<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix http://oval.mitre.org/language/download/schema/version5.8/ovaldefinition/complete/unix-definitions-schema.xsd">
  <generator>
    <oval:product_name>repotool</oval:product_name>
    <oval:schema_version>5.8</oval:schema_version>
    <oval:timestamp>2016-12-22T10:13:22</oval:timestamp>
  </generator>
  <definitions>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1" version="1">
      <metadata>
        <title>The x86 Ctrl-Alt-Delete key sequence must be disabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The x86 Ctrl-Alt-Delete key sequence must be disabled.</description>
      </metadata>
      <criteria>
        <criterion comment="control-alt-delete.override is configured" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:100" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:112" version="3">
      <metadata>
        <title>Set Maximum Number of Concurrent Login Sessions Per User</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27457-1" source="http://cce.mitre.org" />
        <description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_max_concurrent_login_sessions" />
      </metadata>
      <criteria comment="the value maxlogins should be set appropriately in /etc/security/limits.conf">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:113" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:115" version="1">
      <metadata>
        <title>Service sshd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The sshd service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_sshd_disabled" />
      </metadata>
      <criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
        <extend_definition comment="openssh-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:140" />
        <criteria operator="AND" comment="service sshd is not configured to start">
          <criterion comment="sshd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1063" />
          <criterion comment="sshd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1064" />
          <criterion comment="sshd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1065" />
          <criterion comment="sshd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1066" />
          <criterion comment="sshd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1067" />
          <criterion comment="sshd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1068" />
          <criterion comment="sshd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1069" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:119" version="2">
      <metadata>
        <title>Package cronie Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cronie should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_cronie_installed" />
      </metadata>
      <criteria>
        <criterion comment="package cronie is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:120" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:121" version="3">
      <metadata>
        <title>Postfix network listening should be disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26780-7" source="http://cce.mitre.org" />
        <description>Postfix network listening should be disabled</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="postfix_network_listening_disabled" />
      </metadata>
      <criteria>
        <criterion comment="Check inet_interfaces in /etc/postfix/main.cf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2988" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:125" version="3">
      <metadata>
        <title>Record Attempts to Alter Time Through Clock_settime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27170-0" source="http://cce.mitre.org" />
        <description>Record attempts to alter time through clock_settime.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_time_clock_settime" />
      </metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:126" />
          <criterion comment="32bit line clock_settime and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:127" />
        </criteria>
        <criteria comment="both ..." operator="AND">
          <extend_definition comment="64bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" />
          <criterion comment="64bit line for clock_settime and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:129" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:126" version="3">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86 Architecture</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Generic test for x86 architecture to be used by other tests</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="system_info_architecture_x86" />
      </metadata>
      <criteria>
        <criterion comment="Generic test for x86 architecture" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:963" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:128" version="3">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86_64 Architecture</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Generic test for x86_64 architecture to be used by other tests</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="system_info_architecture_x86_64" />
      </metadata>
      <criteria>
        <criterion comment="Generic test for x86_64 architecture" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:692" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:130" version="1">
      <metadata>
        <title>Package ntpdate Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ntpdate should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_ntpdate_removed" />
      </metadata>
      <criteria>
        <criterion comment="package ntpdate is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:131" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:132" version="3">
      <metadata>
        <title>Service ntpdate Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27256-7" source="http://cce.mitre.org" />
        <description>The ntpdate service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_ntpdate_disabled" />
      </metadata>
      <criteria comment="package ntpdate removed or service ntpdate is not configured to start" operator="OR">
        <extend_definition comment="ntpdate removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:130" />
        <criteria operator="AND" comment="service ntpdate is not configured to start">
          <criterion comment="ntpdate runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:133" />
          <criterion comment="ntpdate runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:134" />
          <criterion comment="ntpdate runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:135" />
          <criterion comment="ntpdate runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:136" />
          <criterion comment="ntpdate runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:137" />
          <criterion comment="ntpdate runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:138" />
          <criterion comment="ntpdate runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:139" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:140" version="2">
      <metadata>
        <title>Package openssh-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package openssh-server should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_openssh-server_removed" />
      </metadata>
      <criteria>
        <criterion comment="package openssh-server is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:141" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:142" version="3">
      <metadata>
        <title>Service xinetd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27046-2" source="http://cce.mitre.org" />
        <description>The xinetd service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_xinetd_disabled" />
      </metadata>
      <criteria comment="package xinetd removed or service xinetd is not configured to start" operator="OR">
        <extend_definition comment="xinetd removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:143" />
        <criteria operator="AND" comment="service xinetd is not configured to start">
          <criterion comment="xinetd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:144" />
          <criterion comment="xinetd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:145" />
          <criterion comment="xinetd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:146" />
          <criterion comment="xinetd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:147" />
          <criterion comment="xinetd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:148" />
          <criterion comment="xinetd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:149" />
          <criterion comment="xinetd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:150" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:143" version="3">
      <metadata>
        <title>Package xinetd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27005-8" source="http://cce.mitre.org" />
        <description>The RPM package xinetd should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_xinetd_removed" />
      </metadata>
      <criteria>
        <criterion comment="package xinetd is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:741" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:153" version="3">
      <metadata>
        <title>Package screen Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26940-7" source="http://cce.mitre.org" />
        <description>The RPM package screen should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_screen_installed" />
      </metadata>
      <criteria>
        <criterion comment="package screen is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:154" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:157" version="4">
      <metadata>
        <title>Implement idle activation of screen saver</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26600-7" source="http://cce.mitre.org" />
        <description>Idle activation of the screen saver should be
      enabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="gconf_gnome_screensaver_idle_activation_enabled" />
      </metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:3447" negate="true" />
        <criterion comment="gnome screensaver is activated on idle" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:158" />
        <criterion comment="gnome screensaver is activated on idle" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3651" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:159" version="4">
      <metadata>
        <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26785-6" source="http://cce.mitre.org" />
        <description>Look for argument audit=1 in the kernel line in /boot/grub/grub.conf.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="bootloader_audit_argument" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:160" comment="check for audit=1 in /boot/grub/grub.conf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:161" version="3">
      <metadata>
        <title>Ensure /var Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26639-5" source="http://cce.mitre.org" />
        <description>Ensuring that /var is mounted on its own partition enables
      the setting of more restrictive mount options, which is used as temporary
      storage by many program, particularly system services such as daemons. It
      is not uncommon for the /var directory to contain world-writable
      directories, installed by other software packages.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="partition_for_var" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:162" comment="/var on own partition" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:165" version="3">
      <metadata>
        <title>Service postfix Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26325-1" source="http://cce.mitre.org" />
        <description>The postfix service should be enabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_postfix_enabled" />
      </metadata>
      <criteria comment="package postfix installed and service postfix is configured to start" operator="AND">
        <extend_definition comment="postfix installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:166" />
        <criteria operator="OR" comment="service postfix is configured to start">
          <criterion comment="postfix runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:167" />
          <criterion comment="postfix runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:168" />
          <criterion comment="postfix runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:169" />
          <criterion comment="postfix runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:170" />
          <criterion comment="postfix runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:171" />
          <criterion comment="postfix runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:172" />
          <criterion comment="postfix runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:173" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:166" version="2">
      <metadata>
        <title>Package postfix Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package postfix should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_postfix_installed" />
      </metadata>
      <criteria>
        <criterion comment="package postfix is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1021" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:174" version="3">
      <metadata>
        <title>Service ntpd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27093-4" source="http://cce.mitre.org" />
        <description>The ntpd service should be enabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_ntpd_enabled" />
      </metadata>
      <criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
        <extend_definition comment="ntp installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:175" />
        <criteria operator="OR" comment="service ntpd is configured to start">
          <criterion comment="ntpd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:176" />
          <criterion comment="ntpd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:177" />
          <criterion comment="ntpd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:178" />
          <criterion comment="ntpd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:179" />
          <criterion comment="ntpd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:180" />
          <criterion comment="ntpd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:181" />
          <criterion comment="ntpd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:182" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:175" version="2">
      <metadata>
        <title>Package ntp Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ntp should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_ntp_installed" />
      </metadata>
      <criteria>
        <criterion comment="package ntp is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:693" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:183" version="3">
      <metadata>
        <title>Service qpidd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26928-2" source="http://cce.mitre.org" />
        <description>The qpidd service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_qpidd_disabled" />
      </metadata>
      <criteria comment="package qpid-cpp-server removed or service qpidd is not configured to start" operator="OR">
        <extend_definition comment="qpid-cpp-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:184" />
        <criteria operator="AND" comment="service qpidd is not configured to start">
          <criterion comment="qpidd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:185" />
          <criterion comment="qpidd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:186" />
          <criterion comment="qpidd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:187" />
          <criterion comment="qpidd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:188" />
          <criterion comment="qpidd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:189" />
          <criterion comment="qpidd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:190" />
          <criterion comment="qpidd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:191" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:184" version="2">
      <metadata>
        <title>Package qpid-cpp-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package qpid-cpp-server should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_qpid-cpp-server_removed" />
      </metadata>
      <criteria>
        <criterion comment="package qpid-cpp-server is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:783" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:197" version="4">
      <metadata>
        <title>Disable IPv6 Kernel Module Functionality via Disable Option</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27153-6" source="http://cce.mitre.org" />
        <description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="kernel_module_ipv6_option_disabled" />
      </metadata>
      <criteria operator="OR" comment="Check if ipv6 was disabled in /etc/sysctl.conf or in /etc/modprobe.d">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:355" comment="ipv6 disabled any modprobe conf file" />
        <criteria operator="AND" comment="Make sure that the /etc/sysctl.conf file is configured correctly and the option is configured correctly in the running kernel using sysctl.">
          <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:19700" comment="ipv6 disabled in /etc/sysctl.conf file" />
          <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:19701" comment="ipv6 disabled reported using sysctl." />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:205" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lchown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27181-7" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_lchown" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification lchown x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:206" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification lchown x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:207" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:208" version="4">
      <metadata>
        <title>Disable DHCP Client</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27021-5" source="http://cce.mitre.org" />
        <description>DHCP configuration should be static for all
      interfaces.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysconfig_networking_bootproto_ifcfg" />
      </metadata>
      <criteria comment="Test for BOOTPROTO=none across all interfaces">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3005" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:210" version="3">
      <metadata>
        <title>Ensure Only Protocol 2 Connections Allowed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27072-8" source="http://cce.mitre.org" />
        <description>The OpenSSH daemon should be running protocol 2.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_protocol_2" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <extend_definition comment="rpm package openssh-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:140" />
        <criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:211" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:220" version="3">
      <metadata>
        <title>Service rsh Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26994-4" source="http://cce.mitre.org" />
        <description>The rsh service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_rsh_disabled" />
      </metadata>
      <criteria comment="package rsh-server removed or service rsh is not configured to start" operator="OR">
        <extend_definition comment="rpm package rsh-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:221" />
        <criterion comment="rsh disabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:222" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:221" version="3">
      <metadata>
        <title>Package rsh-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27062-9" source="http://cce.mitre.org" />
        <description>The RPM package rsh-server should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_rsh-server_removed" />
      </metadata>
      <criteria>
        <criterion comment="package rsh-server is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:962" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:223" version="2">
      <metadata>
        <title>Package oddjob Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package oddjob should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_oddjob_removed" />
      </metadata>
      <criteria>
        <criterion comment="package oddjob is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:224" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:238" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.ip_forward" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26866-4" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.ip_forward" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_ip_forward" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3076" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.ip_forward set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3077" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:240" version="3">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values set for bash</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26917-5" source="http://cce.mitre.org" />
        <description>The default umask for users of the bash shell</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_umask_bashrc" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:241" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:244" version="5">
      <metadata>
        <title>Disable rds Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26239-4" source="http://cce.mitre.org" />
        <description>The kernel module rds should be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="kernel_module_rds_disabled" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:245" comment="kernel module rds disabled in /etc/modprobe.d" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3009" comment="kernel module rds disabled in /etc/modprobe.conf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:257" version="3">
      <metadata>
        <title>Change the default policy to DROP (from ACCEPT) for
      the INPUT built-in chain</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26444-0" source="http://cce.mitre.org" />
        <description>Change the default policy to DROP (from ACCEPT)
      for the INPUT built-in chain.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="iptables_default_policy_drop" />
      </metadata>
      <criteria>
        <criterion comment=":INPUT DROP [0:0]" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:258" />
        <criterion comment=":INPUT ACCEPT [0:0]" negate="true" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:259" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:268" version="4">
      <metadata>
        <title>Audit Information Export To Media</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26573-6" source="http://cce.mitre.org" />
        <description>Audit rules that detect the mounting of filesystems should be enabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_media_export" />
      </metadata>
      <criteria>
        <criterion comment="audit mount" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:269" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:272" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.icmp_echo_ignore_broadcasts" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26883-9" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.icmp_echo_ignore_broadcasts" should be set to "1".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3035" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3036" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:274" version="3">
      <metadata>
        <title>Package sendmail Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27515-6" source="http://cce.mitre.org" />
        <description>The RPM package sendmail should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_sendmail_removed" />
      </metadata>
      <criteria>
        <criterion comment="package sendmail is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:275" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:276" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - chown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27173-4" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_chown" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification chown x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:277" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification chown x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:278" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:283" version="3">
      <metadata>
        <title>Service abrtd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27247-6" source="http://cce.mitre.org" />
        <description>The abrtd service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_abrtd_disabled" />
      </metadata>
      <criteria comment="package abrt removed or service abrtd is not configured to start" operator="OR">
        <extend_definition comment="abrt removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:284" />
        <criteria operator="AND" comment="service abrtd is not configured to start">
          <criterion comment="abrtd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:285" />
          <criterion comment="abrtd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:286" />
          <criterion comment="abrtd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:287" />
          <criterion comment="abrtd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:288" />
          <criterion comment="abrtd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:289" />
          <criterion comment="abrtd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:290" />
          <criterion comment="abrtd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:291" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:284" version="2">
      <metadata>
        <title>Package abrt Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package abrt should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_abrt_removed" />
      </metadata>
      <criteria>
        <criterion comment="package abrt is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:949" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:292" version="2">
      <metadata>
        <title>Audit User/Group Information</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26664-3" source="http://cce.mitre.org" />
        <description>Audit rules should detect modification to system files that hold information about users and groups.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_usergroup_modification" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="audit /etc/group" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:293" />
        <criterion comment="audit /etc/passwd" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:294" />
        <criterion comment="audit /etc/gshadow" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:295" />
        <criterion comment="audit /etc/shadow" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:296" />
        <criterion comment="audit /etc/security/opasswd" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:297" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:301" version="3">
      <metadata>
        <title>No Legacy .rhosts Or hosts.equiv Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27270-8" source="http://cce.mitre.org" />
        <description>There should not be any .rhosts or hosts.equiv files on the system.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="no_rsh_trust_files" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:302" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:303" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:304" negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:305" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - setxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27185-8" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_setxattr" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification setxattr x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:306" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification setxattr x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:307" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:308" version="4">
      <metadata>
        <title>All Password Hashes Shadowed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26476-2" source="http://cce.mitre.org" />
        <description>All password hashes should be shadowed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_password_all_shadowed" />
      </metadata>
      <criteria>
        <criterion comment="password hashes are shadowed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:309" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:310" version="3">
      <metadata>
        <title>Record Attempts to Alter Time Through Settimeofday</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27203-9" source="http://cce.mitre.org" />
        <description>Record attempts to alter time through settimeofday.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_time_settimeofday" />
      </metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:126" />
          <criterion comment="32bit line settimeofday and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:311" />
        </criteria>
        <criteria comment="both ..." operator="AND">
          <extend_definition comment="64bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" />
          <criterion comment="64bit line for settimeofday and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:312" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:322" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lremovexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27182-5" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_lremovexattr" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification lremovexattr x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:323" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification lremovexattr x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:324" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:325" version="3">
      <metadata>
        <title>Verify group who owns 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26930-8" source="http://cce.mitre.org" />
        <description>The /etc/group file should be owned by the appropriate
      group.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_groupowner_etc_group" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3102" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:327" version="2">
      <metadata>
        <title>Service atd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27249-2" source="http://cce.mitre.org" />
        <description>The atd service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_atd_disabled" />
      </metadata>
      <criteria comment="package at removed or service atd is not configured to start" operator="OR">
        <extend_definition comment="at removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:328" />
        <criteria operator="AND" comment="service atd is not configured to start">
          <criterion comment="atd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:329" />
          <criterion comment="atd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:330" />
          <criterion comment="atd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:331" />
          <criterion comment="atd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:332" />
          <criterion comment="atd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:333" />
          <criterion comment="atd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:334" />
          <criterion comment="atd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:335" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:328" version="2">
      <metadata>
        <title>Package at Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package at should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_at_removed" />
      </metadata>
      <criteria>
        <criterion comment="package at is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:476" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:380" version="3">
      <metadata>
        <title>Service oddjobd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27257-5" source="http://cce.mitre.org" />
        <description>The oddjobd service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_oddjobd_disabled" />
      </metadata>
      <criteria comment="package oddjob removed or service oddjobd is not configured to start" operator="OR">
        <extend_definition comment="oddjob removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:223" />
        <criteria operator="AND" comment="service oddjobd is not configured to start">
          <criterion comment="oddjobd runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:381" />
          <criterion comment="oddjobd runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:382" />
          <criterion comment="oddjobd runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:383" />
          <criterion comment="oddjobd runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:384" />
          <criterion comment="oddjobd runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:385" />
          <criterion comment="oddjobd runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:386" />
          <criterion comment="oddjobd runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:387" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:396" version="3">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values in
      /etc/login.defs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26371-5" source="http://cce.mitre.org" />
        <description>The default umask for all users specified in /etc/login.defs</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_umask_login_defs" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:397" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:418" version="3">
      <metadata>
        <title>Service bluetooth Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27081-9" source="http://cce.mitre.org" />
        <description>The bluetooth service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_bluetooth_disabled" />
      </metadata>
      <criteria operator="AND" comment="service bluetooth is not configured to start">
        <criterion comment="bluetooth runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:419" />
        <criterion comment="bluetooth runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:420" />
        <criterion comment="bluetooth runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:421" />
        <criterion comment="bluetooth runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:422" />
        <criterion comment="bluetooth runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:423" />
        <criterion comment="bluetooth runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:424" />
        <criterion comment="bluetooth runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:425" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:434" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lsetxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27183-3" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_lsetxattr" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification lsetxattr x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:435" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification lsetxattr x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:436" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:445" version="4">
      <metadata>
        <title>The system must require passwords to contain a minimum of 15 characters.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27002-5" source="http://cce.mitre.org" />
        <description>The password minimum length should be set appropriately.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_password_minlen_login_defs" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:447" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:450" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchown</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27177-5" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_fchown" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchown x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:451" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification fchown x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:452" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:453" version="5">
      <metadata>
        <title>Set Password dcredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26374-9" source="http://cce.mitre.org" />
        <description>The password dcredit should meet minimum
      requirements using pam_cracklib</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_password_pam_cracklib_dcredit" />
      </metadata>
      <criteria operator="OR">
        <criterion comment="check the password dcredit configuration of /etc/pam.d/system-auth -appears not first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:45300" />
        <criterion comment="check the password dcredit configuration of /etc/pam.d/system-auth -appears first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:45301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:461" version="3">
      <metadata>
        <title>Audit Kernel Module Loading and Unloading</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26611-4" source="http://cce.mitre.org" />
        <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_kernel_module_loading" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="audit insmod" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:462" />
        <criterion comment="audit rmmod" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:463" />
        <criterion comment="audit rmmod" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:464" />
        <criterion comment="audit module syscalls" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:465" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:468" version="3">
      <metadata>
        <title>Package ypserv Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27079-3" source="http://cce.mitre.org" />
        <description>The RPM package ypserv should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_ypserv_removed" />
      </metadata>
      <criteria>
        <criterion comment="package ypserv is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:469" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:470" version="4">
      <metadata>
        <title>Disable telnet Service</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26836-7" source="http://cce.mitre.org" />
        <description>Disable telnet Service</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_telnetd_disabled" />
      </metadata>
      <criteria comment="package telnet-server removed or service telnetd is not configured to start" operator="OR">
        <extend_definition comment="rpm package telnet-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:604" />
        <criterion comment="Disable telnet Service" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:471" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:472" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.default.secure_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26831-8" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.default.secure_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_default_secure_redirects" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3088" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.secure_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3089" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:474" version="4">
      <metadata>
        <title>Set Password ocredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26409-3" source="http://cce.mitre.org" />
        <description>The password ocredit should meet minimum
      requirements using pam_cracklib</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check the password ocredit configuration of /etc/pam.d/system-auth -appears not first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:47400" />
        <criterion comment="check the password ocredit configuration of /etc/pam.d/system-auth -appears first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:47401" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:477" version="4">
      <metadata>
        <title>Implement blank screen saver</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26638-7" source="http://cce.mitre.org" />
        <description>The screen saver should be blank.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="gconf_gnome_screensaver_mode_blank" />
      </metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:3447" negate="true" />
        <criterion comment="gnome screensaver set to blank screen" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:478" />
        <criterion comment="gnome screensaver set to blank screen" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3662" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:488" version="6">
      <metadata>
        <title>The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (system-auth).</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26303-8" source="http://cce.mitre.org" />
        <description>Using a stronger hashing algorithm makes password cracking attacks more difficult.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="set_password_hashing_algorithm_systemauth" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4890" comment="Check the files in /etc/pam.d/ to see if the password sufficient section for pam_unix.so uses sha512" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4891" comment="Check to see if any files with the correct password configuration exist." />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4892" comment="Check the file /etc/pam.d/password-auth to see if the password section for pam_unix.so uses sha512." />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4893" comment="Check the file /etc/pam.d/password-auth-ac to see if the password section for pam_unix.so uses sha512." />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4894" comment="Check the file /etc/pam.d/system-auth to see if the password section for pam_unix.so uses sha512." />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4895" comment="Check the file /etc/pam.d/system-auth-ac to see if the password section for pam_unix.so uses sha512." />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:4896" comment="Check the files in /etc/pam.d to make sure md5, sha256, blowfish or big_crypt are not used." negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:490" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.all.secure_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26854-0" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.all.secure_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_all_secure_redirects" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2981" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.secure_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2982" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:494" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchmod</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27174-2" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_fchmod" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchmod x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:495" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification fchmod x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:496" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:497" version="3">
      <metadata>
        <title>Ensure /var/log Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26215-4" source="http://cce.mitre.org" />
        <description>System logs are stored in the /var/log directory. Ensure
      that it has its own partition or logical volume.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="partition_for_var_log" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:498" comment="/var/log on own partition" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:508" version="2">
      <metadata>
        <title>File /boot/grub/grub.conf Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26949-8" source="http://cce.mitre.org" />
        <description>File permissions for /boot/grub/grub.conf should be set to 0600.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_grub_conf" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:509" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:510" version="3">
      <metadata>
        <title>Restrict Serial Port Root Logins</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27047-0" source="http://cce.mitre.org" />
        <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="restrict_serial_port_logins" />
      </metadata>
      <criteria>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:511" negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:523" version="4">
      <metadata>
        <title>Set Password difok Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26615-5" source="http://cce.mitre.org" />
        <description>The password difok should meet minimum
      requirements using pam_cracklib</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="Conditions for difok are satisfied" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:52300" />
        <criterion comment="Conditions for difok are satisfied" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:52301" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:525" version="4">
      <metadata>
        <title>Users must not be able to change passwords more than once every 24 hours.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27013-2" source="http://cce.mitre.org" />
        <description>The minimum password age policy should be set appropriately.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_minimum_age_login_defs" />
      </metadata>
      <criteria comment="the value PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:526" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:527" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.tcp_syncookies" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27053-8" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.tcp_syncookies" should be set to "1".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_tcp_syncookies" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3049" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.tcp_syncookies set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3050" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:540" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.default.rp_filter" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26915-9" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.default.rp_filter" should be set to "1".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_default_rp_filter" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3123" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.rp_filter set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3124" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:542" version="4">
      <metadata>
        <title>Record Attempts to Alter Time Through Adjtimex</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26242-8" source="http://cce.mitre.org" />
        <description>Record attempts to alter time through adjtimex.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_time_adjtimex" />
      </metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:126" />
          <criterion comment="32bit line adjtimex and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:543" />
        </criteria>
        <criteria comment="both ..." operator="AND">
          <extend_definition comment="64bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" />
          <criterion comment="64bit line for adjtimex and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:544" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:548" version="2">
      <metadata>
        <title>Auditd Email Account to Notify Upon Action</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27241-9" source="http://cce.mitre.org" />
        <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="auditd_data_retention_action_mail_acct" />
      </metadata>
      <criteria>
        <criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:549" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:554" version="3">
      <metadata>
        <title>Verify user who owns 'passwd' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26953-0" source="http://cce.mitre.org" />
        <description>The /etc/passwd file should be owned by the appropriate
      user.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_owner_etc_passwd" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3084" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:556" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27027-2" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.all.accept_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_all_accept_redirects" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3113" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.accept_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3114" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:558" version="3">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values in
      /etc/profile</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26669-2" source="http://cce.mitre.org" />
        <description>The default umask for all users should be set
      correctly</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_umask_etc_profile" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:559" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:598" version="4">
      <metadata>
        <title>Configure GUI Screen Locking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26828-4" source="http://cce.mitre.org" />
        <description>The allowed period of inactivity before the screensaver is
      activated.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="gconf_gnome_screensaver_idle_delay" />
      </metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:3447" negate="true" />
        <criterion comment="check value of idle_delay in GCONF" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:599" />
        <criterion comment="check value of idle_delay in GCONF" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3670" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:604" version="4">
      <metadata>
        <title>Package telnet-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27073-6" source="http://cce.mitre.org" />
        <description>The RPM package telnet-server should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_telnet-server_removed" />
      </metadata>
      <criteria>
        <criterion comment="package telnet-server is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:605" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:606" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.default.send_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27001-7" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.default.send_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_default_send_redirects" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3085" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3086" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:617" version="4">
      <metadata>
        <title>User passwords must be changed at least every 60 days.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26985-2" source="http://cce.mitre.org" />
        <description>The maximum password age policy should meet
      minimum requirements.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_maximum_age_login_defs" />
      </metadata>
      <criteria comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:618" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:619" version="2">
      <metadata>
        <title>Record Events that Modify the System's Mandatory Access Controls</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26657-7" source="http://cce.mitre.org" />
        <description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_mac_modification" />
      </metadata>
      <criteria>
        <criterion comment="audit changes selinux" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:620" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:621" version="3">
      <metadata>
        <title>Service autofs Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26976-1" source="http://cce.mitre.org" />
        <description>The autofs service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_autofs_disabled" />
      </metadata>
      <criteria operator="AND" comment="service autofs is not configured to start">
        <criterion comment="autofs runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:622" />
        <criterion comment="autofs runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:623" />
        <criterion comment="autofs runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:624" />
        <criterion comment="autofs runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:625" />
        <criterion comment="autofs runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:626" />
        <criterion comment="autofs runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:627" />
        <criterion comment="autofs runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:628" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:629" version="3">
      <metadata>
        <title>Enable SELinux</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <reference ref_id="CCE-26875-5" source="http://cce.mitre.org" />
        <description>The SELinux policy should be set appropriately.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="selinux_policytype" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:630" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:631" version="3">
      <metadata>
        <title>Service ypbind Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26894-6" source="http://cce.mitre.org" />
        <description>The ypbind service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_ypbind_disabled" />
      </metadata>
      <criteria comment="package ypbind removed or service ypbind is not configured to start" operator="OR">
        <extend_definition comment="ypbind removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:632" />
        <criteria operator="AND" comment="service ypbind is not configured to start">
          <criterion comment="ypbind runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:633" />
          <criterion comment="ypbind runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:634" />
          <criterion comment="ypbind runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:635" />
          <criterion comment="ypbind runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:636" />
          <criterion comment="ypbind runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:637" />
          <criterion comment="ypbind runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:638" />
          <criterion comment="ypbind runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:639" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:632" version="2">
      <metadata>
        <title>Package ypbind Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ypbind should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_ypbind_removed" />
      </metadata>
      <criteria>
        <criterion comment="package ypbind is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1115" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:644" version="3">
      <metadata>
        <title>Restrict Virtual Console Root Logins</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26855-7" source="http://cce.mitre.org" />
        <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="securetty_root_login_console_only" />
      </metadata>
      <criteria>
        <criterion comment="virtual consoles /etc/securetty" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:645" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:649" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_source_route" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26983-7" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.default.accept_source_route" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_default_accept_source_route" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3033" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.accept_source_route set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3034" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:651" version="4">
      <metadata>
        <title>Users must be warned 7 days in advance of password expiration.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26988-6" source="http://cce.mitre.org" />
        <description>The password expiration warning age should be set appropriately.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_password_warn_age_login_defs" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:652" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:661" version="3">
      <metadata>
        <title>Package tftp-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26946-4" source="http://cce.mitre.org" />
        <description>The RPM package tftp-server should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_tftp-server_removed" />
      </metadata>
      <criteria>
        <criterion comment="package tftp-server is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:662" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:663" version="5">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values set for csh</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27034-8" source="http://cce.mitre.org" />
        <description>The default umask for users of the csh shell</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_umask_cshrc" />
      </metadata>
      <criteria operator="OR" comment="tcsh is not installed or csh.cshrc exist">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:664" />
        <criteria operator="AND" comment="tcsh is not installed or csh.cshrc exist">
          <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:6640" />
          <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:6641" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:665" version="3">
      <metadata>
        <title>Specify a Remote NTP Server for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27098-3" source="http://cce.mitre.org" />
        <description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="ntp_remote_server" />
      </metadata>
      <criteria comment="ntp.conf conditions are met">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3063" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:667" version="3">
      <metadata>
        <title>Auditd Action to Take When Disk is Low on Space</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27239-3" source="http://cce.mitre.org" />
        <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      </metadata>
      <criteria>
        <criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:668" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:669" version="4">
      <metadata>
        <title>Implement idle activation of screen lock</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26235-2" source="http://cce.mitre.org" />
        <description>Idle activation of the screen lock should be
      enabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="gconf_gnome_screensaver_lock_enabled" />
      </metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:3447" negate="true" />
        <criterion comment="screensaver lock is enabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:670" />
        <criterion comment="screensaver lock is enabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3634" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:671" version="2">
      <metadata>
        <title>Package samba-common Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba-common should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_samba-common_removed" />
      </metadata>
      <criteria>
        <criterion comment="package samba-common is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:672" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:688" version="3">
      <metadata>
        <title>Disable X Windows Startup By Setting Runlevel</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27119-7" source="http://cce.mitre.org" />
        <description>Checks /etc/inittab to ensure that default runlevel is set to 3.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="xwindows_runlevel_setting" />
      </metadata>
      <criteria>
        <criterion comment="default runlevel is 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:689" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:702" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.all.log_martians" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27066-0" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.all.log_martians" should be set to "1".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_all_log_martians" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2990" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.log_martians set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2991" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:714" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fremovexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27179-1" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_fremovexattr" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fremovexattr x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:715" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification fremovexattr x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:716" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:717" version="2">
      <metadata>
        <title>Package iputils Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package iputils should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_iputils_removed" />
      </metadata>
      <criteria>
        <criterion comment="package iputils is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:718" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:719" version="6">
      <metadata>
        <title>The system must disable accounts after three consecutive unsuccessful logon attempts.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <reference ref_id="CCE-26844-1" source="http://cce.mitre.org" />
        <description>The number of allowed failed logins should be set correctly.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_passwords_pam_faillock_deny" />
      </metadata>
      <criteria>
        <criterion comment="pam_faillock.so preauth deny value set in system-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:7190" />
        <criterion comment="pam_faillock.so authfail deny value set in system-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3761" />
        <criterion comment="account required pam_faillock.so set in system-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:720" />
        <criterion comment="pam_faillock.so preauth deny value set in system-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:7191" />
        <criterion comment="pam_faillock.so authfail deny value set in password-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:721" />
        <criterion comment="account required pam_faillock.so set in password-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3762" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:727" version="3">
      <metadata>
        <title>Verify /etc/gshadow Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26951-4" source="http://cce.mitre.org" />
        <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_etc_gshadow" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:728" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:739" version="3">
      <metadata>
        <title>Verify group who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26975-3" source="http://cce.mitre.org" />
        <description>The /etc/gshadow file should be owned by the appropriate
      group.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_groupowner_etc_gshadow" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3039" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:746" version="5">
      <metadata>
        <title>Disable dccp Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26448-1" source="http://cce.mitre.org" />
        <description>The kernel module dccp should be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="kernel_module_dccp_disabled" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:747" comment="kernel module dccp disabled in /etc/modprobe.d" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3087" comment="kernel module dccp disabled in /etc/modprobe.conf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:748" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchownat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27178-3" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_fchownat" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchownat x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:749" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification fchownat x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:750" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:751" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fsetxattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27180-9" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_fsetxattr" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fsetxattr x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:752" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification fsetxattr x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:753" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:754" version="3">
      <metadata>
        <title>Service avahi-daemon Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27087-6" source="http://cce.mitre.org" />
        <description>The avahi-daemon service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_avahi-daemon_disabled" />
      </metadata>
      <criteria operator="AND" comment="service avahi-daemon is not configured to start">
        <criterion comment="avahi-daemon runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:755" />
        <criterion comment="avahi-daemon runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:756" />
        <criterion comment="avahi-daemon runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:757" />
        <criterion comment="avahi-daemon runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:758" />
        <criterion comment="avahi-daemon runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:759" />
        <criterion comment="avahi-daemon runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:760" />
        <criterion comment="avahi-daemon runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:761" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:763" version="3">
      <metadata>
        <title>Require Client SMB Packet Signing in smb.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26328-5" source="http://cce.mitre.org" />
        <description>Require samba clients which use smb.conf, such as smbclient,
      to use packet signing. A Samba client should only communicate with
      servers who can support SMB packet signing.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="smb_client_signing_smb_conf" />
      </metadata>
      <criteria operator="OR">
        <extend_definition comment="package samba-common is not installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:671" />
        <criterion comment="check for client signing = mandatory in /etc/samba/smb.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2999" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:773" version="2">
      <metadata>
        <title>Verify /var/log/audit Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27244-3" source="http://cce.mitre.org" />
        <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_ownership_var_log_audit" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:774" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:775" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:781" version="3">
      <metadata>
        <title>Verify /etc/shadow Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26992-8" source="http://cce.mitre.org" />
        <description>This test makes sure that /etc/shadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_etc_shadow" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:782" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:818" version="3">
      <metadata>
        <title>Service crond Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27070-2" source="http://cce.mitre.org" />
        <description>The crond service should be enabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_crond_enabled" />
      </metadata>
      <criteria comment="package cronie installed and service crond is configured to start" operator="AND">
        <extend_definition comment="cronie installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:119" />
        <criteria operator="OR" comment="service crond is configured to start">
          <criterion comment="crond runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:819" />
          <criterion comment="crond runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:820" />
          <criterion comment="crond runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:821" />
          <criterion comment="crond runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:822" />
          <criterion comment="crond runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:823" />
          <criterion comment="crond runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:824" />
          <criterion comment="crond runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:825" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:826" version="3">
      <metadata>
        <title>Service rexec Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27208-8" source="http://cce.mitre.org" />
        <description>The rexec service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_rexec_disabled" />
      </metadata>
      <criteria comment="package rsh-server removed or service rexec is not configured to start" operator="OR">
        <extend_definition comment="rpm package rsh-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:221" />
        <criterion comment="rexec disabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:827" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:828" version="4">
      <metadata>
        <title>Service iptables Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27018-1" source="http://cce.mitre.org" />
        <description>The iptables service should be enabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_iptables_enabled" />
      </metadata>
      <criteria comment="package iptables installed and service iptables is configured to start" operator="AND">
        <extend_definition comment="iptables installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:829" />
        <criteria operator="OR" comment="service iptables is configured to start">
          <criterion comment="iptables runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:830" />
          <criterion comment="iptables runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:831" />
          <criterion comment="iptables runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:832" />
          <criterion comment="iptables runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:833" />
          <criterion comment="iptables runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:834" />
          <criterion comment="iptables runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:835" />
          <criterion comment="iptables runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:836" />
        </criteria>
        <criterion comment="iptables has an entry in /var/lock/subsys" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:837" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:829" version="2">
      <metadata>
        <title>Package iptables Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package iptables should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_iptables_installed" />
      </metadata>
      <criteria>
        <criterion comment="package iptables is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:878" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:845" version="3">
      <metadata>
        <title>Record Attempts to Alter Time Through Stime</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27169-2" source="http://cce.mitre.org" />
        <description>Record attempts to alter time through stime, note that this
 is only relevant on 32bit architecture.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_time_stime" />
      </metadata>
      <criteria comment="Test for either..." operator="OR">
        <criteria comment="both..." operator="AND">
          <extend_definition comment="32bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:126" />
          <criterion comment="32bit line stime and key present" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:846" />
        </criteria>
        <criteria comment="both ...">
          <extend_definition comment="64bit and ..." definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:852" version="3">
      <metadata>
        <title>Package openldap-servers Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26858-1" source="http://cce.mitre.org" />
        <description>The RPM package openldap-servers should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_openldap-servers_removed" />
      </metadata>
      <criteria>
        <criterion comment="package openldap-servers is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:853" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:854" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - chmod</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26280-8" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_chmod" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification chmod x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:855" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification chmod x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:856" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:857" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.icmp_ignore_bogus_error_responses" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26993-6" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.icmp_ignore_bogus_error_responses" should be set to "1".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3130" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3131" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:863" version="3">
      <metadata>
        <title>Audit System Administrator Actions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26662-7" source="http://cce.mitre.org" />
        <description>Audit actions taken by system administrators on the system.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_sysadmin_actions" />
      </metadata>
      <criteria>
        <criterion comment="audit sudoers" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:864" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:865" version="3">
      <metadata>
        <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27238-5" source="http://cce.mitre.org" />
        <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="auditd_data_retention_space_left_action" />
      </metadata>
      <criteria>
        <criterion comment="space_left_action setting in auditd.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:866" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:867" version="3">
      <metadata>
        <title>Set Last Logon/Access Notification</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27291-4" source="http://cce.mitre.org" />
        <description>Configure the system to notify users of last logon/access using pam_lastlog.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="display_login_attempts" />
      </metadata>
      <criteria>
        <criterion comment="Conditions for pam_lastlog are satisfied" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:868" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:869" version="3">
      <metadata>
        <title>File grub.conf Owned By root Group</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27022-3" source="http://cce.mitre.org" />
        <description>The grub.conf file should be owned by the root group. By default, this file is located at /boot/grub/grub.conf or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_group_owner_grub_conf" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:870" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3002" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:874" version="3">
      <metadata>
        <title>Send Logs to a Remote Loghost</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26801-1" source="http://cce.mitre.org" />
        <description>Syslog logs should be sent to a remote loghost</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="rsyslog_remote_loghost" />
      </metadata>
      <criteria operator="OR">
        <criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3016" />
        <criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3017" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:879" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.all.rp_filter" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26979-5" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.all.rp_filter" should be set to "1".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_all_rp_filter" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3119" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.rp_filter set to 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3120" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:904" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchmodat</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27175-9" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_fchmodat" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification fchmodat x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:905" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification fchmodat x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:906" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:907" version="3">
      <metadata>
        <title>File grub.conf Owned By root User</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26995-1" source="http://cce.mitre.org" />
        <description>The grub.conf file should be owned by the root user. By default, this file is located at /boot/grub/grub.conf or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_user_owner_grub_conf" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:908" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3013" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:924" version="2">
      <metadata>
        <title>Auditd Maximum Log File Size</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27550-3" source="http://cce.mitre.org" />
        <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="auditd_data_retention_max_log_file" />
      </metadata>
      <criteria>
        <criterion comment="max_log_file setting in auditd.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:925" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:926" version="3">
      <metadata>
        <title>UID 0 Belongs Only To Root</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26971-2" source="http://cce.mitre.org" />
        <description>Only the root account should be assigned a user id of 0.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_no_uid_except_zero" />
      </metadata>
      <criteria>
        <criterion comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:927" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:937" version="3">
      <metadata>
        <title>Ensure Yum gpgcheck Globally Activated</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26709-6" source="http://cce.mitre.org" />
        <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="yum_gpgcheck_global_activation" />
      </metadata>
      <criteria>
        <criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:938" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:939" version="3">
      <metadata>
        <title>Ensure /home Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26557-9" source="http://cce.mitre.org" />
        <description>If user home directories will be stored locally, create a
      separate partition for /home. If /home will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="partition_for_home" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:940" comment="/home on own partition" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:941" version="3">
      <metadata>
        <title>Service netconsole Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27254-2" source="http://cce.mitre.org" />
        <description>The netconsole service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_netconsole_disabled" />
      </metadata>
      <criteria operator="AND" comment="service netconsole is not configured to start">
        <criterion comment="netconsole runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:942" />
        <criterion comment="netconsole runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:943" />
        <criterion comment="netconsole runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:944" />
        <criterion comment="netconsole runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:945" />
        <criterion comment="netconsole runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:946" />
        <criterion comment="netconsole runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:947" />
        <criterion comment="netconsole runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:948" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:960" version="5">
      <metadata>
        <title>Disable usb-storage Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27016-5" source="http://cce.mitre.org" />
        <description>The kernel module usb-storage should be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="kernel_module_usb-storage_disabled" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:961" comment="kernel module usb-storage disabled in /etc/modprobe.d" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2995" comment="kernel module usb-storage disabled in /etc/modprobe.conf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:964" version="5">
      <metadata>
        <title>All rsyslog-generated log files must be owned by root</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26812-8" source="http://cce.mitre.org" />
        <description>All syslog log files should be owned by the
      appropriate user.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="rsyslog_files_ownership" />
      </metadata>
      <criteria comment="evaluate to true if no configuration, handling tool error results" negate="true">
        <criterion comment="Files referenced in /etc/rsyslog.conf are owned by root" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:965" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:96400" comment="/etc/rsyslog.conf log file configuration exists" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:969" version="3">
      <metadata>
        <title>Verify group who owns 'passwd' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26856-5" source="http://cce.mitre.org" />
        <description>The /etc/passwd file should be owned by the appropriate
      group.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_groupowner_etc_passwd" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3107" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:971" version="3">
      <metadata>
        <title>Package aide Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27024-9" source="http://cce.mitre.org" />
        <description>The RPM package aide should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_aide_installed" />
      </metadata>
      <criteria>
        <criterion comment="package aide is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:972" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1003" version="3">
      <metadata>
        <title>Set SHA512 Password Hashing Algorithm in /etc/libuser.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27229-4" source="http://cce.mitre.org" />
        <description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="set_password_hashing_algorithm_libuserconf" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1004" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1005" version="4">
      <metadata>
        <title>Package libreswan Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27626-1" source="http://cce.mitre.org" />
        <description>The RPM package libreswan should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_openswan_installed" />
      </metadata>
      <criteria>
        <criterion comment="package libreswan is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1006" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1012" version="3">
      <metadata>
        <title>Verify user who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27026-4" source="http://cce.mitre.org" />
        <description>The /etc/gshadow file should be owned by the appropriate
      user.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_owner_etc_gshadow" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3046" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1019" version="4">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv6.conf.default.accept_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27166-8" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv6.conf.default.accept_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv6_conf_default_accept_redirects" />
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3044" />
          <criterion comment="kernel /etc/sysctl.conf parameter net.ipv6.conf.default.accept_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3045" />
        </criteria>
        <criteria operator="AND">
          <extend_definition comment="IPv6 disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:197" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1030" version="3">
      <metadata>
        <title>Verify permissions on 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26954-8" source="http://cce.mitre.org" />
        <description>File permissions for /etc/group should be set
      correctly.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_etc_group" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3129" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1032" version="4">
      <metadata>
        <title>Set Password lcredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26631-2" source="http://cce.mitre.org" />
        <description>The password lcredit should meet minimum
      requirements using pam_cracklib</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check the password lcredit configuration of /etc/pam.d/system-auth -appears not first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:103200" />
        <criterion comment="check the password lcredit configuration of /etc/pam.d/system-auth -appears first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:103201" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1042" version="3">
      <metadata>
        <title>Ensure /var/log/audit Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26436-6" source="http://cce.mitre.org" />
        <description>Audit logs are stored in the /var/log/audit directory.
      Ensure that it has its own partition or logical volume. Make absolutely
      certain that it is large enough to store all audit logs that will be
      created by the auditing daemon.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="partition_for_var_log_audit" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1043" comment="/var/log/audit on own partition" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1049" version="3">
      <metadata>
        <title>TFTP Daemon Uses Secure Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27272-4" source="http://cce.mitre.org" />
        <description>The TFTP daemon should use secure mode.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="tftpd_uses_secure_mode" />
      </metadata>
      <criteria comment="package tftp-server removed or /etc/xinetd.d/tftp configured correctly" operator="OR">
        <extend_definition comment="rpm package tftp-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:661" />
        <criterion comment="tftpd secure mode" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1050" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1059" version="2">
      <metadata>
        <title>Auditd Maximum Number of Logs to Retain</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27522-2" source="http://cce.mitre.org" />
        <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="auditd_data_retention_num_logs" />
      </metadata>
      <criteria>
        <criterion comment="num_logs setting in auditd.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1060" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1061" version="2">
      <metadata>
        <title>Record Attempts to Alter Time Through the Localtime File</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27172-6" source="http://cce.mitre.org" />
        <description>Record attempts to alter time through /etc/localtime</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_time_watch_localtime" />
      </metadata>
      <criteria comment="Test for localtime file being watched">
        <criterion comment="watch localtime file" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1062" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1078" version="4">
      <metadata>
        <title>Set Boot Loader Password</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26911-8" source="http://cce.mitre.org" />
        <description>The grub boot loader should have password protection enabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="bootloader_password" />
      </metadata>
      <criteria>
        <criterion comment="make sure a password is defined in /boot/grub/grub.conf" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1079" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1080" version="3">
      <metadata>
        <title>Service rdisc Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27261-7" source="http://cce.mitre.org" />
        <description>The rdisc service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_rdisc_disabled" />
      </metadata>
      <criteria comment="package iputils removed or service rdisc is not configured to start" operator="OR">
        <extend_definition comment="iputils removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:717" />
        <criteria operator="AND" comment="service rdisc is not configured to start">
          <criterion comment="rdisc runlevel 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1081" />
          <criterion comment="rdisc runlevel 1" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1082" />
          <criterion comment="rdisc runlevel 2" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1083" />
          <criterion comment="rdisc runlevel 3" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1084" />
          <criterion comment="rdisc runlevel 4" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1085" />
          <criterion comment="rdisc runlevel 5" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1086" />
          <criterion comment="rdisc runlevel 6" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1087" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1088" version="3">
      <metadata>
        <title>Set SHA512 Password Hashing Algorithm in /etc/login.defs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27228-6" source="http://cce.mitre.org" />
        <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="set_password_hashing_algorithm_logindefs" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1089" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1105" version="5">
      <metadata>
        <title>Disable sctp Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26410-1" source="http://cce.mitre.org" />
        <description>The kernel module sctp should be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="kernel_module_sctp_disabled" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1106" comment="kernel module sctp disabled in /etc/modprobe.d" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3062" comment="kernel module sctp disabled in /etc/modprobe.conf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1109" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.all.send_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27004-1" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.all.send_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_all_send_redirects" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3067" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3068" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1141" version="4">
      <metadata>
        <title>Set Password ucredit Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26601-5" source="http://cce.mitre.org" />
        <description>The password ucredit should meet minimum
      requirements using pam_cracklib</description>
      </metadata>
      <criteria operator="OR">
        <criterion comment="check the password ucredit configuration of /etc/pam.d/system-auth -appears not first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:114100" />
        <criterion comment="check the password ucredit configuration of /etc/pam.d/system-auth -appears first" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:114101" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1143" version="2">
      <metadata>
        <title>Verify /var/log/audit Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27243-5" source="http://cce.mitre.org" />
        <description>Checks for correct permissions for all log files in /var/log/audit.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_var_log_audit" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1144" negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1147" version="5">
      <metadata>
        <title>Audit File Deletion Events</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26651-0" source="http://cce.mitre.org" />
        <description>Audit files deletion events.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_file_deletion_events" />
      </metadata>
      <criteria>
        <criterion comment="audit rmdir syscall" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3950" />
        <criterion comment="audit unlink syscall" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3958" />
        <criterion comment="audit unlinkat syscall" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3961" />
        <criterion comment="audit rename syscall" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3964" />
        <criterion comment="audit renameat syscall" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3967" />
        <criterion comment="audit rmdir syscall root" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3972" />
        <criterion comment="audit unlink syscall root" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3973" />
        <criterion comment="audit unlinkat syscall root" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3974" />
        <criterion comment="audit rename syscall root" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3975" />
        <criterion comment="audit renameat syscall root" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3976" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1153" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.default.accept_redirects" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27015-7" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.default.accept_redirects" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_default_accept_redirects" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3111" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.default.accept_redirects set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3112" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1155" version="3">
      <metadata>
        <title>Kernel Runtime Parameter "net.ipv4.conf.all.accept_source_route" Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27037-1" source="http://cce.mitre.org" />
        <description>The kernel runtime parameter "net.ipv4.conf.all.accept_source_route" should be set to "0".</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sysctl_net_ipv4_conf_all_accept_source_route" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3117" />
        <criterion comment="kernel /etc/sysctl.conf parameter net.ipv4.conf.all.accept_source_route set to 0" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3118" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1165" version="4">
      <metadata>
        <title>Set Daemon umask</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27031-4" source="http://cce.mitre.org" />
        <description>The daemon umask should be set as
      appropriate</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1166" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1167" version="5">
      <metadata>
        <title>Disable tipc Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26696-5" source="http://cce.mitre.org" />
        <description>The kernel module tipc should be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="kernel_module_tipc_disabled" />
      </metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1168" comment="kernel module tipc disabled in /etc/modprobe.d" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3028" comment="kernel module tipc disabled in /etc/modprobe.conf" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1170" version="3">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - removexattr</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27184-1" source="http://cce.mitre.org" />
        <description>The changing of file permissions and attributes should be
      audited.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="audit_rules_dac_modification_removexattr" />
      </metadata>
      <!-- x32 system calls are monitored and ... -->
      <criteria operator="AND">
        <criterion comment="dac modification removexattr x32" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1171" />
        <!-- system is not x64 or x64 system calls are monitored  -->
        <criteria operator="OR">
          <extend_definition comment="x64?" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:128" negate="true" />
          <criterion comment="dac modification removexattr x64" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1172" />
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1175" version="3">
      <metadata>
        <title>Package xorg-x11-server-common Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27198-1" source="http://cce.mitre.org" />
        <description>The RPM package xorg-x11-server-common should be removed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_xorg-x11-server-common_removed" />
      </metadata>
      <criteria>
        <criterion comment="package xorg-x11-server-common is removed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1176" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1177" version="3">
      <metadata>
        <title>Verify user who owns 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26822-7" source="http://cce.mitre.org" />
        <description>The /etc/group file should be owned by the appropriate
      user.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_owner_etc_group" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3051" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1179" version="3">
      <metadata>
        <title>Service rlogin Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26865-6" source="http://cce.mitre.org" />
        <description>The rlogin service should be disabled if possible.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="service_rlogin_disabled" />
      </metadata>
      <criteria comment="package rsh-server removed or service rlogin is not configured to start" operator="OR">
        <extend_definition comment="rpm package rsh-server removed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:221" />
        <criterion comment="rlogin disabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1180" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1181" version="3">
      <metadata>
        <title>Verify /etc/passwd Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26868-0" source="http://cce.mitre.org" />
        <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_etc_passwd" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1182" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:1183" version="3">
      <metadata>
        <title>Ensure /tmp Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26435-8" source="http://cce.mitre.org" />
        <description>The /tmp directory is a world-writable directory used for
      temporary file storage. Verify that it has its own partition or logical
      volume.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="partition_for_tmp" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1184" comment="/tmp on own partition" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:2992" version="5">
      <metadata>
        <title>The system must require administrator action to unlock an account locked by excessive failed login attempts.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27110-6" source="http://cce.mitre.org" />
        <description>The number of allowed failed logins should be set correctly.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_passwords_pam_faillock_unlock_time" />
      </metadata>
      <criteria>
        <criterion comment="preauth default is set to 604800" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:29920" />
        <criterion comment="account required pam-faillock.so is set" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2993" />
        <criterion comment="authfail default is set to 604800" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3765" />
        <criterion comment="preauth default is set to 604800" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:29921" />
        <criterion comment="authfail default is set to 604800" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2994" />
        <criterion comment="account required pam-faillock.so is set" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3767" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:2996" version="3">
      <metadata>
        <title>No nullok Option in /etc/pam.d/system-auth</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27038-9" source="http://cce.mitre.org" />
        <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="no_empty_passwords" />
      </metadata>
      <criteria>
        <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2997" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3000" version="3">
      <metadata>
        <title>Require Authentication for Single-User Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27040-5" source="http://cce.mitre.org" />
        <description>The requirement for a password to boot into single-user mode
      should be configured correctly.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="require_singleuser_auth" />
      </metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3001" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3014" version="3">
      <metadata>
        <title>Set ClientAliveCountMax for User Logins</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26282-4" source="http://cce.mitre.org" />
        <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_set_keepalive" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3015" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3020" version="4">
      <metadata>
        <title>Disable Host-Based Authentication</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27091-8" source="http://cce.mitre.org" />
        <description>SSH host-based authentication should be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="disable_host_auth" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check HostbasedAuthentication in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:237" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3032" version="3">
      <metadata>
        <title>SELinux Enforcing</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <reference ref_id="CCE-26969-6" source="http://cce.mitre.org" />
        <description>The SELinux state should be enforcing the local policy.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="selinux_state" />
      </metadata>
      <criteria operator="AND">
        <criterion comment="enforce is disabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:1119" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3037" version="3">
      <metadata>
        <title>Set OpenSSH Idle Timeout Interval</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26919-1" source="http://cce.mitre.org" />
        <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_set_idle_timeout" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:116" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3042" version="3">
      <metadata>
        <title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26647-8" source="http://cce.mitre.org" />
        <description>Ensure all yum repositories utilize signature checking.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="ensure_gpgcheck_never_disabled" />
      </metadata>
      <criteria comment="ensure all yum repositories utilize signiature checking" operator="AND">
        <criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3043" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3052" version="3">
      <metadata>
        <title>Disable .rhosts Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27124-7" source="http://cce.mitre.org" />
        <description>Emulation of the rsh command through the ssh server should
      be disabled (and dependencies are met)</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_disable_rhosts" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check IgnoreRhosts in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3053" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3054" version="3">
      <metadata>
        <title>Set Accounts to Expire Following Password Expiration</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27283-1" source="http://cce.mitre.org" />
        <description>The accounts should be configured to expire automatically following password expiration.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="account_disable_post_pw_expiration" />
      </metadata>
      <criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:265" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3055" version="4">
      <metadata>
        <title>Verify that System Executables Have Restrictive Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks that /bin, /usr/bin, /usr/local/bin, /sbin, /usr/sbin, /usr/local/sbin, and objects therein,
      are not group-writable or world-writable.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_permissions_binary_dirs" />
        <reference ref_url="http://cce.mitre.org" source="CCE" ref_id="CCE-27289-8" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3055" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3056" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3057" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3058" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3059" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3060" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3061" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:305501" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:305502" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:305503" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:305504" negate="true" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:305505" negate="true" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3072" version="3">
      <metadata>
        <title>Disable Core Dumps</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27033-0" source="http://cce.mitre.org" />
        <description>Core dumps for all users should be disabled</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="disable_users_coredumps" />
      </metadata>
      <criteria>
        <criterion comment="Are core dumps disabled" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3073" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3074" version="3">
      <metadata>
        <title>Disable root Login via SSH</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27100-7" source="http://cce.mitre.org" />
        <description>Root login via SSH should be disabled (and dependencies are
      met)</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_disable_root_login" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3075" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3080" version="3">
      <metadata>
        <title>Verify group who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26967-0" source="http://cce.mitre.org" />
        <description>The /etc/shadow file should be owned by the appropriate
      group.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="groupowner_shadow_file" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3081" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3082" version="3">
      <metadata>
        <title>Enable a Warning Banner</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27112-2" source="http://cce.mitre.org" />
        <description>SSH warning banner should be enabled (and dependencies are
      met)</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_enable_warning_banner" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check Banner in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3083" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3090" version="3">
      <metadata>
        <title>Verify that System Executables Have Root Ownership</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and objects therein, are owned by root</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="file_ownership_binary_dirs" />
        <reference ref_url="http://cce.mitre.org" source="CCE" ref_id="CCE-27623-8" />
      </metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3091" negate="true" comment="/bin directories use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3092" negate="true" comment="/sbin directories use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3093" negate="true" comment="/usr/bin directories use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3094" negate="true" comment="/usr/sbin directories use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3095" negate="true" comment="/usr/local/bin directories use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3096" negate="true" comment="/bin files use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3097" negate="true" comment="/sbin files use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3098" negate="true" comment="/usr/bin files use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3099" negate="true" comment="/usr/sbin files use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3100" negate="true" comment="/usr/local/bin files use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3101" negate="true" comment="/usr/local/sbin files use the uid of root" />
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3090" negate="true" comment="/usr/local/sbin directories use the uid of root" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3103" version="3">
      <metadata>
        <title>Do Not Allow Users to Set Environment Options</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27201-3" source="http://cce.mitre.org" />
        <description>PermitUserEnvironment should be disabled</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_do_not_permit_user_env" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check PermitUserEnvironment in /etc/ssh/sshd_config" negate="true" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3104" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3105" version="3">
      <metadata>
        <title>Disable Interactive Boot</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27043-9" source="http://cce.mitre.org" />
        <description>The ability for users to perform interactive startups should
      be disabled.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="disable_interactive_boot" />
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3106" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3109" version="4">
      <metadata>
        <title>Disable Empty Passwords</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Fedora 20</platform>
        </affected>
        <reference ref_id="CCE-26887-0" source="http://cce.mitre.org" />
        <description>Remote connections from accounts with empty passwords should
      be disabled (and dependencies are met)</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="sshd_disable_empty_passwords" />
      </metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:115" />
        <criterion comment="Check PermitEmptyPasswords in /etc/ssh/sshd_config" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3110" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3115" version="3">
      <metadata>
        <title>Verify user who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26947-2" source="http://cce.mitre.org" />
        <description>The /etc/shadow file should be owned by the
      appropriate user.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="userowner_shadow_file" />
      </metadata>
      <criteria>
        <criterion comment="Check file ownership of /etc/shadow" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3116" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3126" version="13">
      <metadata>
        <title>The system must disable accounts after excessive login failures within a 15-minute interval.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27215-3" source="http://cce.mitre.org" />
        <description>The number of allowed failed logins should be set correctly.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="accounts_passwords_pam_fail_interval" />
      </metadata>
      <criteria>
        <criterion comment="preauth default is set to 900" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:31260" />
        <criterion comment="account is set" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3127" />
        <criterion comment="authfail default is set to 900" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3769" />
        <criterion comment="preauth default is set to 900" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:31261" />
        <criterion comment="authfail default is set to 900" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3128" />
        <criterion comment="account is set" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3770" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3446" version="4">
      <metadata>
        <title>Enable SELinux in /boot/grub/grub.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-26956-3" source="http://cce.mitre.org" />
        <description>Check if selinux=0 OR enforcing=0 within /boot/grub/grub.conf lines, fail if found.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="enable_selinux_bootloader" />
      </metadata>
      <criteria>
        <criterion comment="check value selinux|enforcing=0 in /boot/grub/grub.conf, fail if found" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:2989" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3447" version="2">
      <metadata>
        <title>Package GConf2 Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package GConf2 should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_GConf2_installed" />
      </metadata>
      <criteria>
        <criterion comment="package GConf2 is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3448" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3565" version="2">
      <metadata>
        <title>Package gdm Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package gdm should be installed.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="package_gdm_installed" />
      </metadata>
      <criteria>
        <criterion comment="package gdm is installed" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3569" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:3883" version="4">
      <metadata>
        <title>Enable GUI Warning Banner</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <reference ref_id="CCE-27195-7" source="http://cce.mitre.org" />
        <description>Enable the GUI warning banner.</description>
        <reference source="mil.disa.fso.redhat.rhel6" ref_id="gconf_gdm_enable_warning_gui_banner" />
      </metadata>
      <criteria operator="OR">
        <extend_definition comment="GConf2 installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:3447" negate="true" />
        <extend_definition comment="gdm installed" definition_ref="oval:mil.disa.fso.redhat.rhel6:def:3565" negate="true" />
        <criterion comment="check var settings" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3884" />
        <criterion comment="check etc settings tree" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3885" />
        <criterion comment="check etc settings without tree" test_ref="oval:mil.disa.fso.redhat.rhel6:tst:3886" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:4001" version="1">
      <metadata>
        <title>The NFS server must not have the insecure file locking option enabled.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The NFS server must not have the insecure file locking option enabled.</description>
      </metadata>
      <criteria>
        <criterion test_ref="oval:mil.disa.fso.redhat.rhel6:tst:400100" comment="no insecure_locks configuration in /etc/exports" />
      </criteria>
    </definition>
    <definition class="compliance" id="oval:mil.disa.fso.redhat.rhel6:def:4002" version="2">
      <metadata>
        <title>The system must prohibit the reuse of passwords within five iterations.</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Preventing reuse of previous passwords helps ensure that a compromised password is not reused by a user.</description>
        <reference ref_id="CCE-26741-9" source="http://cce.mitre.org" />
      </metadata>
      <criteria operator="OR">
        <criterion comment="Make sure password reuse setting is set to at least 5 -appears not first." test_ref="oval:mil.disa.fso.redhat.rhel6:tst:400200" />
        <criterion comment="Make sure password reuse setting is set to at least 5 -appears first." test_ref="oval:mil.disa.fso.redhat.rhel6:tst:400201" />
      </criteria>
    </definition>
  </definitions>
  <tests>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="control-alt-delete.override is configured" id="oval:mil.disa.fso.redhat.rhel6:tst:100" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:100" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:113" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3893" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1187" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="timeout is configured" id="oval:mil.disa.fso.redhat.rhel6:tst:116" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1188" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1189" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:120" version="1" comment="package cronie is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1192" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S clock_settime and key" id="oval:mil.disa.fso.redhat.rhel6:tst:127" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1195" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 64bit -S clock_settime and key" id="oval:mil.disa.fso.redhat.rhel6:tst:129" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1196" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:131" version="1" comment="package ntpdate is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1197" />
    </linux:rpminfo_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:133" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1198" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:134" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1200" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:135" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1201" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:136" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1202" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:137" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1203" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:138" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1204" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:139" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1205" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1199" />
    </unix:runlevel_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:141" version="1" comment="package openssh-server is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1206" />
    </linux:rpminfo_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:144" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1207" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:145" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1209" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:146" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1210" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:147" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1211" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:148" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1212" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:149" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1213" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:150" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1214" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1208" />
    </unix:runlevel_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:154" version="1" comment="package screen is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1216" />
    </linux:rpminfo_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="gnome screensaver is activated on idle" id="oval:mil.disa.fso.redhat.rhel6:tst:158" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1218" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3453" />
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check for audit=1 in /boot/grub/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:160" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1220" />
    </ind:textfilecontent54_test>
    <linux:partition_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:162" version="1" comment="/var on own partition">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1221" />
    </linux:partition_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:167" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1223" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:168" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1225" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:169" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1226" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:170" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1227" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:171" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1228" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:172" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1229" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:173" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1230" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1224" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:176" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1231" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:177" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1233" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:178" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1234" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:179" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1235" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:180" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1236" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:181" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1237" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:182" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1238" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1232" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:185" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1239" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:186" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1241" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:187" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1242" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:188" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1243" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:189" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1244" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:190" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1245" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:191" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1246" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1240" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification lchown x32" id="oval:mil.disa.fso.redhat.rhel6:tst:206" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1257" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification lchown x64" id="oval:mil.disa.fso.redhat.rhel6:tst:207" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1258" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:mil.disa.fso.redhat.rhel6:tst:211" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1261" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="rsh disabled" id="oval:mil.disa.fso.redhat.rhel6:tst:222" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1267" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:224" version="1" comment="package oddjob is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1268" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="sshd HostbasedAuthentication" id="oval:mil.disa.fso.redhat.rhel6:tst:237" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1279" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/bashrc file" id="oval:mil.disa.fso.redhat.rhel6:tst:241" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1282" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1283" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:245" version="3" check="all" comment="kernel module rds disabled">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1285" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/iptables for line :INPUT DROP [0:0]" id="oval:mil.disa.fso.redhat.rhel6:tst:258" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1296" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Check /etc/sysconfig/iptables for line :INPUT ACCEPT [0:0]" id="oval:mil.disa.fso.redhat.rhel6:tst:259" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1297" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" id="oval:mil.disa.fso.redhat.rhel6:tst:265" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1301" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1302" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1303" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit mount" id="oval:mil.disa.fso.redhat.rhel6:tst:269" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1305" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:275" version="1" comment="package sendmail is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1310" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification chown x32" id="oval:mil.disa.fso.redhat.rhel6:tst:277" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1311" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification chown x64" id="oval:mil.disa.fso.redhat.rhel6:tst:278" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1312" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:285" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1316" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:286" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1318" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:287" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1319" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:288" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1320" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:289" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1321" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:290" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1322" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:291" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1323" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1317" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit /etc/group" id="oval:mil.disa.fso.redhat.rhel6:tst:293" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1324" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit /etc/passwd" id="oval:mil.disa.fso.redhat.rhel6:tst:294" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1325" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit /etc/gshadow" id="oval:mil.disa.fso.redhat.rhel6:tst:295" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1326" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit /etc/shadow" id="oval:mil.disa.fso.redhat.rhel6:tst:296" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1327" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit /etc/security/opasswd" id="oval:mil.disa.fso.redhat.rhel6:tst:297" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1328" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="at_least_one_exists" comment="look for .rhosts or .shosts in /root" id="oval:mil.disa.fso.redhat.rhel6:tst:302" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1333" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="at_least_one_exists" comment="look for .rhosts or .shosts in /home" id="oval:mil.disa.fso.redhat.rhel6:tst:303" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1334" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="at_least_one_exists" comment="look for /etc/hosts.equiv or /etc/shosts.equiv" id="oval:mil.disa.fso.redhat.rhel6:tst:304" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1335" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification setxattr x32" id="oval:mil.disa.fso.redhat.rhel6:tst:306" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1336" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification setxattr x64" id="oval:mil.disa.fso.redhat.rhel6:tst:307" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1337" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="password hashes are shadowed" id="oval:mil.disa.fso.redhat.rhel6:tst:309" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1338" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1339" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S settimeofday and key" id="oval:mil.disa.fso.redhat.rhel6:tst:311" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1340" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 64bit -S settimeofday and key" id="oval:mil.disa.fso.redhat.rhel6:tst:312" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1341" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification lremovexattr x32" id="oval:mil.disa.fso.redhat.rhel6:tst:323" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1348" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification lremovexattr x64" id="oval:mil.disa.fso.redhat.rhel6:tst:324" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1349" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:329" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1352" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:330" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1354" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:331" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1355" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:332" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1356" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:333" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1357" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:334" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1358" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:335" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1359" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1353" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:355" version="1" check="all" comment="ipv6 disabled any modprobe conf file">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1377" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:381" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1396" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:382" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1398" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:383" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1399" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:384" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1400" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:385" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1401" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:386" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1402" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:387" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1403" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1397" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/login.defs file" id="oval:mil.disa.fso.redhat.rhel6:tst:397" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1412" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1413" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:419" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1431" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:420" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1433" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:421" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1434" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:422" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1435" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:423" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1436" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:424" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1437" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:425" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1438" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1432" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification lsetxattr x32" id="oval:mil.disa.fso.redhat.rhel6:tst:435" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1447" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification lsetxattr x64" id="oval:mil.disa.fso.redhat.rhel6:tst:436" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1448" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check PASS_MIN_LEN in /etc/login.defs" id="oval:mil.disa.fso.redhat.rhel6:tst:447" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1459" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3187" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchown x32" id="oval:mil.disa.fso.redhat.rhel6:tst:451" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1461" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchown x64" id="oval:mil.disa.fso.redhat.rhel6:tst:452" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1462" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit insmod" id="oval:mil.disa.fso.redhat.rhel6:tst:462" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1468" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit rmmod" id="oval:mil.disa.fso.redhat.rhel6:tst:463" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1469" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit modprobe" id="oval:mil.disa.fso.redhat.rhel6:tst:464" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1470" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit module syscalls" id="oval:mil.disa.fso.redhat.rhel6:tst:465" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1471" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:469" version="1" comment="package ypserv is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1473" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Disable Telnet Service" id="oval:mil.disa.fso.redhat.rhel6:tst:471" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1474" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:476" version="1" comment="package at is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1479" />
    </linux:rpminfo_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="gnome screensaver set to blank screen" id="oval:mil.disa.fso.redhat.rhel6:tst:478" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1480" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1481" />
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchmod x32" id="oval:mil.disa.fso.redhat.rhel6:tst:495" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1494" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchmod x64" id="oval:mil.disa.fso.redhat.rhel6:tst:496" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1495" />
    </ind:textfilecontent54_test>
    <linux:partition_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:498" version="1" comment="/var/log on own partition">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1496" />
    </linux:partition_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing file permissions" id="oval:mil.disa.fso.redhat.rhel6:tst:509" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1505" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1506" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:mil.disa.fso.redhat.rhel6:tst:511" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1507" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs" id="oval:mil.disa.fso.redhat.rhel6:tst:526" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1519" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1520" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S adjtime and key" id="oval:mil.disa.fso.redhat.rhel6:tst:543" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1534" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 64bit -S adjtime and key" id="oval:mil.disa.fso.redhat.rhel6:tst:544" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1535" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="email account for actions" id="oval:mil.disa.fso.redhat.rhel6:tst:549" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1538" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1539" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/profile file" id="oval:mil.disa.fso.redhat.rhel6:tst:559" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1549" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1550" />
    </ind:textfilecontent54_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="test screensaver timeout period" id="oval:mil.disa.fso.redhat.rhel6:tst:599" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1583" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1584" />
    </ind:xmlfilecontent_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:605" version="2" comment="package telnet-server is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1587" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="oval:mil.disa.fso.redhat.rhel6:tst:618" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1598" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3203" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit changes selinux" id="oval:mil.disa.fso.redhat.rhel6:tst:620" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1600" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:622" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1601" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:623" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1603" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:624" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1604" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:625" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1605" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:626" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1606" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:627" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1607" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:628" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1608" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1602" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" id="oval:mil.disa.fso.redhat.rhel6:tst:630" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1609" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1610" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:633" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1611" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:634" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1613" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:635" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1614" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:636" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1615" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:637" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1616" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:638" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1617" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:639" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1618" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1612" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:mil.disa.fso.redhat.rhel6:tst:645" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1621" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="Tests the value of PASS_WARN_AGE in /etc/login.defs" id="oval:mil.disa.fso.redhat.rhel6:tst:652" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1627" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1628" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:662" version="1" comment="package tftp-server is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1637" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the value of the ^[\s]*umask[\s]+([^#]*) expression in the /etc/csh.cshrc file" id="oval:mil.disa.fso.redhat.rhel6:tst:664" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1638" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1639" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="space left action" id="oval:mil.disa.fso.redhat.rhel6:tst:668" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1641" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1642" />
    </ind:textfilecontent54_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="screensaver lock is enabled" id="oval:mil.disa.fso.redhat.rhel6:tst:670" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1643" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1644" />
    </ind:xmlfilecontent_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:672" version="1" comment="package samba-common is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1645" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="default runlevel is 3" id="oval:mil.disa.fso.redhat.rhel6:tst:689" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1661" />
    </ind:textfilecontent54_test>
    <unix:uname_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" comment="64 bit architecture" id="oval:mil.disa.fso.redhat.rhel6:tst:692" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1664" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1665" />
    </unix:uname_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:693" version="1" comment="package ntp is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1666" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fremovexattr x32" id="oval:mil.disa.fso.redhat.rhel6:tst:715" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1686" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fremovexattr x64" id="oval:mil.disa.fso.redhat.rhel6:tst:716" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1687" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:718" version="1" comment="package iputils is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1688" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check account in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:720" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1689" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" id="oval:mil.disa.fso.redhat.rhel6:tst:721" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1691" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1692" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:728" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1696" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1697" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1698" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1699" />
    </unix:file_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:741" version="1" comment="package xinetd is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1711" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:747" version="3" check="all" comment="kernel module dccp disabled">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1716" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchownat x32" id="oval:mil.disa.fso.redhat.rhel6:tst:749" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1717" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchownat x64" id="oval:mil.disa.fso.redhat.rhel6:tst:750" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1718" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fsetxattr x32" id="oval:mil.disa.fso.redhat.rhel6:tst:752" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1719" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fsetxattr x64" id="oval:mil.disa.fso.redhat.rhel6:tst:753" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1720" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:755" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1721" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:756" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1723" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:757" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1724" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:758" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1725" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:759" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1726" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:760" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1727" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:761" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1728" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1722" />
    </unix:runlevel_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:mil.disa.fso.redhat.rhel6:tst:774" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1741" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1740" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:mil.disa.fso.redhat.rhel6:tst:775" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1739" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1740" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/etc/shadow mode and ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:782" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1746" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1747" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1748" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1749" />
    </unix:file_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:783" version="1" comment="package qpid-cpp-server is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1750" />
    </linux:rpminfo_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:819" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1779" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:820" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1781" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:821" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1782" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:822" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1783" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:823" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1784" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:824" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1785" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:825" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1786" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1780" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="rexec disabled" id="oval:mil.disa.fso.redhat.rhel6:tst:827" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1787" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:830" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1788" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:831" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1790" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:832" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1791" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:833" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1792" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:834" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1793" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:835" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1794" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:836" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1795" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1789" />
    </unix:runlevel_test>
    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="at_least_one_exists" comment="iptables has an entry in /var/lock/subsys" id="oval:mil.disa.fso.redhat.rhel6:tst:837" version="1">
      <object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:83700" />
    </file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence of 32bit -S stime and key" id="oval:mil.disa.fso.redhat.rhel6:tst:846" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1804" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:853" version="1" comment="package openldap-servers is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1809" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification chmod x32" id="oval:mil.disa.fso.redhat.rhel6:tst:855" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1810" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification chmod x64" id="oval:mil.disa.fso.redhat.rhel6:tst:856" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1811" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit sudoers" id="oval:mil.disa.fso.redhat.rhel6:tst:864" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1816" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="space left action" id="oval:mil.disa.fso.redhat.rhel6:tst:866" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1817" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1818" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:868" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1819" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/boot/grub/grub.conf owned by root" id="oval:mil.disa.fso.redhat.rhel6:tst:870" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1820" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1821" />
    </unix:file_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:878" version="1" comment="package iptables is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1827" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchmodat x32" id="oval:mil.disa.fso.redhat.rhel6:tst:905" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1850" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification fchmodat x64" id="oval:mil.disa.fso.redhat.rhel6:tst:906" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1851" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/boot/grub/grub.conf owned by root" id="oval:mil.disa.fso.redhat.rhel6:tst:908" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1852" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1853" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="max log file size" id="oval:mil.disa.fso.redhat.rhel6:tst:925" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1866" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1867" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" id="oval:mil.disa.fso.redhat.rhel6:tst:927" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1868" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/yum.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:938" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1878" />
    </ind:textfilecontent54_test>
    <linux:partition_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:940" version="1" comment="/home on own partition">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1879" />
    </linux:partition_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:942" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1880" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:943" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1882" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:944" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1883" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:945" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1884" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:946" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1885" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:947" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1886" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:948" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1887" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1881" />
    </unix:runlevel_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:949" version="1" comment="package abrt is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1888" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:961" version="3" check="all" comment="kernel module usb-storage disabled">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1899" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:962" version="1" comment="package rsh-server is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1900" />
    </linux:rpminfo_test>
    <unix:uname_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" comment="32 bit architecture" id="oval:mil.disa.fso.redhat.rhel6:tst:963" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1901" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1902" />
    </unix:uname_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Files referenced in /etc/rsyslog.conf are owned by root" id="oval:mil.disa.fso.redhat.rhel6:tst:965" version="4">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1906" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1904" />
    </unix:file_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:972" version="1" comment="package aide is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1910" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:1004" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1941" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:1006" version="2" comment="package libreswan is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1942" />
    </linux:rpminfo_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:1021" version="1" comment="package postfix is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1953" />
    </linux:rpminfo_test>
    <linux:partition_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:1043" version="1" comment="check for /var/log/audit partition">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1974" />
    </linux:partition_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="tftpd secure mode" id="oval:mil.disa.fso.redhat.rhel6:tst:1050" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1978" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="admin space left action " id="oval:mil.disa.fso.redhat.rhel6:tst:1060" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1987" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1988" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the for presence etc localtime file in the rules file" id="oval:mil.disa.fso.redhat.rhel6:tst:1062" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1989" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1063" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1990" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1064" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1992" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1065" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1993" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1066" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1994" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1067" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1995" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1068" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1996" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1069" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1997" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1991" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:1079" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2006" />
    </ind:textfilecontent54_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1081" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2007" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1082" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2009" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1083" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2010" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1084" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2011" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1085" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2012" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1086" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2013" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <unix:runlevel_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="any_exist" comment="Runlevel test" id="oval:mil.disa.fso.redhat.rhel6:tst:1087" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2014" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2008" />
    </unix:runlevel_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check ENCRYPT_METHOD in /etc/login.defs" id="oval:mil.disa.fso.redhat.rhel6:tst:1089" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2015" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:1106" version="3" check="all" comment="kernel module sctp disabled">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2029" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:1115" version="1" comment="package ypbind is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2037" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:mil.disa.fso.redhat.rhel6:tst:1119" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2038" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2039" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0640" id="oval:mil.disa.fso.redhat.rhel6:tst:1144" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2061" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2062" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the \s*umask\s+((?:022|027))\s* expression in the /etc/init.d/functions file" id="oval:mil.disa.fso.redhat.rhel6:tst:1166" version="4">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2081" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2082" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:1168" version="3" check="all" comment="kernel module tipc disabled">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2083" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification removexattr x32" id="oval:mil.disa.fso.redhat.rhel6:tst:1171" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2085" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="dac modification removexattr x64" id="oval:mil.disa.fso.redhat.rhel6:tst:1172" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2086" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="none_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:1176" version="1" comment="package xorg-x11-server-common is removed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2088" />
    </linux:rpminfo_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="rlogin disabled" id="oval:mil.disa.fso.redhat.rhel6:tst:1180" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2091" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/etc/passwd mode and ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:1182" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2092" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2093" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2094" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2095" />
    </unix:file_test>
    <linux:partition_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:1184" version="1" comment="/tmp on own partition">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2096" />
    </linux:partition_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:2981" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1491" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1492" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.secure_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:2982" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3132" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" id="oval:mil.disa.fso.redhat.rhel6:tst:2988" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3138" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /boot/grub/grub.conf, fail if found" id="oval:mil.disa.fso.redhat.rhel6:tst:2989" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3139" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to 1" id="oval:mil.disa.fso.redhat.rhel6:tst:2990" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1675" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1676" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.log_martians static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:2991" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3140" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check account in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:2993" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3142" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check authfail maximum failed login attempts allowed in /etc/pam.d/password-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:2994" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3144" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3145" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:2995" version="3" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3146" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:2997" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3147" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="check for client signing = mandatory in /etc/samba/smb.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:2999" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3149" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests that the SINGLE variable in the /etc/sysconfig/init file is set to /sbin/sulogin, to ensure that a password must be entered to access single user mode" id="oval:mil.disa.fso.redhat.rhel6:tst:3001" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3150" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="oval:mil.disa.fso.redhat.rhel6:tst:3002" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3151" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1821" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="any_exist" comment="Tests the value of the ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/network-scripts/ifcfg-.* file" id="oval:mil.disa.fso.redhat.rhel6:tst:3005" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3153" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3154" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:3009" version="3" check="all" comment="kernel module rds disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3158" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="oval:mil.disa.fso.redhat.rhel6:tst:3013" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3161" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1853" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:mil.disa.fso.redhat.rhel6:tst:3015" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3162" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3163" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:mil.disa.fso.redhat.rhel6:tst:3016" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3164" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:mil.disa.fso.redhat.rhel6:tst:3017" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3165" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:3028" version="3" check="all" comment="kernel module tipc disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3176" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3033" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1625" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1626" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_source_route static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3034" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3179" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to 1" id="oval:mil.disa.fso.redhat.rhel6:tst:3035" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1308" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1309" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3036" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3180" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:3039" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3182" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3183" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files" id="oval:mil.disa.fso.redhat.rhel6:tst:3043" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3186" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3044" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1951" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1952" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3045" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3188" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:3046" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3189" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3190" />
    </unix:file_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to 1" id="oval:mil.disa.fso.redhat.rhel6:tst:3049" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1521" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1522" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.tcp_syncookies static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3050" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3192" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing user ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:3051" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3193" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3194" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="Tests the value of the IgnoreRhosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:mil.disa.fso.redhat.rhel6:tst:3053" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3195" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="Are the /bin files world writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3055" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3196" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2103" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="Are the /bin files group writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3056" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3196" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2104" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/bin files world writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3057" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3197" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2103" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/bin files world writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3058" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3198" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2103" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/sbin files world writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3059" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3199" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2103" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/sbin files world writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3060" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3200" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2103" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/sbin files world writable" id="oval:mil.disa.fso.redhat.rhel6:tst:3061" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3201" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2103" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:3062" version="3" check="all" comment="kernel module sctp disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3202" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Ensure at least one NTP server is set" id="oval:mil.disa.fso.redhat.rhel6:tst:3063" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3204" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3067" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2032" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2033" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.send_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3068" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3206" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="oval:mil.disa.fso.redhat.rhel6:tst:3073" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3209" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3210" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Tests the value of the PermitRootLogin[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:mil.disa.fso.redhat.rhel6:tst:3075" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3211" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3211" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3076" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1280" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1281" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3077" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3212" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing group ownership /etc/shadow" id="oval:mil.disa.fso.redhat.rhel6:tst:3081" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3215" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3216" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests the value of the Banner[\s]+/etc/issue setting in the /etc/ssh/sshd_config file" id="oval:mil.disa.fso.redhat.rhel6:tst:3083" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3217" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing user ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:3084" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3218" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3219" />
    </unix:file_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3085" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1588" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1589" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.send_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3086" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3220" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:3087" version="3" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3222" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3088" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1475" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1476" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.secure_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3089" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3223" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/sbin directories uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3090" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3235" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/bin directories uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3091" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3224" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/sbin directories uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3092" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3226" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/bin directories uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3093" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3228" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/sbin directories uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3094" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3230" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/bin directories uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3095" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3232" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/bin files uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3096" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3225" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/sbin files uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3097" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3227" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/bin files uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3098" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3229" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/sbin files uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3099" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3231" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/bin files uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3100" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3233" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/sbin files uid root" id="oval:mil.disa.fso.redhat.rhel6:tst:3101" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3236" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2106" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing group ownership" id="oval:mil.disa.fso.redhat.rhel6:tst:3102" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3237" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3238" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="Check value of PermitUserEnvironment in /etc/ssh/sshd_config" id="oval:mil.disa.fso.redhat.rhel6:tst:3104" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3239" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="Tests that PROMPT=no in /etc/sysconfig/init" id="oval:mil.disa.fso.redhat.rhel6:tst:3106" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3240" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="oval:mil.disa.fso.redhat.rhel6:tst:3107" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3241" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3242" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="Tests the value of the PermitEmptyPasswords[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:mil.disa.fso.redhat.rhel6:tst:3110" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3244" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3111" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2069" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2070" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3112" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3245" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3113" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1547" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1548" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_redirects static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3114" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3246" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing user ownership of /etc/shadow" id="oval:mil.disa.fso.redhat.rhel6:tst:3116" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1298" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1299" />
    </unix:file_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to 0" id="oval:mil.disa.fso.redhat.rhel6:tst:3117" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:2071" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2072" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_source_route static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3118" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3247" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1" id="oval:mil.disa.fso.redhat.rhel6:tst:3119" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1828" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1829" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.rp_filter static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3120" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3248" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to 1" id="oval:mil.disa.fso.redhat.rhel6:tst:3123" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1532" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1533" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.rp_filter static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3124" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3250" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check if account is set in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3127" version="10">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3251" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/password-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3128" version="10">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3253" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3254" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="oval:mil.disa.fso.redhat.rhel6:tst:3129" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3255" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3256" />
    </unix:file_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to 1" id="oval:mil.disa.fso.redhat.rhel6:tst:3130" version="1">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1812" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1813" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" id="oval:mil.disa.fso.redhat.rhel6:tst:3131" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3257" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:3448" version="1" comment="package GConf2 is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3452" />
    </linux:rpminfo_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" check="all" check_existence="all_exist" id="oval:mil.disa.fso.redhat.rhel6:tst:3569" version="1" comment="package gdm is installed">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3572" />
    </linux:rpminfo_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="screensaver lock is enabled" id="oval:mil.disa.fso.redhat.rhel6:tst:3634" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3687" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1644" />
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="gnome screensaver is activated on idle" id="oval:mil.disa.fso.redhat.rhel6:tst:3651" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3699" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3453" />
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="gnome screensaver set to blank screen" id="oval:mil.disa.fso.redhat.rhel6:tst:3662" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3709" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1481" />
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="test screensaver timeout period" id="oval:mil.disa.fso.redhat.rhel6:tst:3670" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3717" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1584" />
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" id="oval:mil.disa.fso.redhat.rhel6:tst:3761" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3763" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1690" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check account in  /etc/pam.d/password-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3762" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3764" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check authfail maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3765" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3766" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3143" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check account in /etc/pam.d/password-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3767" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3768" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3769" version="10">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3771" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3252" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check if account is set in /etc/pam.d/password-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:3770" version="10">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3772" />
    </ind:textfilecontent54_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="stuff" id="oval:mil.disa.fso.redhat.rhel6:tst:3884" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1778" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3141" />
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="checks for gconf-tree file" id="oval:mil.disa.fso.redhat.rhel6:tst:3885" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3689" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3141" />
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="checks for absent gconf-tree file" id="oval:mil.disa.fso.redhat.rhel6:tst:3886" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3690" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3141" />
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit rmdir syscall" id="oval:mil.disa.fso.redhat.rhel6:tst:3950" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3956" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit unlink syscall" id="oval:mil.disa.fso.redhat.rhel6:tst:3958" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3959" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit unlinkat syscall" id="oval:mil.disa.fso.redhat.rhel6:tst:3961" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3962" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit rename syscall" id="oval:mil.disa.fso.redhat.rhel6:tst:3964" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3965" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit renameat syscall" id="oval:mil.disa.fso.redhat.rhel6:tst:3967" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3968" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit rmdir syscall root" id="oval:mil.disa.fso.redhat.rhel6:tst:3972" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3977" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit unlink syscall root" id="oval:mil.disa.fso.redhat.rhel6:tst:3973" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3978" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit unlinkat syscall root" id="oval:mil.disa.fso.redhat.rhel6:tst:3974" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3979" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit rename syscall root" id="oval:mil.disa.fso.redhat.rhel6:tst:3975" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3980" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="audit renameat syscall root" id="oval:mil.disa.fso.redhat.rhel6:tst:3976" version="3">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3981" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="none_exist" comment="check the files in /etc/pam.d/ for files that use password sufficient pam_unix.so but without sha512" id="oval:mil.disa.fso.redhat.rhel6:tst:4890" version="5">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149001" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d for files that use: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:tst:4891" version="4">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149002" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="only one" check_existence="only_one_exists" comment="check /etc/pam.d/password-auth for use: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:tst:4892" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149003" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1490" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="only one" check_existence="only_one_exists" comment="check /etc/pam.d/password-auth-ac for use: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:tst:4893" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149004" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1490" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="only one" check_existence="only_one_exists" comment="check /etc/pam.d/system-auth for use: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:tst:4894" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149005" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1490" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="only one" check_existence="only_one_exists" comment="check /etc/pam.d/system-auth-ac for use: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:tst:4895" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149006" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1490" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="at least one" check_existence="at_least_one_exists" comment="check /etc/pam.d for files that use md5, sha256, blowfish, or big_crypt in their password sufficient pam_unix.so lines" id="oval:mil.disa.fso.redhat.rhel6:tst:4896" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:149007" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:149002" />
    </ind:textfilecontent54_test>
    <linux:rpminfo_test xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:tst:6640" version="1" check="all" comment="tcsh is not installed" check_existence="none_exist">
      <linux:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:6640" />
    </linux:rpminfo_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="none_exist" comment="The /etc/csh.cshrc file does not exist" id="oval:mil.disa.fso.redhat.rhel6:tst:6641" version="2">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:6641" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum failed login attempts allowed in /etc/pam.d/system-auth (preauth)" id="oval:mil.disa.fso.redhat.rhel6:tst:7190" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:7190" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1690" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum failed login attempts allowed in /etc/pam.d/password-auth (preauth)" id="oval:mil.disa.fso.redhat.rhel6:tst:7191" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:7191" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:1690" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:19700" version="1" check="all" comment="ipv6 disabled in /etc/sysctl.conf file">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:19700" />
    </ind:textfilecontent54_test>
    <unix:sysctl_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:tst:19701" version="1" check="all" comment="ipv6 is disabled in the running kernel according to sysctl.">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:19701" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:19701" />
    </unix:sysctl_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check preauth maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:29920" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:29920" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3143" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check preauth maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:29921" version="2">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:29921" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3143" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:31260" version="10">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:31260" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3252" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/system-auth" id="oval:mil.disa.fso.redhat.rhel6:tst:31261" version="10">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:31261" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:3254" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password dcredit configuration of /etc/pam.d/system-auth -appears not first" id="oval:mil.disa.fso.redhat.rhel6:tst:45300" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:45300" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:45300" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password dcredit configuration of /etc/pam.d/system-auth -appears first" id="oval:mil.disa.fso.redhat.rhel6:tst:45301" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:45301" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:45300" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password ocredit configuration of /etc/pam.d/system-auth -appears not first" id="oval:mil.disa.fso.redhat.rhel6:tst:47400" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:47400" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:47400" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password ocredit configuration of /etc/pam.d/system-auth -appears first" id="oval:mil.disa.fso.redhat.rhel6:tst:47401" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:47401" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:47400" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password difok configuration of /etc/pam.d/system-auth -appears not first" id="oval:mil.disa.fso.redhat.rhel6:tst:52300" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:52300" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:52300" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password difok configuration of /etc/pam.d/system-auth -appears first" id="oval:mil.disa.fso.redhat.rhel6:tst:52301" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:52301" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:52300" />
    </ind:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="configuration present in /etc/rsyslog.conf" id="oval:mil.disa.fso.redhat.rhel6:tst:96400" version="2">
      <object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1904" />
    </textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password lcredit configuration of /etc/pam.d/system-auth -appears not first" id="oval:mil.disa.fso.redhat.rhel6:tst:103200" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:103200" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:103200" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password lcredit configuration of /etc/pam.d/system-auth -appears first" id="oval:mil.disa.fso.redhat.rhel6:tst:103201" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:103201" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:103200" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password ucredit configuration of /etc/pam.d/system-auth -appears not first" id="oval:mil.disa.fso.redhat.rhel6:tst:114100" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:114100" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:114100" />
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" comment="check the password ucredit configuration of /etc/pam.d/system-auth -appears first" id="oval:mil.disa.fso.redhat.rhel6:tst:114101" version="1">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:114101" />
      <ind:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:114100" />
    </ind:textfilecontent54_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/bin files group writable" id="oval:mil.disa.fso.redhat.rhel6:tst:305501" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3197" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2104" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/bin files group writable" id="oval:mil.disa.fso.redhat.rhel6:tst:305502" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3198" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2104" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/sbin files group writable" id="oval:mil.disa.fso.redhat.rhel6:tst:305503" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3199" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2104" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/sbin files group writable" id="oval:mil.disa.fso.redhat.rhel6:tst:305504" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3200" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2104" />
    </unix:file_test>
    <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="at least one" check_existence="at_least_one_exists" comment="/usr/local/sbin files group writable" id="oval:mil.disa.fso.redhat.rhel6:tst:305505" version="3">
      <unix:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:3201" />
      <unix:state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:2104" />
    </unix:file_test>
    <ind:textfilecontent54_test xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:tst:400100" version="1" check="all" check_existence="none_exist" comment="oval:mil.disa.fso.redhat.rhel6:tst:400100">
      <ind:object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:400100" />
    </ind:textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Make sure password reuse setting is set to at least 5 -appears not first." id="oval:mil.disa.fso.redhat.rhel6:tst:400200" version="2">
      <object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:400200" />
      <state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:400200" />
    </textfilecontent54_test>
    <textfilecontent54_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" check="all" check_existence="at_least_one_exists" comment="Make sure password reuse setting is set to at least 5 -appears first." id="oval:mil.disa.fso.redhat.rhel6:tst:400201" version="1">
      <object object_ref="oval:mil.disa.fso.redhat.rhel6:obj:400201" />
      <state state_ref="oval:mil.disa.fso.redhat.rhel6:ste:400200" />
    </textfilecontent54_test>
  </tests>
  <objects>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:100" version="1" comment="control-alt-delete.override configuration">
      <ind:filepath datatype="string">/etc/init/control-alt-delete.override</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*exec /usr/bin/logger -p security.info "Ctrl-Alt-Delete pressed"\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1186" version="2">
      <ind:filepath datatype="string">/etc/security/limits.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1188" version="1">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1192" version="1">
      <linux:name datatype="string">cronie</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1195" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b32.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1196" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b64.*-S[\s]+clock_settime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1197" version="1">
      <linux:name datatype="string">ntpdate</linux:name>
    </linux:rpminfo_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1198" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1200" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1201" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1202" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1203" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1204" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1205" version="1">
      <unix:service_name datatype="string">ntpdate</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1206" version="1">
      <linux:name datatype="string">openssh-server</linux:name>
    </linux:rpminfo_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1207" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1209" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1210" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1211" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1212" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1213" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1214" version="1">
      <unix:service_name datatype="string">xinetd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1216" version="1">
      <linux:name datatype="string">screen</linux:name>
    </linux:rpminfo_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1218" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/entry[@name='idle_activation_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1220" version="3">
      <ind:filepath datatype="string">/boot/grub/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*kernel\s(?:/boot)?/vmlinuz.*audit=1.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1221" version="1">
      <linux:mount_point datatype="string">/var</linux:mount_point>
    </linux:partition_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1223" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1225" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1226" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1227" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1228" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1229" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1230" version="1">
      <unix:service_name datatype="string">postfix</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1231" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1233" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1234" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1235" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1236" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1237" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1238" version="1">
      <unix:service_name datatype="string">ntpd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1239" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1241" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1242" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1243" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1244" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1245" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1246" version="1">
      <unix:service_name datatype="string">qpidd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1257" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lchown syscall.
         Assume user id's start above 500 and watch for lchowns by them
         Watch for lchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1258" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the lchown syscall.
         Assume user id's start above 500 and watch for lchowns by them
         Watch for lchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1261" version="2">
      <ind:path datatype="string">/etc/ssh</ind:path>
      <ind:filename datatype="string">sshd_config</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)Protocol[\s]+2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1267" version="1">
      <!-- the rpm package rsh-server installs a xinetd config file in /etc/xinetd.d which controls rsh -->
      <!-- in this case /sbin/chkconfig edits /etc/xinetd.d/rsh to enable/disable this service which is why we check it this way -->
      <ind:filepath datatype="string">/etc/xinetd.d/rsh</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1268" version="1">
      <linux:name datatype="string">oddjob</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1279" version="1">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)HostbasedAuthentication[\s]+yes[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1280" version="1">
      <unix:name datatype="string">net.ipv4.ip_forward</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1282" version="1">
      <ind:filepath datatype="string">/etc/bashrc</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1285" version="4" comment="kernel module rds disabled">
      <ind:path datatype="string">/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+rds\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1296" version="1">
      <ind:path datatype="string">/etc/sysconfig</ind:path>
      <ind:filename datatype="string">iptables</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*:INPUT\sDROP\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1297" version="1">
      <ind:path datatype="string">/etc/sysconfig</ind:path>
      <ind:filename datatype="string">iptables</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*:INPUT\ACCEPT\s\[0:0\]</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/shadow" id="oval:mil.disa.fso.redhat.rhel6:obj:1298" version="1">
      <unix:filepath datatype="string">/etc/shadow</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1301" version="1">
      <ind:filepath datatype="string">/etc/default/useradd</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1305" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+mount\s+\-F\s+auid&gt;=500\s+\-F\s+auid!=(?:4294967295|-1)\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1308" version="1">
      <unix:name datatype="string">net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
    </unix:sysctl_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1310" version="1">
      <linux:name datatype="string">sendmail</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1311" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the chown syscall.
         Assume user id's start above 500 and watch for chowns by them
         Watch for chowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1312" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the chown syscall.
         Assume user id's start above 500 and watch for chowns by them
         Watch for chowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1316" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1318" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1319" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1320" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1321" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1322" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1323" version="1">
      <unix:service_name datatype="string">abrtd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1324" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/group\s+\-p\s+wa\s+\-k\s+\w+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1325" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/passwd\s+\-p\s+wa\s+\-k\s+\w+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1326" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/gshadow\s+\-p\s+wa\s+\-k\s+\w+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1327" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/shadow\s+\-p\s+wa\s+\-k\s+\w+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1328" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/security/opasswd\s+\-p\s+wa\s+\-k\s+\w+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="look for .rhosts or .shosts in /root" id="oval:mil.disa.fso.redhat.rhel6:obj:1333" version="1">
      <unix:path operation="equals" datatype="string">/root</unix:path>
      <unix:filename operation="pattern match" datatype="string">^\.(r|s)hosts$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="look for .rhosts or .shosts in /home" id="oval:mil.disa.fso.redhat.rhel6:obj:1334" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/home</unix:path>
      <unix:filename operation="pattern match" datatype="string">^\.(r|s)hosts$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="look for /etc/hosts.equiv or /etc/shosts.equiv" id="oval:mil.disa.fso.redhat.rhel6:obj:1335" version="1">
      <unix:path operation="equals" datatype="string">/etc</unix:path>
      <unix:filename operation="pattern match" datatype="string">^s?hosts\.equiv$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1336" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the setxattr syscall.
         Assume user id's start above 500 and watch for setxattrs by them
         Watch for setxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1337" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the setxattr syscall.
         Assume user id's start above 500 and watch for setxattrs by them
         Watch for setxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1338" version="2">
      <ind:filepath datatype="string">/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[^:]*:([^:]*):</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1340" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1341" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1348" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lremovexattr syscall.
         Assume user id's start above 500 and watch for any lremovexattr by them
         Watch for lremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1349" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the lremovexattr syscall.
         Assume user id's start above 500 and watch for any lremovexattr by them
         Watch for lremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1352" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1354" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1355" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1356" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1357" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1358" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1359" version="1">
      <unix:service_name datatype="string">atd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1377" version="1" comment="ipv6 disabled any modprobe conf file">
      <ind:path datatype="string">/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*options\s+ipv6\s+.*disable=1.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1396" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1398" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1399" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1400" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1401" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1402" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1403" version="1">
      <unix:service_name datatype="string">oddjobd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1412" version="1">
      <ind:filepath datatype="string">/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*UMASK[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1431" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1433" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1434" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1435" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1436" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1437" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1438" version="1">
      <unix:service_name datatype="string">bluetooth</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1447" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lsetxattr syscall.
         Assume user id's start above 500 and watch for lsetxattr by them
         Watch for lsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1448" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the lsetxattr syscall.
         Assume user id's start above 500 and watch for lsetxattr by them
         Watch for lsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1459" version="1">
      <ind:filepath datatype="string">/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1461" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchown syscall.
         Assume user id's start above 500 and watch for fchowns by them
         Watch for fchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1462" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the fchown syscall.
         Assume user id's start above 500 and watch for fchowns by them
         Watch for fchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1468" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/sbin/insmod\s+\-p\s+x\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1469" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/sbin/rmmod\s+\-p\s+x\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1470" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/sbin/modprobe\s+\-p\s+x\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1471" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=(?:(?:b64)|(?:b32))\s+)?\-S\s+init_module\s+\-S\s+delete_module\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1473" version="1">
      <linux:name datatype="string">ypserv</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Disable Telnet Service" id="oval:mil.disa.fso.redhat.rhel6:obj:1474" version="2">
      <ind:path datatype="string">/etc/xinetd.d</ind:path>
      <ind:filename datatype="string">telnet</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1475" version="1">
      <unix:name datatype="string">net.ipv4.conf.default.secure_redirects</unix:name>
    </unix:sysctl_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1479" version="1">
      <linux:name datatype="string">at</linux:name>
    </linux:rpminfo_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1480" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1491" version="1">
      <unix:name datatype="string">net.ipv4.conf.all.secure_redirects</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1494" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchmod syscall.
         Assume user id's start above 500 and watch for fchmods by them
         Watch for fchmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1495" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the fchmod syscall.
         Assume user id's start above 500 and watch for fchmods by them
         Watch for fchmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1496" version="1">
      <linux:mount_point datatype="string">/var/log</linux:mount_point>
    </linux:partition_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/boot/grub/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:obj:1505" version="1">
      <unix:path datatype="string">/boot/grub</unix:path>
      <unix:filename datatype="string">grub.conf</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="serial ports /etc/securetty" id="oval:mil.disa.fso.redhat.rhel6:obj:1507" version="1">
      <ind:path datatype="string">/etc</ind:path>
      <ind:filename datatype="string">securetty</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^ttyS[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1519" version="1">
      <ind:filepath datatype="string">/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*PASS_MIN_DAYS[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1521" version="1">
      <unix:name datatype="string">net.ipv4.tcp_syncookies</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1532" version="1">
      <unix:name datatype="string">net.ipv4.conf.default.rp_filter</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1534" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1535" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1538" version="1">
      <ind:filepath datatype="string">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^action_mail_acct\s*=\s*(\S+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1547" version="1">
      <unix:name datatype="string">net.ipv4.conf.all.accept_redirects</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1549" version="1">
      <ind:filepath datatype="string">/etc/profile</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1583" version="2">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/entry[@name='idle_delay']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1587" version="2">
      <linux:name datatype="string">telnet-server</linux:name>
    </linux:rpminfo_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1588" version="1">
      <unix:name datatype="string">net.ipv4.conf.default.send_redirects</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1598" version="1">
      <ind:filepath datatype="string">/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*PASS_MAX_DAYS[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1600" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/selinux/\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1601" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1603" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1604" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1605" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1606" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1607" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1608" version="1">
      <unix:service_name datatype="string">autofs</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1609" version="2">
      <ind:filepath datatype="string">/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*SELINUXTYPE[\s]*=[\s]*([^\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1611" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1613" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1614" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1615" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1616" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1617" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1618" version="1">
      <unix:service_name datatype="string">ypbind</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="virtual consoles /etc/securetty" id="oval:mil.disa.fso.redhat.rhel6:obj:1621" version="1">
      <ind:filepath datatype="string">/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^vc/[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1625" version="1">
      <unix:name datatype="string">net.ipv4.conf.default.accept_source_route</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1627" version="1">
      <ind:filepath datatype="string">/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*PASS_WARN_AGE[\s]*(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1637" version="1">
      <linux:name datatype="string">tftp-server</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1638" version="1">
      <ind:filepath datatype="string">/etc/csh.cshrc</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1641" version="5">
      <ind:filepath datatype="string">/etc/audit/auditd.conf</ind:filepath>
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match" datatype="string">^\s*admin_space_left_action[ ]+=[ ]+(\S+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1643" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/entry[@name='lock_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1645" version="1">
      <linux:name datatype="string">samba-common</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1661" version="1">
      <ind:filepath datatype="string">/etc/inittab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*id:3:initdefault:[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:uname_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="64 bit architecture" id="oval:mil.disa.fso.redhat.rhel6:obj:1664" version="2" />
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1666" version="1">
      <linux:name datatype="string">ntp</linux:name>
    </linux:rpminfo_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1675" version="1">
      <unix:name datatype="string">net.ipv4.conf.all.log_martians</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1686" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fremovexattr syscall.
         Assume user id's start above 500 and watch for any fremovexattr by them
         Watch for fremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1687" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the fremovexattr syscall.
         Assume user id's start above 500 and watch for any fremovexattr by them
         Watch for fremovexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1688" version="1">
      <linux:name datatype="string">iputils</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1689" version="4">
      <ind:filepath datatype="string">/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*account\s+(?:(?:required))\s+pam_faillock\.so$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1691" version="4">
      <ind:filepath datatype="string">/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*deny=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/gshadow" id="oval:mil.disa.fso.redhat.rhel6:obj:1696" version="1">
      <unix:path datatype="string">/etc</unix:path>
      <unix:filename datatype="string">gshadow</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1711" version="1">
      <linux:name datatype="string">xinetd</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1716" version="4" comment="kernel module dccp disabled">
      <ind:path datatype="string">/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+dccp\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1717" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchownat syscall.
         Assume user id's start above 500 and watch for fchownats by them
         Watch for fchownats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1718" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the fchownat syscall.
         Assume user id's start above 500 and watch for fchownats by them
         Watch for fchownats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1719" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fsetxattr syscall.
         Assume user id's start above 500 and watch for any fsetxattr by them
         Watch for fsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1720" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the fsetxattr syscall.
         Assume user id's start above 500 and watch for any fsetxattr by them
         Watch for fsetxattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1721" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1723" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1724" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1725" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1726" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1727" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1728" version="1">
      <unix:service_name datatype="string">avahi-daemon</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/var/log/audit directories" id="oval:mil.disa.fso.redhat.rhel6:obj:1739" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/var/log/audit files" id="oval:mil.disa.fso.redhat.rhel6:obj:1741" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/var/log/audit</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/shadow" id="oval:mil.disa.fso.redhat.rhel6:obj:1746" version="1">
      <unix:filepath datatype="string">/etc/shadow</unix:filepath>
    </unix:file_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1750" version="1">
      <linux:name datatype="string">qpid-cpp-server</linux:name>
    </linux:rpminfo_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1778" version="1">
      <ind:filepath datatype="string">/var/lib/gdm/.gconf/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/entry[@name='banner_message_enable']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1779" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1781" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1782" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1783" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1784" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1785" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1786" version="1">
      <unix:service_name datatype="string">crond</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1787" version="1">
      <!-- the rpm package rsh-server installs a xinetd config file in /etc/xinetd.d which controls rexec -->
      <!-- in this case /sbin/chkconfig edits /etc/xinetd.d/rexec to enable/disable this service which is why we check it this way -->
      <ind:filepath datatype="string">/etc/xinetd.d/rexec</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1788" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1790" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1791" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1792" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1793" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1794" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1795" version="1">
      <unix:service_name datatype="string">iptables</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1804" version="2">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1809" version="1">
      <linux:name datatype="string">openldap-servers</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1810" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the chmod syscall.
         Assume user id's start above 500 and watch for any chmod by them
         Watch for chmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1811" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the chmod syscall.
         Assume user id's start above 500 and watch for any chmod by them
         Watch for chmods by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1812" version="1">
      <unix:name datatype="string">net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1816" version="1">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\-w\s+/etc/sudoers\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1817" version="3">
      <ind:filepath datatype="string">/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match" datatype="string">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1819" version="2">
      <ind:filepath datatype="string">/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*session\s+(required|requisite)?\s+pam_lastlog.so[\s\w\d\=]+showfailed</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/boot/grub/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:obj:1820" version="1">
      <unix:filepath datatype="string">/boot/grub/grub.conf</unix:filepath>
    </unix:file_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1827" version="1">
      <linux:name datatype="string">iptables</linux:name>
    </linux:rpminfo_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1828" version="1">
      <unix:name datatype="string">net.ipv4.conf.all.rp_filter</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1850" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the fchmodat syscall.
         Assume user id's start above 500 and watch for fchmodats by them
         Watch for fchmodats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1851" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the fchmodat syscall.
         Assume user id's start above 500 and watch for fchmodats by them
         Watch for fchmodats by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/boot/grub/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:obj:1852" version="1">
      <unix:filepath datatype="string">/boot/grub/grub.conf</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1866" version="1">
      <ind:filepath datatype="string">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^max_log_file\s*=\s*(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1868" version="1">
      <ind:path datatype="string">/etc</ind:path>
      <ind:filename datatype="string">passwd</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^(?!root:)[^:]*:[^:]:0</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1878" comment="gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath datatype="string">/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1879" version="1">
      <linux:mount_point datatype="string">/home</linux:mount_point>
    </linux:partition_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1880" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1882" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1883" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1884" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1885" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1886" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1887" version="1">
      <unix:service_name datatype="string">netconsole</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1888" version="1">
      <linux:name datatype="string">abrt</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1899" version="4" comment="kernel module usb-storage disabled">
      <ind:path datatype="string">/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+usb-storage\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1900" version="1">
      <linux:name datatype="string">rsh-server</linux:name>
    </linux:rpminfo_object>
    <unix:uname_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="32 bit architecture" id="oval:mil.disa.fso.redhat.rhel6:obj:1901" version="2" />
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="Filepaths referenced in /etc/rsyslog cartesian product" id="oval:mil.disa.fso.redhat.rhel6:obj:1903" version="5">
      <unix:path operation="equals" datatype="string" var_ref="oval:mil.disa.fso.redhat.rhel6:var:1906" var_check="at least one" />
      <unix:filename operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.redhat.rhel6:var:1907" var_check="at least one" />
    </unix:file_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1904" version="3" comment="collect log files">
      <path datatype="string" operation="equals">/etc</path>
      <filename datatype="string" operation="equals">rsyslog.conf</filename>
      <pattern datatype="string" operation="pattern match">^[^#\$\s]+\s+-?(/.*)$</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="Filepaths referenced in /etc/rsyslog cartesian product filtered" id="oval:mil.disa.fso.redhat.rhel6:obj:1906" version="4">
      <set set_operator="UNION">
        <object_reference>oval:mil.disa.fso.redhat.rhel6:obj:1903</object_reference>
        <filter action="include">oval:mil.disa.fso.redhat.rhel6:ste:1903</filter>
      </set>
    </unix:file_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1910" version="1">
      <linux:name datatype="string">aide</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:mil.disa.fso.redhat.rhel6:obj:1941" version="1">
      <ind:filepath datatype="string">/etc/libuser.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1942" version="2" comment="Determine if the libreswan package is installed.">
      <linux:name datatype="string">libreswan</linux:name>
    </linux:rpminfo_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1951" version="1">
      <unix:name datatype="string">net.ipv6.conf.default.accept_redirects</unix:name>
    </unix:sysctl_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1953" version="1">
      <linux:name datatype="string">postfix</linux:name>
    </linux:rpminfo_object>
    <linux:partition_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:1974" version="1">
      <linux:mount_point datatype="string">/var/log/audit</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1978" version="1">
      <ind:filepath datatype="string">/etc/xinetd.d/tftp</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*server_args[\s]+=[\s]+\-s[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1987" version="1">
      <ind:filepath datatype="string">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^num_logs\s*=\s*(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:1989" version="1">
      <ind:path datatype="string">/etc/audit</ind:path>
      <ind:filename datatype="string">audit.rules</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1990" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1992" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1993" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1994" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1995" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1996" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:1997" version="1">
      <unix:service_name datatype="string">sshd</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2006" version="3">
      <ind:path datatype="string">/boot/grub</ind:path>
      <ind:filename datatype="string">grub.conf</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+--encrypted\s+.*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2007" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2009" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2010" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2011" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2012" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2013" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2014" version="1">
      <unix:service_name datatype="string">rdisc</unix:service_name>
      <unix:runlevel operation="equals" datatype="string">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="check ENCRYPT_METHOD in /etc/login.defs" id="oval:mil.disa.fso.redhat.rhel6:obj:2015" version="1">
      <ind:filepath datatype="string">/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*ENCRYPT_METHOD[\s]+SHA512[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2029" version="4" comment="kernel module sctp disabled">
      <ind:path datatype="string">/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+sctp\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2032" version="1">
      <unix:name datatype="string">net.ipv4.conf.all.send_redirects</unix:name>
    </unix:sysctl_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:2037" version="1">
      <linux:name datatype="string">ypbind</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2038" version="2">
      <ind:filepath datatype="string">/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/var/log/audit files" id="oval:mil.disa.fso.redhat.rhel6:obj:2061" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
      <unix:path operation="equals" datatype="string">/var/log/audit</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
      <filter action="include">oval:mil.disa.fso.redhat.rhel6:ste:2062</filter>
    </unix:file_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2069" version="1">
      <unix:name datatype="string">net.ipv4.conf.default.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:2071" version="1">
      <unix:name datatype="string">net.ipv4.conf.all.accept_source_route</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2081" version="4">
      <ind:filepath datatype="string">/etc/rc.d/init.d/functions</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*umask\s+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2083" version="4" comment="kernel module tipc disabled">
      <ind:path datatype="string">/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+tipc\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2085" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch.  Remember that we can still have x32 libs on x64
         Watch for the removexattr syscall.
         Assume user id's start above 500 and watch for any removexattr by them
         Watch for removexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2086" version="2">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by
           arch. Remember that we can still have x32 libs on x64
         Watch for the removexattr syscall.
         Assume user id's start above 500 and watch for any removexattr by them
         Watch for removexattrs by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be:
         -a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perms
    -->
      <ind:pattern operation="pattern match" datatype="string">^-[Aa][\s]*(?:exit,always|always,exit)+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=500[\s]+)(?:.*-F\s+auid!=(?:-1|4294967295)[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:2088" version="1">
      <linux:name datatype="string">xorg-x11-server-common</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:2091" version="1">
      <!-- the rpm package rsh-server installs a xinetd config file in /etc/xinetd.d which controls rlogin -->
      <!-- in this case /sbin/chkconfig edits /etc/xinetd.d/rlogin to enable/disable this service which is why we check it this way -->
      <ind:filepath datatype="string">/etc/xinetd.d/rlogin</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/passwd" id="oval:mil.disa.fso.redhat.rhel6:obj:2092" version="1">
      <unix:path datatype="string">/etc</unix:path>
      <unix:filename datatype="string">passwd</unix:filename>
    </unix:file_object>
    <linux:partition_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:2096" version="1">
      <linux:mount_point datatype="string">/tmp</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3132" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" id="oval:mil.disa.fso.redhat.rhel6:obj:3138" version="1">
      <ind:path datatype="string">/etc/postfix</ind:path>
      <ind:filename datatype="string">main.cf</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*inet_interfaces[\s]*=[\s]*localhost[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3139" comment="check value selinux|enforcing=0 in /boot/grub/grub.conf, fail if found" version="3">
      <ind:filepath datatype="string">/boot/grub/grub.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*kernel[\s]+.*(selinux|enforcing)=0.*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3140" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3142" version="4">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*account\s+(?:(?:required))\s+pam_faillock\.so$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3144" version="5">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3146" version="4" comment="Check depricated /etc/modprobe.conf for disablement of usb-storage">
      <ind:filepath datatype="string">/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+usb-storage\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3147" version="2" comment="Search /etc/pam.d/system-auth for the use of nullok">
      <ind:filepath datatype="string">/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[^#]\s*.*\snullok\s*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3149" version="1">
      <ind:path datatype="string">/etc/samba</ind:path>
      <ind:filename datatype="string">smb.conf</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*client[\s]+signing[\s]*=[\s]*mandatory</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3150" version="1">
      <ind:filepath datatype="string">/etc/sysconfig/init</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^SINGLE=/sbin/sulogin[\s]*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/boot/efi/EFI/redhat/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:obj:3151" version="1">
      <unix:filepath datatype="string">/boot/efi/EFI/redhat/grub.conf</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3153" version="1">
      <ind:path datatype="string">/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match" datatype="string">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*BOOTPROTO[\s]*=[\s"]*([^#"\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3158" version="4" comment="Check depricated /etc/modprobe.conf for disablement of rds">
      <ind:filepath datatype="string">/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+rds\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/boot/efi/EFI/redhat/grub.conf" id="oval:mil.disa.fso.redhat.rhel6:obj:3161" version="1">
      <unix:filepath datatype="string">/boot/efi/EFI/redhat/grub.conf</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3162" version="1">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3164" version="1">
      <ind:filepath datatype="string">/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3165" version="1">
      <ind:path datatype="string">/etc/rsyslog.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">.*</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3176" version="4" comment="Check depricated /etc/modprobe.conf for disablement of tipc">
      <ind:filepath datatype="string">/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+tipc\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3179" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3180" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/gshadow" id="oval:mil.disa.fso.redhat.rhel6:obj:3182" version="1">
      <unix:filepath datatype="string">/etc/gshadow</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3186" version="1">
      <ind:path datatype="string">/etc/yum.repos.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">.*</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3188" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/gshadow" id="oval:mil.disa.fso.redhat.rhel6:obj:3189" version="1">
      <unix:path datatype="string">/etc</unix:path>
      <unix:filename datatype="string">gshadow</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3192" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/group" id="oval:mil.disa.fso.redhat.rhel6:obj:3193" version="1">
      <unix:path datatype="string">/etc</unix:path>
      <unix:filename datatype="string">group</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3195" version="1">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)IgnoreRhosts[\s]+no[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/bin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3196" version="3">
      <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/bin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/bin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3197" version="3">
      <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/bin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/local/bin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3198" version="3">
      <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/local/bin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/sbin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3199" version="3">
      <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/sbin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/sbin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3200" version="3">
      <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/sbin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/local/sbin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3201" version="3">
      <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/local/sbin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3202" version="4" comment="Check depricated /etc/modprobe.conf for disablement of sctp">
      <ind:filepath datatype="string">/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+sctp\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Ensure at least one NTP server is set" id="oval:mil.disa.fso.redhat.rhel6:obj:3204" version="1">
      <ind:path datatype="string">/etc</ind:path>
      <ind:filename datatype="string">ntp.conf</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*server[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3206" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3209" version="2">
      <set set_operator="UNION">
        <object_reference>oval:mil.disa.fso.redhat.rhel6:obj:3970</object_reference>
        <object_reference>oval:mil.disa.fso.redhat.rhel6:obj:3971</object_reference>
      </set>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3211" version="2">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*[Pp][Ee][Rr][Mm][Ii][Tt][Rr][Oo][Oo][Tt][Ll][Oo][Gg][Ii][Nn]\s+(\S+)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3212" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/shadow" id="oval:mil.disa.fso.redhat.rhel6:obj:3215" version="1">
      <unix:filepath datatype="string">/etc/shadow</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3217" version="1">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/passwd" id="oval:mil.disa.fso.redhat.rhel6:obj:3218" version="1">
      <unix:path datatype="string">/etc</unix:path>
      <unix:filename datatype="string">passwd</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3220" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3222" version="4" comment="Check depricated /etc/modprobe.conf for disablement of dccp">
      <ind:filepath datatype="string">/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*install\s+dccp\s+(/bin/true)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3223" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/bin directories" id="oval:mil.disa.fso.redhat.rhel6:obj:3224" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/bin</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/bin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3225" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/bin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/sbin directories" id="oval:mil.disa.fso.redhat.rhel6:obj:3226" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/sbin</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/sbin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3227" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/sbin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/bin directories" id="oval:mil.disa.fso.redhat.rhel6:obj:3228" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/bin</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/bin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3229" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/bin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/sbin directories" id="oval:mil.disa.fso.redhat.rhel6:obj:3230" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/sbin</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/sbin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3231" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/sbin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/local/bin directories" id="oval:mil.disa.fso.redhat.rhel6:obj:3232" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/local/bin</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/local/bin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3233" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/local/bin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/local/sbin directories" id="oval:mil.disa.fso.redhat.rhel6:obj:3235" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/local/sbin</unix:path>
      <unix:filename xsi:nil="true" datatype="string" />
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/usr/local/sbin files" id="oval:mil.disa.fso.redhat.rhel6:obj:3236" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <unix:path operation="equals" datatype="string">/usr/local/sbin</unix:path>
      <unix:filename operation="pattern match" datatype="string">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/group" id="oval:mil.disa.fso.redhat.rhel6:obj:3237" version="1">
      <unix:filepath datatype="string">/etc/group</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3239" version="1">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)PermitUserEnvironment[\s]+no[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3240" version="1">
      <ind:filepath datatype="string">/etc/sysconfig/init</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*PROMPT[\s]*=[\s]*no[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/passwd" id="oval:mil.disa.fso.redhat.rhel6:obj:3241" version="1">
      <unix:filepath datatype="string">/etc/passwd</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3244" version="2">
      <ind:filepath datatype="string">/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*(?i)PermitEmptyPasswords(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3245" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3246" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3247" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3248" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3250" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3251" version="10">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*account\s+(?:(?:required))\s+pam_faillock\.so$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3253" version="10">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*deny=(?:[0-9]+).*unlock_time=(?:[0-9]+).*fail_interval=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="/etc/group" id="oval:mil.disa.fso.redhat.rhel6:obj:3255" version="1">
      <unix:filepath datatype="string">/etc/group</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3257" version="2">
      <ind:filepath datatype="string">/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:3452" version="1">
      <linux:name datatype="string">GConf2</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:3572" version="1">
      <linux:name datatype="string">gdm</linux:name>
    </linux:rpminfo_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3687" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/dir/dir/entry[@name='lock_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3689" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/dir/dir/dir/entry[@name='banner_message_enable']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3690" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/apps/gdm/simple-greeter/%gconf.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/entry[@name='banner_message_enable']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3699" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/dir/dir/entry[@name='idle_activation_enabled']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3709" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/dir/dir/entry[@name='mode']/stringvalue[1]/text()</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3717" version="1">
      <ind:filepath datatype="string">/etc/gconf/gconf.xml.mandatory/%gconf-tree.xml</ind:filepath>
      <ind:xpath datatype="string">/gconf/dir/dir/entry[@name='idle_delay']/@value</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3763" version="4">
      <ind:filepath datatype="string">/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*deny=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3764" version="4">
      <ind:filepath datatype="string">/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*account\s+(?:(?:required))\s+pam_faillock\.so$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3766" version="5">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*\s+unlock_time=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3768" version="4">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*account\s+(?:(?:required))\s+pam_faillock\.so$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3771" version="10">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*deny=(?:[0-9]+).*unlock_time=(?:[0-9]+).*fail_interval=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3772" version="10">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*account\s+(?:(?:required))\s+pam_faillock\.so$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3893" version="1">
      <set set_operator="UNION">
        <object_reference>oval:mil.disa.fso.redhat.rhel6:obj:1186</object_reference>
        <object_reference>oval:mil.disa.fso.redhat.rhel6:obj:3903</object_reference>
      </set>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3903" version="2">
      <ind:path datatype="string">/etc/security/limits.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3956" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+rmdir\s+.*\-F\s+auid&gt;=500\s+\-F\s+auid!=(?:(?:-1)|(?:4294967295))\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3959" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+unlink\s+.*\-F\s+auid&gt;=500\s+\-F\s+auid!=(?:(?:-1)|(?:4294967295))\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3962" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+unlinkat\s+.*\-F\s+auid&gt;=500\s+\-F\s+auid!=(?:(?:-1)|(?:4294967295))\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3965" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+rename\s+.*\-F\s+auid&gt;=500\s+\-F\s+auid!=(?:(?:-1)|(?:4294967295))\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3968" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+renameat\s+.*\-F\s+auid&gt;=500\s+\-F\s+auid!=(?:(?:-1)|(?:4294967295))\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3970" version="1">
      <ind:filepath datatype="string">/etc/security/limits.conf</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+core[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3971" version="1">
      <ind:path datatype="string">/etc/security/limits.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+core[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3977" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+rmdir\s+.*\-F\s+auid=0\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3978" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+unlink\s+.*\-F\s+auid=0\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3979" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+unlinkat\s+.*\-F\s+auid=0\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3980" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+rename\s+.*\-F\s+auid=0\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:3981" version="3">
      <ind:filepath datatype="string">/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[\s]*-a[\s](?:always,exit|exit,always)\s+(?:\-F\s+arch=(?:(?:b64)|(?:b32))\s+)?.*\-S\s+renameat\s+.*\-F\s+auid=0\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:mil.disa.fso.redhat.rhel6:obj:6640" version="1" comment="tcsh">
      <linux:name datatype="string" operation="equals">tcsh</linux:name>
    </linux:rpminfo_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:6641" version="1">
      <unix:path datatype="string" operation="equals">/etc</unix:path>
      <unix:filename datatype="string" operation="equals">csh.cshrc</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:7190" version="4">
      <ind:filepath datatype="string">/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*deny=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:7191" version="4">
      <ind:filepath datatype="string">/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*deny=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:19700" version="1" comment="ipv6 disabled in /etc/sysctl.conf file">
      <ind:path datatype="string">/etc</ind:path>
      <ind:filename operation="equals" datatype="string">sysctl.conf</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:19701" version="1" comment="ipv6 disabled in the running kernel according to sysctl.">
      <unix:name datatype="string">net.ipv6.conf.all.disable_ipv6</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:29920" version="7">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:29921" version="7">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*\s+unlock_time=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:31260" version="12">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*deny=(?:[0-9]+).*unlock_time=(?:[0-9]+).*fail_interval=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:31261" version="12">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth\s+(?:silent)?.*deny=(?:[0-9]+).*unlock_time=(?:[0-9]+).*fail_interval=([0-9]+).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:45300" version="2" comment="The password dcredit setting in /etc/pam.d/system-auth -appears not first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))[\t ]+[^#\n\r]*\s+dcredit=-(\d+)[^\n\r]*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:45301" version="2" comment="The password dcredit setting in /etc/pam.d/system-auth -appears first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))\s+dcredit=-(\d+)\s+.*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:47400" version="1" comment="The password ocredit setting in /etc/pam.d/system-auth -appears not first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))[\t ]+[^#\n\r]*\s+ocredit=-(\d+)[^\n\r]*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:47401" version="1" comment="The password ocredit setting in /etc/pam.d/system-auth -appears first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))\s+ocredit=-(\d+)\s+.*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:52300" version="1" comment="The password difok setting in /etc/pam.d/system-auth -appears not first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))[\t ]+[^#\n\r]*\s+difok=(\d+)[^\n\r]*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:52301" version="1" comment="The password difok setting in /etc/pam.d/system-auth -appears first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))\s+difok=(\d+)\s+.*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:obj:83700" version="1" comment="iptables entry in /var/lock/subsys">
      <filepath datatype="string" operation="equals">/var/lock/subsys/iptables</filepath>
    </file_object>
    <unix:file_object xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="Filepaths referenced in /etc/rsyslog" id="oval:mil.disa.fso.redhat.rhel6:obj:96400" version="4">
      <unix:filepath operation="equals" datatype="string" var_ref="oval:mil.disa.fso.redhat.rhel6:var:1905" var_check="at least one" />
    </unix:file_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:103200" version="1" comment="The password lcredit setting in /etc/pam.d/system-auth -appears not first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))[\t ]+[^#\n\r]*\s+lcredit=-(\d+)[^\n\r]*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:103201" version="1" comment="The password lcredit setting in /etc/pam.d/system-auth -appears first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))\s+lcredit=-(\d+)\s+.*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:114100" version="1" comment="The password ucredit setting in /etc/pam.d/system-auth -appears not first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))[\t ]+[^#\n\r]*\s+ucredit=-(\d+)[^\n\r]*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:114101" version="2" comment="The password ucredit setting in /etc/pam.d/system-auth -appears first">
      <ind:path datatype="string">/etc/pam.d</ind:path>
      <ind:filename datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^\s*password\s+(?:(?:required)|(?:requisite))\s+(?:(?:\/lib\/security\/\$ISA\/pam_cracklib\.so)|(?:pam_cracklib\.so))\s+ucredit=-(\d+)\s+.*$</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check all the files in /etc/pam.d for incorrect password pam_unix.so usage" id="oval:mil.disa.fso.redhat.rhel6:obj:149001" version="4">
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^([ \t]*password[ \t]+[^#\r\f\n]+[ \t]+pam_unix\.so.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
      <filter action="exclude">oval:mil.disa.fso.redhat.rhel6:ste:149001</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check all the files in /etc/pam.d for the setting: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:obj:149002" version="3">
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[ \t]*password[ \t]+sufficient[ \t]+pam_unix\.so(?:[ \t]+|(?:[ \t][^#\r\f\n]+[ \t]))sha512(?:[ \t]|$)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check the file /etc/pam.d/password-auth for the setting: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:obj:149003" version="3">
      <ind:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="equals" datatype="string">password-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[ \t]*password[ \t]+sufficient[ \t]+pam_unix\.so(.*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check the file /etc/pam.d/password-auth-ac for the setting: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:obj:149004" version="3">
      <ind:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="equals" datatype="string">password-auth-ac</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[ \t]*password[ \t]+sufficient[ \t]+pam_unix\.so(.*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check the file /etc/pam.d/system-auth for the setting: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:obj:149005" version="1">
      <ind:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="equals" datatype="string">system-auth</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[ \t]*password[ \t]+sufficient[ \t]+pam_unix\.so(.*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check the file /etc/pam.d/system-auth-ac for the setting: password sufficient pam_unix.so sha512" id="oval:mil.disa.fso.redhat.rhel6:obj:149006" version="1">
      <ind:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="equals" datatype="string">system-auth-ac</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[ \t]*password[ \t]+sufficient[ \t]+pam_unix\.so(.*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="Check all the files in /etc/pam.d for incorrect crypto use with password sufficient pam_unix.so usage" id="oval:mil.disa.fso.redhat.rhel6:obj:149007" version="1">
      <ind:path operation="equals" datatype="string">/etc/pam.d</ind:path>
      <ind:filename operation="pattern match" datatype="string">^.*$</ind:filename>
      <ind:pattern operation="pattern match" datatype="string">^[ \t]*password[ \t]+[^#\r\f\n]+[ \t]+pam_unix\.so(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:400100" version="2" comment="/etc/exports insecure_locks configuration">
      <ind:filepath operation="equals" datatype="string">/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string">^[^#]*insecure_locks.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:400200" version="6" comment="the remember setting in /etc/pam.d/system-auth">
      <filepath datatype="string" operation="equals">/etc/pam.d/system-auth</filepath>
      <pattern datatype="string" operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_pwhistory\.so[\t ]+[^#\n\r]*\s+remember=(\d+)(?:(?:\s)|(?:$))</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
    <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:obj:400201" version="4" comment="the remember setting in /etc/pam.d/system-auth">
      <filepath datatype="string" operation="equals">/etc/pam.d/system-auth</filepath>
      <pattern datatype="string" operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_pwhistory\.so\s+remember=(\d+)(?:(?:\s)|(?:$))</pattern>
      <instance datatype="int" operation="greater than or equal">1</instance>
    </textfilecontent54_object>
  </objects>
  <states>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1187" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3266" datatype="int" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="ClientAliveInterval in seconds" id="oval:mil.disa.fso.redhat.rhel6:ste:1189" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2113" />
    </ind:textfilecontent54_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1199" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1208" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1224" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1232" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1240" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1281" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1283" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3265" />
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1299" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1302" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2115" datatype="int" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1303" version="1">
      <ind:subexpression operation="greater than" datatype="int">-1</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1309" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1317" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1339" version="2">
      <ind:subexpression datatype="string">x</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1353" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1397" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1413" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3265" />
    </ind:textfilecontent54_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1432" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1476" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:xmlfilecontent_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1481" version="1">
      <ind:value_of datatype="string">blank-only</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="check for sha512" id="oval:mil.disa.fso.redhat.rhel6:ste:1490" version="3">
      <ind:subexpression operation="pattern match">^(?:[ \t]+|(?:[ \t][^#\r\f\n]+[ \t]))sha512(?:\s|$)</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1492" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1506" version="1">
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1520" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3269" datatype="int" />
    </ind:textfilecontent54_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1522" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1533" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1539" version="1">
      <ind:subexpression operation="equals" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2122" />
    </ind:textfilecontent54_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1548" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1550" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3265" />
    </ind:textfilecontent54_state>
    <ind:xmlfilecontent_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="idle timeout" id="oval:mil.disa.fso.redhat.rhel6:ste:1584" version="1">
      <ind:value_of datatype="int" operation="less than or equal" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2125" />
    </ind:xmlfilecontent_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1589" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1602" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1610" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2127" />
    </ind:textfilecontent54_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1612" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1626" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1628" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3272" datatype="int" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1639" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3265" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1642" version="4">
      <!-- According to the man page for auditd.conf the option names and value are case insensitive. -->
      <ind:subexpression operation="pattern match" datatype="string">^(?:[sS][iI][nN][gG][lL][eE]|[sS][uU][sS][pP][eE][nN][dD]|[hH][aA][lL][tT])$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:xmlfilecontent_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1644" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <unix:uname_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="64 bit architecture" id="oval:mil.disa.fso.redhat.rhel6:ste:1665" version="2">
      <unix:processor_type operation="equals">x86_64</unix:processor_type>
    </unix:uname_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1676" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1690" version="3">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2131" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1692" version="3">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2131" />
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1697" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1698" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1699" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">false</unix:uread>
      <unix:uwrite datatype="boolean">false</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1722" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1740" version="2">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1747" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1748" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1749" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">false</unix:uread>
      <unix:uwrite datatype="boolean">false</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1780" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1789" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1813" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1818" version="2">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2135" />
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1821" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1829" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1853" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1867" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2136" datatype="int" />
    </ind:textfilecontent54_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1881" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:uname_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="32 bit architecture" id="oval:mil.disa.fso.redhat.rhel6:ste:1902" version="2">
      <unix:processor_type operation="equals">i686</unix:processor_type>
    </unix:uname_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="Filepaths referenced in /etc/rsyslog" id="oval:mil.disa.fso.redhat.rhel6:ste:1903" version="4">
      <unix:filepath operation="pattern match" datatype="string" var_ref="oval:mil.disa.fso.redhat.rhel6:var:1904" var_check="at least one" />
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1904" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:1952" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:1988" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:2139" datatype="int" />
    </ind:textfilecontent54_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:1991" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:runlevel_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="not configured to start" id="oval:mil.disa.fso.redhat.rhel6:ste:2008" version="1">
      <unix:start datatype="boolean">false</unix:start>
      <unix:kill datatype="boolean">true</unix:kill>
    </unix:runlevel_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2033" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:2039" version="1">
      <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3267" />
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2062" version="1" operator="OR">
      <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:uexec datatype="boolean">true</unix:uexec>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:gexec datatype="boolean">true</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2070" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2072" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:2082" version="3">
      <ind:subexpression operation="pattern match" datatype="string">^0?(022|027)$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2093" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2094" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2095" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2103" version="2" comment="File is world writable">
      <unix:type operation="equals">regular</unix:type>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2104" version="2" comment="File is group writable">
      <unix:type operation="equals">regular</unix:type>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:2106" version="3" comment="uid not equal to root">
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <ind:xmlfilecontent_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3141" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3143" version="3">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3264" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3145" version="3">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3264" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3154" version="2">
      <ind:subexpression operation="equals">none</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3163" version="1">
      <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3183" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3187" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3268" datatype="int" />
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3190" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3194" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3203" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3270" datatype="int" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3210" version="1">
      <ind:subexpression operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3211" version="1">
      <ind:subexpression datatype="string" operation="equals">no</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3216" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3219" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3238" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3242" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3252" version="10">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3276" />
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3254" version="10">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:mil.disa.fso.redhat.rhel6:var:3276" />
    </ind:textfilecontent54_state>
    <unix:file_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:3256" version="1">
      <unix:uread datatype="boolean">true</unix:uread>
      <unix:uwrite datatype="boolean">true</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <ind:xmlfilecontent_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:3453" version="1">
      <ind:value_of datatype="string">true</ind:value_of>
    </ind:xmlfilecontent_state>
    <unix:sysctl_state xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:mil.disa.fso.redhat.rhel6:ste:19701" version="1" comment="sysctl should report back that net.ipv6.conf.all.disable_ipv6 equals 1.">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:45300" version="1" comment="dcredit greater than or equal to one">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:47400" version="1" comment="ocredit greater than or equal to one">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:52300" version="1" comment="difok greater than or equal to eight">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal">8</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:103200" version="1" comment="lcredit negative value greater than or equal to one">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mil.disa.fso.redhat.rhel6:ste:114100" version="1" comment="ucredit greater than or equal to one">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="check for anything not matching to password sufficient pam_unix.so sha512 ..." id="oval:mil.disa.fso.redhat.rhel6:ste:149001" version="1">
      <ind:subexpression operation="pattern match">^[ \t]*password[ \t]+sufficient[ \t]+pam_unix.so(?:[ \t]+|(?:[ \t][^#\r\f\n]+[ \t]))sha512(?:[\s]|$)</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="check for md5, blowfish, big_crypt, sha256" id="oval:mil.disa.fso.redhat.rhel6:ste:149002" version="1">
      <ind:subexpression operation="pattern match">^(?:[ \t]+|(?:[ \t][^#\r\f\n]+[ \t]))(?:md5|sha256|big_crypt|blowfish)(?:\s|$)</ind:subexpression>
    </ind:textfilecontent54_state>
    <textfilecontent54_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" comment="greater than 5" id="oval:mil.disa.fso.redhat.rhel6:ste:400200" version="1">
      <subexpression datatype="int" operation="greater than or equal">5</subexpression>
    </textfilecontent54_state>
  </states>
  <variables>
    <local_variable id="oval:mil.disa.fso.redhat.rhel6:var:1904" datatype="string" version="4" comment="pattern for log files from /etc/rsyslog.conf and their default rotations">
      <concat>
        <literal_component>^</literal_component>
        <escape_regex>
          <object_component object_ref="oval:mil.disa.fso.redhat.rhel6:obj:96400" item_field="filepath" />
        </escape_regex>
        <literal_component>[^/]*$</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:mil.disa.fso.redhat.rhel6:var:1905" datatype="string" version="3" comment="log files from /etc/rsyslog.conf">
      <object_component object_ref="oval:mil.disa.fso.redhat.rhel6:obj:1904" item_field="subexpression" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.redhat.rhel6:var:1906" datatype="string" version="4" comment="paths from /etc/rsyslog.conf specified log files">
      <object_component object_ref="oval:mil.disa.fso.redhat.rhel6:obj:96400" item_field="path" />
    </local_variable>
    <local_variable id="oval:mil.disa.fso.redhat.rhel6:var:1907" datatype="string" version="4" comment="filenames for default rotations of rsyslog.conf specified log files">
      <concat>
        <literal_component>^</literal_component>
        <escape_regex>
          <object_component object_ref="oval:mil.disa.fso.redhat.rhel6:obj:96400" item_field="filename" />
        </escape_regex>
        <literal_component>[^/]*$</literal_component>
      </concat>
    </local_variable>
    <external_variable comment="timeout value" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:2113" version="1" />
    <external_variable comment="inactive days expiration" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:2115" version="1" />
    <external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:2122" version="1" />
    <external_variable comment="inactivity timeout variable" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:2125" version="1" />
    <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:2127" version="1" />
    <external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:2130" version="1" />
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:2131" version="3" />
    <external_variable comment="audit space_left_action setting" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:2135" version="2" />
    <external_variable comment="audit max_log_file settting" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:2136" version="1" />
    <external_variable comment="audit num_logs settting" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:2139" version="1" />
    <external_variable comment="external variable for daemon umask" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:2143" version="1" />
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3264" version="3" />
    <external_variable comment="user umask" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:3265" version="1" />
    <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3266" version="1" />
    <external_variable comment="external variable for selinux state" datatype="string" id="oval:mil.disa.fso.redhat.rhel6:var:3267" version="1" />
    <external_variable comment="password minimum length" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3268" version="1" />
    <external_variable comment="minimum password age in days" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3269" version="1" />
    <external_variable comment="maximum password age" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3270" version="1" />
    <external_variable comment="password expiration warning age in days" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3272" version="1" />
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:mil.disa.fso.redhat.rhel6:var:3276" version="10" />
  </variables>
</oval_definitions>
