" /etc/sysctl.conf
+cat <<-EOF >> /etc/sysctl.conf
+        net.ipv4.tcp_max_syn_backlog = 1280
+        net.ipv4.icmp_echo_ignore_broadcasts = 1
+        net.ipv4.icmp_echo_ignore_all = 1
+EOF
+
+## (GEN003660: CAT II) The SA will ensure the authentication notice and
+## informational data is logged.
+echo "auth.notice                                               /var/log/messages" >> /etc/syslog.conf
+
+## (GEN003700: CAT II) The SA will ensure inetd (xinetd for Linux) is disabled
+## if all inetd/xinetd based services are disabled.
+/sbin/chkconfig bluetooth off
+/sbin/chkconfig irda off
+/sbin/chkconfig lm_sensors off
+/sbin/chkconfig portmap off
+/sbin/chkconfig rawdevices off
+/sbin/chkconfig rpcgssd off
+/sbin/chkconfig rpcidmapd off
+/sbin/chkconfig rpcsvcgssd off
+/sbin/chkconfig sendmail off
+/sbin/chkconfig xinetd off
+/sbin/chkconfig cups off
+/sbin/chkconfig rhnsd off
+/sbin/chkconfig autofs off
+
+## (GEN003740: CAT II) (Previously – G108) The SA will ensure the inetd.conf
+## (xinetd.conf for Linux) file has permissions of 440, or more restrictive.
+## The Linux xinetd.d directory will have permissions of 755, or more
+## restrictive. This is to include any directories defined in the includedir
+## parameter.
+chmod 755 /etc/xinetd.d
+chmod 440 /etc/xinetd.conf
+
+## (GEN003760: CAT II) (Previously – G109) The SA will ensure the owner of the
+## services file is root or bin.
+chown root /etc/services
+
+## (GEN003780: CAT II) (Previously – G110) The SA will ensure the services
+## file has permissions of 644, or more restrictive.
+chmod 644 /etc/services
+
+## (GEN003860: CAT III) (Previously – V046) The SA will ensure finger is not
+## enabled.
+/sbin/chkconfig finger off
+
+## (GEN003960: CAT II) (Previously – G631) The SA will ensure the owner of
+## the traceroute command is root.
+chown root /bin/traceroute
+
+## (GEN003980: CAT II) (Previously – G632) The SA will ensure the group
+## owner of the traceroute command is root, sys, or bin.
+chgrp root /bin/traceroute
+
+## (GEN004000: CAT II) (Previously – G633) The SA will ensure the traceroute
+## command has permissions of 700, or more restrictive.
+chmod 700 /bin/traceroute
+
+## (GEN004360: CAT II) (Previously – G127) The SA will ensure the aliases file
+## is owned by root.
+chown root /etc/aliases
+
+## (GEN004380: CAT II) (Previously – G128) The SA will ensure the aliases file
+## has permissions of 644, or more restrictive.
+chmod 644 /etc/aliases
+
+## (GEN004440: CAT IV) (Previously – G133) The SA will ensure the sendmail
+## logging level (the detail level of e-mail tracing and debugging
+## information) in the sendmail.cf file is set to a value no lower than
+## nine (9).
+sed -i '/LogLevel/ c\O LogLevel=9' /etc/mail/sendmail.cf
+
+## (GEN004480: CAT II) (Previously – G135) The SA will ensure the owner of the
+## critical sendmail log file is root.
+chown root /var/log/maillog
+
+## (GEN004500: CAT II) (Previously – G136) The SA will ensure the critical
+## sendmail log file has permissions of 644, or more restrictive.
+chmod 644 /var/log/maillog
+
+## (GEN004540: CAT II) The SA will ensure the help sendmail command is
+## disabled.
+mv /etc/mail/helpfile /etc/mail/helpfile.bak
+echo "" > /etc/mail/helpfile
+
+## (GEN004560: CAT II) (Previously – G646) To help mask the e-mail version,
+## the SA will use the following in place of the original sendmail greeting
+## message:
+##   O SmtpGreetingMessage= Mail Server Ready ; $b
+sed -i '/SmtpGreetingMessage/ c\O SmtpGreetingMessage= Mail Server Ready ; $b' /etc/mail/sendmail.cf
+
+## (GEN004580: CAT I) (Previously – G647) The SA will ensure .forward files
+## are not used.
+for HOMEDIR in `cut -d: -f6 /etc/passwd`; do
+if [ -f $HOMEDIR/.forward ]
+then
+        rm $HOMEDIR/.forward
+fi
+done;
+
+## (GEN004640: CAT I) (Previously – V126) The SA will ensure the decode entry
+## is disabled (deleted or commented out) from the alias file.
+sed --in-place s/^decode\:/\#decode\:/ /etc/aliases
+/usr/bin/newaliases
+
+## (GEN004880: CAT II) (Previously – G140) The SA will ensure the ftpusers
+## file exists.
+touch /etc/ftpusers
+
+## (GEN004900: CAT II) (Previously – G141) The SA will ensure the ftpusers
+## file contains the usernames of users not allowed to use FTP, and contains,
+## at a minimum, the system pseudo-users usernames and root.
+echo -n > /etc/ftpusers
+for NAME in `cut -d: -f1 /etc/passwd`; do
+        NAMEID=`id -u $NAME`
+        if [ $NAMEID -lt 500 ]; then
+                echo $NAME >> /etc/ftpusers
+        fi
+done;
+
+## (GEN004920: CAT II) (Previously – G142) The SA will ensure the owner of the
+## ftpusers file is root.
+chown root /etc/ftpusers
+
+## (GEN004940: CAT II) (Previously – G143) The SA will ensure the ftpusers
+## file has permissions of 640, or more restrictive.
+chmod 640 /etc/ftpusers
+
+## (GEN005000: CAT I) (Previously – G649) The SA will implement the anonymous