OpenSCAP scan results questions about IPv6 and others

Latest response

After running a scan against on of our lab systems I noticed that I failed the "Result for Disable Accepting IPv6 Redirects" . So I go back and do the remediation steps:

# sysctl -w net.ipv6.conf.default.accept_redirects=0

Which returns:

# error: "net.ipv6.conf.default.accept_redirects" is an unknown key

I found the reason here:

https://access.redhat.com/solutions/1308033

The solution in the link above essentially says to re-enable the ipv6 module which will allow sysctl to read the params and set them. Problem with this is that one of the other SCAP rule ID calls for disabling the ipv6 module. So either way it looks like I'll take a hit on this scan. These rule ID's on ipv6 do not seem to make much sense. If you have the module disabled you should not need to worry about the other parameters in /etc/sysctl.conf such as the redirects as ipv6 is essentially disabled anyway. Am I wrong? So not sure what to do here.

Next question - I am testing with xccdf and the pre-canned stig profile. What constitutes a "passing" score against STIG? And are there any more pre-canned profiles/xml files that I can download for RHEL6? Are most non-DOD enterprises that use SCAP using a STIG profile or creating customized profiles?

Responses