ssg-rhel6-ocil.xml

<?xml version="1.0"?>
<ns0:ocil xmlns:ns0="http://scap.nist.gov/schema/ocil/2.0">
  <ns0:generator>
    <ns0:product_name>xccdf-create-ocil.xslt from SCAP Security Guide</ns0:product_name>
    <ns0:product_version>ssg: 0.1.46</ns0:product_version>
    <ns0:schema_version>2.0</ns0:schema_version>
    <ns0:timestamp>2020-04-02T13:13:21Z</ns0:timestamp>
  </ns0:generator>
  <ns0:questionnaires>
    <ns0:questionnaire id="ocil:ssg-package_rsh_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall rsh Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_rsh_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rlogin_disabled_ocil:questionnaire:1">
      <ns0:title>Disable rlogin Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rlogin_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rexec_disabled_ocil:questionnaire:1">
      <ns0:title>Disable rexec Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rexec_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rsh_disabled_ocil:questionnaire:1">
      <ns0:title>Disable rsh Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rsh_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_rsh-server_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall rsh-server Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_rsh-server_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1">
      <ns0:title>Remove Rsh Trust Files</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_telnet_removed_ocil:questionnaire:1">
      <ns0:title>Remove telnet Clients</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_telnet_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_telnet_disabled_ocil:questionnaire:1">
      <ns0:title>Disable telnet Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_telnet_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_telnet-server_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall telnet-server Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_telnet-server_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_ypbind_removed_ocil:questionnaire:1">
      <ns0:title>Remove NIS Client</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_ypbind_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_ypbind_disabled_ocil:questionnaire:1">
      <ns0:title>Disable ypbind Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_ypbind_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_ypserv_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall ypserv Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_ypserv_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_tftp_disabled_ocil:questionnaire:1">
      <ns0:title>Disable tftp Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_tftp_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_tftp_removed_ocil:questionnaire:1">
      <ns0:title>Remove tftp Daemon</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_tftp_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-tftpd_uses_secure_mode_ocil:questionnaire:1">
      <ns0:title>Ensure tftp Daemon Uses Secure Mode</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-tftpd_uses_secure_mode_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_tftp-server_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall tftp-server Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_tftp-server_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_xinetd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable xinetd Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_xinetd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_xinetd_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall xinetd Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_xinetd_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_talk_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall talk Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_talk_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_talk-server_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall talk-server Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_talk-server_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ftp_present_banner_ocil:questionnaire:1">
      <ns0:title>Create Warning Banners for All FTP Users</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ftp_present_banner_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ftp_log_transactions_ocil:questionnaire:1">
      <ns0:title>Enable Logging of All FTP Transactions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ftp_log_transactions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_vsftpd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable vsftpd Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_vsftpd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall vsftpd Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_vsftpd_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1">
      <ns0:title>Configure SNMP Service to Use Only SNMPv3 or Newer</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-snmpd_use_newer_protocol_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-snmpd_not_default_password_ocil:questionnaire:1">
      <ns0:title>Ensure Default SNMP Password Is Not Used</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-snmpd_not_default_password_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall net-snmp Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_net-snmp_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_snmpd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable snmpd Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_snmpd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-disable_anacron_ocil:questionnaire:1">
      <ns0:title>Disable anacron Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-disable_anacron_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_crond_enabled_ocil:questionnaire:1">
      <ns0:title>Enable cron Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_crond_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_atd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable At Service (atd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_atd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_cron_enabled_ocil:questionnaire:1">
      <ns0:title>Enable cron Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_cron_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1">
      <ns0:title>Remove the X Windows Package Group</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-xwindows_runlevel_setting_ocil:questionnaire:1">
      <ns0:title>Disable X Windows Startup By Setting Runlevel</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-xwindows_runlevel_setting_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_named_disabled_ocil:questionnaire:1">
      <ns0:title>Disable named Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_named_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_bind_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall bind Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_bind_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_openldap-servers_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall openldap-servers Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_openldap-servers_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ldap_client_start_tls_ocil:questionnaire:1">
      <ns0:title>Configure LDAP Client to Use TLS For All Transactions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ldap_client_start_tls_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ldap_client_tls_cacertpath_ocil:questionnaire:1">
      <ns0:title>Configure Certificate Directives for LDAP Use of TLS</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ldap_client_tls_cacertpath_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysconfig_networking_bootproto_ifcfg_ocil:questionnaire:1">
      <ns0:title>Disable DHCP Client in ifcfg</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysconfig_networking_bootproto_ifcfg_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_dhcp_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall DHCP Server Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_dhcp_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_dhcpd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable DHCP Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_dhcpd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_smb_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Samba</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_smb_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_samba_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall Samba Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_samba_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_samba-common_installed_ocil:questionnaire:1">
      <ns0:title>Install the Samba Common Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_samba-common_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-mount_option_smb_client_signing_ocil:questionnaire:1">
      <ns0:title>Require Client SMB Packet Signing, if using mount.cifs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-mount_option_smb_client_signing_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-require_smb_client_signing_ocil:questionnaire:1">
      <ns0:title>Require Client SMB Packet Signing, if using smbclient</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-require_smb_client_signing_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1">
      <ns0:title>Install usbguard Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_usbguard_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_httpd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable httpd Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_httpd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_httpd_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall httpd Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_httpd_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-dir_perms_etc_httpd_conf_ocil:questionnaire:1">
      <ns0:title>Set Permissions on the /etc/httpd/conf/ Directory</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-dir_perms_etc_httpd_conf_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_httpd_server_conf_files_ocil:questionnaire:1">
      <ns0:title>Set Permissions on All Configuration Files Inside /etc/httpd/conf/</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_httpd_server_conf_files_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-dir_perms_var_log_httpd_ocil:questionnaire:1">
      <ns0:title>Set Permissions on the /var/log/httpd/ Directory</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-dir_perms_var_log_httpd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-httpd_configure_firewall_ocil:questionnaire:1">
      <ns0:title>Configure firewall to Allow Access to the Web Server</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-httpd_configure_firewall_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sssd_memcache_timeout_ocil:questionnaire:1">
      <ns0:title>Configure SSSD's Memory Cache to Expire</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sssd_memcache_timeout_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_sssd-ipa_installed_ocil:questionnaire:1">
      <ns0:title>Install sssd-ipa Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_sssd-ipa_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1">
      <ns0:title>Configure SSSD to Expire Offline Credentials</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sssd_offline_cred_expiration_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_sssd_installed_ocil:questionnaire:1">
      <ns0:title>Install the SSSD Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_sssd_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sssd_ssh_known_hosts_timeout_ocil:questionnaire:1">
      <ns0:title>Configure SSSD to Expire SSH Known Hosts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_sssd_enabled_ocil:questionnaire:1">
      <ns0:title>Enable the SSSD Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_sssd_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_timesyncd_enabled_ocil:questionnaire:1">
      <ns0:title>Enable systemd_timesyncd Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_timesyncd_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1">
      <ns0:title>Enable the NTP Daemon</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_ntpd_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ntpd_specify_remote_server_ocil:questionnaire:1">
      <ns0:title>Specify a Remote NTP Server</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ntpd_specify_remote_server_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_ntp_enabled_ocil:questionnaire:1">
      <ns0:title>Enable the NTP Daemon</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_ntp_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall Automatic Bug Reporting Tool (abrt)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_cgred_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Control Group Rules Engine (cgred)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_cgred_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_messagebus_disabled_ocil:questionnaire:1">
      <ns0:title>Disable D-Bus IPC Service (messagebus)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_messagebus_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_acpid_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Advanced Configuration and Power Interface (acpid)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_acpid_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rdisc_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Network Router Discovery Daemon (rdisc)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rdisc_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_cpuspeed_disabled_ocil:questionnaire:1">
      <ns0:title>Disable CPU Speed (cpuspeed)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_cpuspeed_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_netconsole_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Network Console (netconsole)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_netconsole_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_certmonger_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Certmonger Service (certmonger)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_certmonger_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_quota_nld_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Quota Netlink (quota_nld)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_quota_nld_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_psacct_enabled_ocil:questionnaire:1">
      <ns0:title>Enable Process Accounting (psacct)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_psacct_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rhnsd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Red Hat Network Service (rhnsd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rhnsd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_psacct_installed_ocil:questionnaire:1">
      <ns0:title>Install the psacct package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_psacct_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_mdmonitor_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Software RAID Monitor (mdmonitor)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_mdmonitor_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_irqbalance_enabled_ocil:questionnaire:1">
      <ns0:title>Enable IRQ Balance (irqbalance)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_irqbalance_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_oddjobd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Odd Job Daemon (oddjobd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_oddjobd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_haldaemon_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Hardware Abstraction Layer Service (haldaemon)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_haldaemon_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_smartd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable SMART Disk Monitoring Service (smartd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_smartd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_qpidd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Apache Qpid (qpidd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_qpidd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_abrtd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Automatic Bug Reporting Tool (abrtd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_abrtd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_saslauthd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Cyrus SASL Authentication Daemon (saslauthd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_saslauthd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_cgconfig_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Control Group Config (cgconfig)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_cgconfig_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_ntpdate_disabled_ocil:questionnaire:1">
      <ns0:title>Disable ntpdate Service (ntpdate)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_ntpdate_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_kdump_disabled_ocil:questionnaire:1">
      <ns0:title>Disable KDump Kernel Crash Analyzer (kdump)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_kdump_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rhsmcertd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Red Hat Subscription Manager Daemon (rhsmcertd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rhsmcertd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_portreserve_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Portreserve (portreserve)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_portreserve_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_sysstat_disabled_ocil:questionnaire:1">
      <ns0:title>Disable System Statistics Reset Service (sysstat)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_sysstat_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1">
      <ns0:title>Enable Use of Strict Mode Checking</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_enable_strictmodes_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1">
      <ns0:title>Disable SSH Support for User Known Hosts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1">
      <ns0:title>Disable SSH Access via Empty Passwords</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_empty_passwords_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1">
      <ns0:title>Set SSH Client Alive Max Count</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_set_keepalive_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1">
      <ns0:title>Disable SSH Support for Rhosts RSA Authentication</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1">
      <ns0:title>Enable SSH Warning Banner</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_enable_warning_banner_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1">
      <ns0:title>Force frequent session key renegotiation</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_rekey_limit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_use_approved_macs_ocil:questionnaire:1">
      <ns0:title>Use Only FIPS 140-2 Validated MACs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_use_approved_macs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1">
      <ns0:title>Do Not Allow SSH Environment Options</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1">
      <ns0:title>Disable Kerberos Authentication</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1">
      <ns0:title>Allow Only SSH Protocol 2</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1">
      <ns0:title>Disable SSH Support for .rhosts Files</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_rhosts_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1">
      <ns0:title>Set SSH Idle Timeout Interval</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_set_idle_timeout_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1">
      <ns0:title>Set LogLevel to INFO</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_set_loglevel_info_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1">
      <ns0:title>Enable Encrypted X11 Forwarding</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_use_approved_ciphers_ocil:questionnaire:1">
      <ns0:title>Use Only FIPS 140-2 Validated Ciphers</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_use_approved_ciphers_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-disable_host_auth_ocil:questionnaire:1">
      <ns0:title>Disable Host-Based Authentication</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-disable_host_auth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1">
      <ns0:title>Set SSH authentication attempt limit</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_set_max_auth_tries_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1">
      <ns0:title>Set SSH Daemon LogLevel to VERBOSE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_use_strong_macs_ocil:questionnaire:1">
      <ns0:title>Use Only Strong MACs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_use_strong_macs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1">
      <ns0:title>Enable Use of Privilege Separation</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_use_priv_separation_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1">
      <ns0:title>Enable SSH Print Last Log</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_print_last_log_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_use_strong_ciphers_ocil:questionnaire:1">
      <ns0:title>Use Only Strong Ciphers</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_use_strong_ciphers_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1">
      <ns0:title>Disable GSSAPI Authentication</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1">
      <ns0:title>Disable Compression Or Set Compression to delayed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_compression_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1">
      <ns0:title>Disable SSH Root Login</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sshd_disable_root_login_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1">
      <ns0:title>Verify Permissions on SSH Server Private *_key Key Files</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_sshd_private_key_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1">
      <ns0:title>Verify Permissions on SSH Server Public *.pub Key Files</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1">
      <ns0:title>Configure System to Forward All Mail For The Root Account</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-postfix_network_listening_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Postfix Network Listening</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-postfix_network_listening_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall Sendmail Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_sendmail_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_postfix_enabled_ocil:questionnaire:1">
      <ns0:title>Enable Postfix Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_postfix_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_dovecot_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall dovecot Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_dovecot_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_dovecot_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Dovecot Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_dovecot_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1">
      <ns0:title>Ensure All-Squashing Disabled On All Exports</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_all_squash_exports_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_insecure_locks_exports_ocil:questionnaire:1">
      <ns0:title>Ensure Insecure File Locking is Not Allowed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_insecure_locks_exports_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-mount_option_nosuid_remote_filesystems_ocil:questionnaire:1">
      <ns0:title>Mount Remote Filesystems with nosuid</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-mount_option_nosuid_remote_filesystems_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-mount_option_nodev_remote_filesystems_ocil:questionnaire:1">
      <ns0:title>Mount Remote Filesystems with nodev</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-mount_option_nodev_remote_filesystems_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-nfs_no_anonymous_ocil:questionnaire:1">
      <ns0:title>Specify UID and GID for Anonymous NFS Connections</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-nfs_no_anonymous_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Network File System (nfs)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_nfs_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rpcsvcgssd_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Secure RPC Server Service (rpcsvcgssd)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall nfs-utils Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_nfs-utils_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cups_disable_browsing_ocil:questionnaire:1">
      <ns0:title>Disable Printer Browsing Entirely if Possible</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cups_disable_browsing_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_cups_disabled_ocil:questionnaire:1">
      <ns0:title>Disable the CUPS Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_cups_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_avahi-daemon_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Avahi Server Software</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_avahi-daemon_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_squid_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Squid</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_squid_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_squid_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall squid Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_squid_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-partition_for_srv_ocil:questionnaire:1">
      <ns0:title>Ensure /srv Located On Separate Partition</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-partition_for_srv_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-partition_for_home_ocil:questionnaire:1">
      <ns0:title>Ensure /home Located On Separate Partition</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-partition_for_home_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-encrypt_partitions_ocil:questionnaire:1">
      <ns0:title>Encrypt Partitions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-encrypt_partitions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-partition_for_var_ocil:questionnaire:1">
      <ns0:title>Ensure /var Located On Separate Partition</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-partition_for_var_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-partition_for_tmp_ocil:questionnaire:1">
      <ns0:title>Ensure /tmp Located On Separate Partition</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-partition_for_tmp_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1">
      <ns0:title>Ensure /var/log/audit Located On Separate Partition</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-partition_for_var_log_audit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-partition_for_var_log_ocil:questionnaire:1">
      <ns0:title>Ensure /var/log Located On Separate Partition</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-partition_for_var_log_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1">
      <ns0:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sudo_require_authentication_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1">
      <ns0:title>Only the VDSM User Can Use sudo NOPASSWD</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1">
      <ns0:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sudo_remove_no_authenticate_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1">
      <ns0:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sudo_remove_nopasswd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_sudo_installed_ocil:questionnaire:1">
      <ns0:title>Install sudo Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_sudo_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_binutils_installed_ocil:questionnaire:1">
      <ns0:title>Install binutils Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_binutils_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-plugin-sosreport_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-plugin-sosreport Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-plugin-sosreport_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-plugin-rhtsupport Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-plugin-rhtsupport_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_libcap-ng-utils_installed_ocil:questionnaire:1">
      <ns0:title>Install libcap-ng-utils Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_libcap-ng-utils_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_krb5-workstation_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall krb5-workstation Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_krb5-workstation_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_geolite2-country_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall geolite2-country Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_geolite2-country_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_vim_installed_ocil:questionnaire:1">
      <ns0:title>Install vim Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_vim_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-addon-kerneloops_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-addon-kerneloops Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-addon-kerneloops_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall iprutils Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_iprutils_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-plugin-logger_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-plugin-logger Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-plugin-logger_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_geolite2-city_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall geolite2-city Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_geolite2-city_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1">
      <ns0:title>Install scap-security-guide Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_scap-security-guide_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_tar_installed_ocil:questionnaire:1">
      <ns0:title>Install tar Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_tar_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1">
      <ns0:title>Install rng-tools Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_rng-tools_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_python-rhsm_installed_ocil:questionnaire:1">
      <ns0:title>Install python-rhsm Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_python-rhsm_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall gssproxy Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_gssproxy_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-addon-ccpp_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-addon-ccpp Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-addon-ccpp_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-cli_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-cli Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-cli_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_tuned_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall tuned Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_tuned_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1">
      <ns0:title>Install openscap-scanner Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_openscap-scanner_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_abrt-addon-python_removed_ocil:questionnaire:1">
      <ns0:title>Uninstall abrt-addon-python Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_abrt-addon-python_removed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1">
      <ns0:title>Install cryptsetup-luks Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1">
      <ns0:title>The Installed Operating System Is Vendor Supported</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-installed_OS_is_FIPS_certified_ocil:questionnaire:1">
      <ns0:title>The Installed Operating System Is FIPS 140-2 Certified</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-grub_legacy_enable_fips_mode_ocil:questionnaire:1">
      <ns0:title>Enable FIPS Mode in GRUB Legacy</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-grub_legacy_enable_fips_mode_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_dracut-fips-aesni_installed_ocil:questionnaire:1">
      <ns0:title>Install the dracut-fips-aesni Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_dracut-fips-aesni_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_dracut-fips_installed_ocil:questionnaire:1">
      <ns0:title>Install the dracut-fips Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_dracut-fips_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1">
      <ns0:title>Harden SSH client Crypto Policy</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-harden_sshd_crypto_policy_ocil:questionnaire:1">
      <ns0:title>Harden SSHD Crypto Policy</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-harden_sshd_crypto_policy_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-install_antivirus_ocil:questionnaire:1">
      <ns0:title>Install Virus Scanning Software</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-install_antivirus_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1">
      <ns0:title>Configure Backups of User Data</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-configure_user_data_backups_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-install_hids_ocil:questionnaire:1">
      <ns0:title>Install Intrusion Detection Software</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-install_hids_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1">
      <ns0:title>Verify and Correct File Permissions with RPM</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rpm_verify_permissions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rpm_verify_ownership_ocil:questionnaire:1">
      <ns0:title>Verify and Correct Ownership with RPM</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rpm_verify_ownership_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1">
      <ns0:title>Verify File Hashes with RPM</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rpm_verify_hashes_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_aide_installed_ocil:questionnaire:1">
      <ns0:title>Install AIDE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_aide_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1">
      <ns0:title>Configure Periodic Execution of AIDE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-aide_periodic_cron_checking_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-aide_build_database_ocil:questionnaire:1">
      <ns0:title>Build and Test AIDE Database</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-aide_build_database_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1">
      <ns0:title>Ensure gpgcheck Enabled In Main yum Configuration</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ensure_redhat_gpgkey_installed_ocil:questionnaire:1">
      <ns0:title>Ensure Red Hat GPG Key Installed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ensure_redhat_gpgkey_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1">
      <ns0:title>Ensure gpgcheck Enabled for All yum Package Repositories</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screensaver_mode_blank_ocil:questionnaire:1">
      <ns0:title>Implement Blank Screensaver</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screensaver_mode_blank_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1">
      <ns0:title>Enable Screen Lock Activation After Idle Period</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screensaver_lock_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1">
      <ns0:title>GNOME Desktop Screensaver Mandatory Use</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screensaver_idle_activation_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screen_locking_keybindings_ocil:questionnaire:1">
      <ns0:title>Set GNOME Screen Locking Keybindings</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screen_locking_keybindings_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screensaver_max_idle_time_ocil:questionnaire:1">
      <ns0:title>Set GNOME Login Maximum Allowed Inactivity</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screensaver_max_idle_time_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screensaver_max_idle_action_ocil:questionnaire:1">
      <ns0:title>Set GNOME Login Maximum Allowed Inactivity Action</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screensaver_max_idle_action_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_screensaver_idle_delay_ocil:questionnaire:1">
      <ns0:title>Set GNOME Login Inactivity Timeout</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_screensaver_idle_delay_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_automount_ocil:questionnaire:1">
      <ns0:title>Disable GNOME Automounting</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_automount_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_thumbnailers_ocil:questionnaire:1">
      <ns0:title>Disable All GNOME Thumbnailers</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_thumbnailers_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1">
      <ns0:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_clock_weather_ocil:questionnaire:1">
      <ns0:title>Disable the GNOME Clock Weather Feature</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_clock_weather_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_clock_temperature_ocil:questionnaire:1">
      <ns0:title>Disable the GNOME Clock Temperature Feature</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_clock_temperature_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gnome_gdm_disable_guest_login_ocil:questionnaire:1">
      <ns0:title>Disable GDM Guest Login</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_restart_shutdown_ocil:questionnaire:1">
      <ns0:title>Disable the GNOME Login Restart and Shutdown Buttons</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_restart_shutdown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1">
      <ns0:title>Disable GDM Automatic Login</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gdm_disable_user_list_ocil:questionnaire:1">
      <ns0:title>Disable the User List</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gdm_disable_user_list_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_wifi_create_ocil:questionnaire:1">
      <ns0:title>Disable WIFI Network Connection Creation in GNOME</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_wifi_create_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_wifi_notification_ocil:questionnaire:1">
      <ns0:title>Disable WIFI Network Connection Notification in GNOME</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_wifi_notification_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gnome_disable_wifi_disconnect_ocil:questionnaire:1">
      <ns0:title>Disable WIFI Network Disconnect Notification in GNOME</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gnome_disable_wifi_disconnect_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1">
      <ns0:title>Ensure Logs Sent To Remote Host</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rsyslog_remote_loghost_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1">
      <ns0:title>Ensure Logrotate Runs Periodically</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-ensure_logrotate_activated_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1">
      <ns0:title>Ensure Log Files Are Owned By Appropriate Group</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rsyslog_files_groupownership_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1">
      <ns0:title>Ensure Log Files Are Owned By Appropriate User</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rsyslog_files_ownership_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1">
      <ns0:title>Ensure System Log Files Have Correct Permissions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-rsyslog_files_permissions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1">
      <ns0:title>Ensure syslog-ng is Installed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_syslogng_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1">
      <ns0:title>Enable syslog-ng Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_syslogng_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1">
      <ns0:title>Ensure rsyslog-gnutls is installed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1">
      <ns0:title>Enable rsyslog Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_rsyslog_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1">
      <ns0:title>Ensure rsyslog is Installed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_rsyslog_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1">
      <ns0:title>Install libreswan Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_libreswan_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_ip6tables_enabled_ocil:questionnaire:1">
      <ns0:title>Verify ip6tables Enabled if Using IPv6</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_ip6tables_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1">
      <ns0:title>Verify iptables Enabled</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1">
      <ns0:title>Set Default ip6tables Policy for Incoming Packets</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-set_ip6tables_default_rule_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1">
      <ns0:title>Set Default iptables Policy for Forwarded Packets</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-set_iptables_default_rule_forward_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1">
      <ns0:title>Set Default iptables Policy for Incoming Packets</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-set_iptables_default_rule_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_iptables_installed_ocil:questionnaire:1">
      <ns0:title>Install iptables Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_iptables_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for IPv6 Forwarding</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Accepting ICMP Redirects for All IPv6 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1">
      <ns0:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_ocil:questionnaire:1">
      <ns0:title>Configure Accepting Router Advertisements on All IPv6 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1">
      <ns0:title>Disable IPv6 Networking Support Automatic Loading</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1">
      <ns0:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1">
      <ns0:title>Disable DCCP Support</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_dccp_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1">
      <ns0:title>Disable ATM Support</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_atm_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1">
      <ns0:title>Disable TIPC Support</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_tipc_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_sctp_disabled_ocil:questionnaire:1">
      <ns0:title>Disable SCTP Support</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_sctp_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1">
      <ns0:title>Disable RDS Support</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_rds_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1">
      <ns0:title>Disable CAN Support</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_can_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Bluetooth Kernel Module</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_bluetooth_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Bluetooth Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_bluetooth_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1">
      <ns0:title>Deactivate Wireless Network Interfaces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-wireless_disable_interfaces_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1">
      <ns0:title>Ensure System is Not Acting as a Network Sniffer</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-network_sniffer_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-grub_legacy_enable_selinux_ocil:questionnaire:1">
      <ns0:title>Ensure SELinux Not Disabled in /etc/grub.conf</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-grub_legacy_enable_selinux_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-selinux_policytype_ocil:questionnaire:1">
      <ns0:title>Configure SELinux Policy</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-selinux_policytype_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1">
      <ns0:title>Install policycoreutils Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_policycoreutils_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1">
      <ns0:title>Ensure No Device Files are Unlabeled by SELinux</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-selinux_state_ocil:questionnaire:1">
      <ns0:title>Ensure SELinux State is Enforcing</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-selinux_state_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-grub_legacy_password_ocil:questionnaire:1">
      <ns0:title>Set Boot Loader Password in grub.conf</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-grub_legacy_password_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_owner_grub_conf_ocil:questionnaire:1">
      <ns0:title>Verify /etc/grub.conf User Ownership</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_owner_grub_conf_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_groupowner_grub_conf_ocil:questionnaire:1">
      <ns0:title>Verify /etc/grub.conf Group Ownership</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_groupowner_grub_conf_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_grub_conf_ocil:questionnaire:1">
      <ns0:title>Verify /boot/grub/grub.conf Permissions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_grub_conf_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1">
      <ns0:title>Restrict Serial Port Root Logins</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-restrict_serial_port_logins_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-root_path_default_ocil:questionnaire:1">
      <ns0:title>Root Path Must Be Vendor Default</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-root_path_default_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1">
      <ns0:title>Direct root Logins Not Allowed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_direct_root_logins_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_root_webbrowsing_ocil:questionnaire:1">
      <ns0:title>Restrict Web Browser Use for Administrative Accounts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_root_webbrowsing_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1">
      <ns0:title>Ensure that System Accounts Are Locked</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1">
      <ns0:title>Restrict Virtual Console Root Logins</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-securetty_root_login_console_only_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1">
      <ns0:title>Ensure that System Accounts Do Not Run a Shell Upon Login</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1">
      <ns0:title>Verify Only Root Has UID 0</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_no_uid_except_zero_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1">
      <ns0:title>Use Centralized and Automated Authentication</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-account_use_centralized_automated_auth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-account_unique_name_ocil:questionnaire:1">
      <ns0:title>Ensure All Accounts on the System Have Unique Names</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-account_unique_name_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1">
      <ns0:title>Set Account Expiration Following Inactivity</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-account_disable_post_pw_expiration_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1">
      <ns0:title>Assign Expiration Date to Temporary Accounts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-account_temp_expire_date_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1">
      <ns0:title>Set Password Minimum Length in login.defs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1">
      <ns0:title>Set Password Minimum Age</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1">
      <ns0:title>Set Password Maximum Age</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1">
      <ns0:title>Set Password Warning Age</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_netrc_files_ocil:questionnaire:1">
      <ns0:title>Verify No netrc Files Exist</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_netrc_files_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1">
      <ns0:title>Verify All Account Password Hashes are Shadowed</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_password_all_shadowed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_empty_passwords_ocil:questionnaire:1">
      <ns0:title>Prevent Login to Accounts With Empty Password</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_empty_passwords_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1">
      <ns0:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gid_passwd_group_same_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1">
      <ns0:title>Set Password Hashing Algorithm in /etc/login.defs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1">
      <ns0:title>Set PAM's Password Hashing Algorithm</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1">
      <ns0:title>Set Password Hashing Algorithm in /etc/libuser.conf</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1">
      <ns0:title>Set Lockout Time for Failed Password Attempts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1">
      <ns0:title>Limit Password Reuse</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1">
      <ns0:title>Set Interval For Counting Failed Password Attempts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1">
      <ns0:title>Set Deny For Failed Password Attempts</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_retry_ocil:questionnaire:1">
      <ns0:title>Set Password Retry Prompts Permitted Per-Session</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_retry_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_ocredit_ocil:questionnaire:1">
      <ns0:title>Set Password Strength Minimum Special Characters</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_ocredit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_dcredit_ocil:questionnaire:1">
      <ns0:title>Set Password Strength Minimum Digit Characters</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_dcredit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_maxrepeat_ocil:questionnaire:1">
      <ns0:title>Set Password to Maximum of Three Consecutive Repeating Characters</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_maxrepeat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_ucredit_ocil:questionnaire:1">
      <ns0:title>Set Password Strength Minimum Uppercase Characters</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_ucredit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_lcredit_ocil:questionnaire:1">
      <ns0:title>Set Password Strength Minimum Lowercase Characters</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_lcredit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_minlen_ocil:questionnaire:1">
      <ns0:title>Set Password Minimum Length</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_minlen_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_minclass_ocil:questionnaire:1">
      <ns0:title>Set Password Strength Minimum Different Categories</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_minclass_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-cracklib_accounts_password_pam_difok_ocil:questionnaire:1">
      <ns0:title>Set Password Strength Minimum Different Characters</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-cracklib_accounts_password_pam_difok_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-display_login_attempts_ocil:questionnaire:1">
      <ns0:title>Ensure PAM Displays Last Logon/Access Notification</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-display_login_attempts_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_screen_installed_ocil:questionnaire:1">
      <ns0:title>Install the screen Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_screen_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-smartcard_auth_ocil:questionnaire:1">
      <ns0:title>Enable Smart Card Login</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-smartcard_auth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1">
      <ns0:title>Disable Ctrl-Alt-Del Reboot Activation</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1">
      <ns0:title>Require Authentication for Single User Mode</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-require_singleuser_auth_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-grub_legacy_disable_interactive_boot_ocil:questionnaire:1">
      <ns0:title>Disable Interactive Boot</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-grub_legacy_disable_interactive_boot_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gdm_enable_warning_gui_banner_ocil:questionnaire:1">
      <ns0:title>Enable GUI Warning Banner</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gdm_enable_warning_gui_banner_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-gconf_gdm_set_login_banner_text_ocil:questionnaire:1">
      <ns0:title>Set GUI Warning Banner Text</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-gconf_gdm_set_login_banner_text_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-banner_etc_issue_ocil:questionnaire:1">
      <ns0:title>Modify the System Login Banner</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-banner_etc_issue_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1">
      <ns0:title>Ensure the Default Umask is Set Correctly in login.defs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_umask_etc_bashrc_ocil:questionnaire:1">
      <ns0:title>Ensure the Default Bash Umask is Set Correctly</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_umask_etc_csh_cshrc_ocil:questionnaire:1">
      <ns0:title>Ensure the Default C Shell Umask is Set Correctly</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1">
      <ns0:title>Ensure the Default Umask is Set Correctly in /etc/profile</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_umask_etc_profile_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1">
      <ns0:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_tmout_ocil:questionnaire:1">
      <ns0:title>Set Interactive Session Timeout</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_tmout_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1">
      <ns0:title>Ensure that User Home Directories are not Group-Writable or World-Readable</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_home_dirs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1">
      <ns0:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_logon_fail_delay_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1">
      <ns0:title>Limit the Number of Concurrent Login Sessions Allowed Per User</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1">
      <ns0:title>Configure auditd flush priority</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_flush_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1">
      <ns0:title>Configure auditd to use audispd's syslog plugin</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1">
      <ns0:title>Configure auditd Disk Full Action when Disk Space Is Full</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_disk_full_action_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1">
      <ns0:title>Configure auditd Max Log File Size</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_space_left_ocil:questionnaire:1">
      <ns0:title>Configure auditd space_left on Low Disk Space</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_space_left_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1">
      <ns0:title>Configure auditd mail_acct Action on Low Disk Space</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1">
      <ns0:title>Configure auditd admin_space_left Action on Low Disk Space</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1">
      <ns0:title>Configure auditd space_left Action on Low Disk Space</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1">
      <ns0:title>Configure auditd Disk Error Action on Disk Error</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_disk_error_action_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1">
      <ns0:title>Configure auditd Number of Logs Retained</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_num_logs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1">
      <ns0:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1">
      <ns0:title>Record Attempts to Alter Time Through stime</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_time_stime_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1">
      <ns0:title>Record attempts to alter time through settimeofday</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_time_settimeofday_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1">
      <ns0:title>Record Attempts to Alter the localtime File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1">
      <ns0:title>Record Attempts to Alter Time Through clock_settime</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_time_clock_settime_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1">
      <ns0:title>Record attempts to alter time through adjtimex</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_time_adjtimex_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - fchown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - chown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - chmod</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - lchown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_renameat_ocil:questionnaire:1">
      <ns0:title>Record Successful Delete Attempts to Files - renameat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Delete Attempts to Files - renameat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lchown_ocil:questionnaire:1">
      <ns0:title>Record Successful Ownership Changes to Files - lchown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lchown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_ocil:questionnaire:1">
      <ns0:title>Record Successful Creation Attempts to Files - open O_TRUNC_WRITE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - chmod</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Ownership Changes to Files - fchownat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_chmod_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - chmod</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_chmod_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Ownership Changes to Files - lchown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - fsetxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fsetxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - fchmodat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_ocil:questionnaire:1">
      <ns0:title>Record Successful Access Attempts to Files - open_by_handle_at</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - removexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Ownership Changes to Files - chown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Ownership Changes to Files - fchown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Access Attempts to Files - truncate</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - setxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - fremovexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - lsetxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lsetxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_ocil:questionnaire:1">
      <ns0:title>Record Successful Delete Attempts to Files - unlinkat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_unlinkat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - lremovexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_setxattr_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - setxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_setxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - fchmodat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchmodat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - fremovexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - lremovexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lremovexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Delete Attempts to Files - unlink</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Access Attempts to Files - creat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_ocil:questionnaire:1">
      <ns0:title>Record Successful Access Attempts to Files - open</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - fsetxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_truncate_ocil:questionnaire:1">
      <ns0:title>Record Successful Access Attempts to Files - truncate</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_truncate_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - lsetxattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Access Attempts to Files - open</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_removexattr_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - removexattr</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_removexattr_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchown_ocil:questionnaire:1">
      <ns0:title>Record Successful Ownership Changes to Files - fchown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_ocil:questionnaire:1">
      <ns0:title>Record Successful Access Attempts to Files - ftruncate</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_ftruncate_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_chown_ocil:questionnaire:1">
      <ns0:title>Record Successful Ownership Changes to Files - chown</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_chown_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Access Attempts to Files - ftruncate</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_ocil:questionnaire:1">
      <ns0:title>Record Successful Creation Attempts to Files - openat O_CREAT</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_creat_ocil:questionnaire:1">
      <ns0:title>Record Successful Access Attempts to Files - creat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_unlink_ocil:questionnaire:1">
      <ns0:title>Record Successful Delete Attempts to Files - unlink</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_unlink_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1">
      <ns0:title>Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchownat_ocil:questionnaire:1">
      <ns0:title>Record Successful Ownership Changes to Files - fchownat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchownat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Delete Attempts to Files - unlinkat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_rename_ocil:questionnaire:1">
      <ns0:title>Record Successful Delete Attempts to Files - rename</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_rename_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_ocil:questionnaire:1">
      <ns0:title>Record Successful Access Attempts to Files - openat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_ocil:questionnaire:1">
      <ns0:title>Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Permission Changes to Files - fchmod</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_ocil:questionnaire:1">
      <ns0:title>Record Successful Creation Attempts to Files - open O_CREAT</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_o_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessful Access Attempts to Files - openat</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_ocil:questionnaire:1">
      <ns0:title>Record Unsuccessul Delete Attempts to Files - rename</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1">
      <ns0:title>Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchmod_ocil:questionnaire:1">
      <ns0:title>Record Successful Permission Changes to Files - fchmod</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchmod_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects File Deletion Events by User</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newuidmap_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify User/Group Information - /etc/shadow</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1">
      <ns0:title>System Audit Logs Must Have Mode 0750 or Less Permissive</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-directory_permissions_var_log_audit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1">
      <ns0:title>Record Access Events to Audit Log Directory</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-directory_access_var_log_audit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects System Administrator Actions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Network Environment</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify User/Group Information</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify User/Group Information - /etc/gshadow</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1">
      <ns0:title>Ensure auditd Collects Information on Exporting to Media (successful)</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_media_export_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1">
      <ns0:title>System Audit Logs Must Have Mode 0640 or Less Permissive</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_var_log_audit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1">
      <ns0:title>System Audit Logs Must Be Owned By Root</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_ownership_var_log_audit_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify User/Group Information - /etc/passwd</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify the System's Mandatory Access Controls</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_mac_modification_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1">
      <ns0:title>Record Events that Modify User/Group Information - /etc/group</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_name_format_ocil:questionnaire:1">
      <ns0:title>Set hostname as computer node name in audit logs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_name_format_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-grub_legacy_audit_argument_ocil:questionnaire:1">
      <ns0:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-grub_legacy_audit_argument_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_write_logs_ocil:questionnaire:1">
      <ns0:title>Write Audit Logs to the Disk</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_write_logs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1">
      <ns0:title>Install audispd-plugins Package</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-package_audispd-plugins_installed_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1">
      <ns0:title>Enable auditd Service</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_auditd_enabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_local_events_ocil:questionnaire:1">
      <ns0:title>Include Local Events in Audit Logs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_local_events_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_freq_ocil:questionnaire:1">
      <ns0:title>Set number of records to cause an explicit flush to audit logs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_freq_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-auditd_log_format_ocil:questionnaire:1">
      <ns0:title>Resolve information before writing to audit logs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-auditd_log_format_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1">
      <ns0:title>Verify Permissions on shadow File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_etc_shadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1">
      <ns0:title>Verify User Who Owns shadow File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_owner_etc_shadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1">
      <ns0:title>Verify User Who Owns group File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_owner_etc_group_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1">
      <ns0:title>Verify Permissions on group File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_etc_group_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1">
      <ns0:title>Verify Group Who Owns gshadow File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1">
      <ns0:title>Verify User Who Owns passwd File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_owner_etc_passwd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1">
      <ns0:title>Verify Group Who Owns shadow File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_groupowner_etc_shadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1">
      <ns0:title>Verify User Who Owns gshadow File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_owner_etc_gshadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1">
      <ns0:title>Verify Group Who Owns group File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_groupowner_etc_group_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1">
      <ns0:title>Verify Permissions on gshadow File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_etc_gshadow_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1">
      <ns0:title>Verify Group Who Owns passwd File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_groupowner_etc_passwd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1">
      <ns0:title>Verify Permissions on passwd File</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_etc_passwd_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1">
      <ns0:title>Verify that System Executables Have Restrictive Permissions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_binary_dirs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1">
      <ns0:title>Verify that Shared Library Files Have Root Ownership</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_ownership_library_dirs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1">
      <ns0:title>Verify that System Executables Have Root Ownership</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_ownership_binary_dirs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1">
      <ns0:title>Verify that Shared Library Files Have Restrictive Permissions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_library_dirs_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1">
      <ns0:title>Ensure All SGID Executables Are Authorized</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Enforce DAC on Symlinks</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-dir_perms_world_writable_system_owned_ocil:questionnaire:1">
      <ns0:title>Ensure All World-Writable Directories Are Owned by a System Account</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1">
      <ns0:title>Ensure All Files Are Owned by a Group</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_ungroupowned_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1">
      <ns0:title>Ensure All Files Are Owned by a User</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-no_files_unowned_by_user_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1">
      <ns0:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1">
      <ns0:title>Ensure No World-Writable Files Exist</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1">
      <ns0:title>Ensure All SUID Executables Are Authorized</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1">
      <ns0:title>Verify that local System.map file (if exists) is readable only by root</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-file_permissions_systemmap_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1">
      <ns0:title>Verify that All World-Writable Directories Have Sticky Bits Set</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-umask_for_daemons_ocil:questionnaire:1">
      <ns0:title>Set Daemon Umask</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-umask_for_daemons_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1">
      <ns0:title>Disable core dump backtraces</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-coredump_disable_backtraces_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1">
      <ns0:title>Disable Core Dumps for SUID programs</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1">
      <ns0:title>Disable storing core dump</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-coredump_disable_storage_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1">
      <ns0:title>Disable Core Dumps for All Users</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-disable_users_coredumps_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1">
      <ns0:title>Restrict Exposed Kernel Pointer Addresses Access</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1">
      <ns0:title>Enable ExecShield via sysctl</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1">
      <ns0:title>Enable Randomized Layout of Virtual Address Space</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Kernel Image Loading</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1">
      <ns0:title>Restrict usage of ptrace to descendant processes</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1">
      <ns0:title>Restrict Access to Kernel Message Buffer</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1">
      <ns0:title>Disable Modprobe Loading of USB Storage Driver</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1">
      <ns0:title>Disable the Automounter</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-service_autofs_disabled_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
    <ns0:questionnaire id="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1">
      <ns0:title>Add noexec Option to Removable Media Partitions</ns0:title>
      <ns0:actions>
        <ns0:test_action_ref>ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1</ns0:test_action_ref>
      </ns0:actions>
    </ns0:questionnaire>
  </ns0:questionnaires>
  <ns0:test_actions>
    <ns0:boolean_question_test_action id="ocil:ssg-package_rsh_removed_action:testaction:1" question_ref="ocil:ssg-package_rsh_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rlogin_disabled_action:testaction:1" question_ref="ocil:ssg-service_rlogin_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rexec_disabled_action:testaction:1" question_ref="ocil:ssg-service_rexec_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rsh_disabled_action:testaction:1" question_ref="ocil:ssg-service_rsh_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_rsh-server_removed_action:testaction:1" question_ref="ocil:ssg-package_rsh-server_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_rsh_trust_files_action:testaction:1" question_ref="ocil:ssg-no_rsh_trust_files_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_telnet_removed_action:testaction:1" question_ref="ocil:ssg-package_telnet_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_telnet_disabled_action:testaction:1" question_ref="ocil:ssg-service_telnet_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_telnet-server_removed_action:testaction:1" question_ref="ocil:ssg-package_telnet-server_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_ypbind_removed_action:testaction:1" question_ref="ocil:ssg-package_ypbind_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_ypbind_disabled_action:testaction:1" question_ref="ocil:ssg-service_ypbind_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_ypserv_removed_action:testaction:1" question_ref="ocil:ssg-package_ypserv_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_tftp_disabled_action:testaction:1" question_ref="ocil:ssg-service_tftp_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_tftp_removed_action:testaction:1" question_ref="ocil:ssg-package_tftp_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-tftpd_uses_secure_mode_action:testaction:1" question_ref="ocil:ssg-tftpd_uses_secure_mode_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_tftp-server_removed_action:testaction:1" question_ref="ocil:ssg-package_tftp-server_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_xinetd_disabled_action:testaction:1" question_ref="ocil:ssg-service_xinetd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_xinetd_removed_action:testaction:1" question_ref="ocil:ssg-package_xinetd_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_talk_removed_action:testaction:1" question_ref="ocil:ssg-package_talk_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_talk-server_removed_action:testaction:1" question_ref="ocil:ssg-package_talk-server_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ftp_present_banner_action:testaction:1" question_ref="ocil:ssg-ftp_present_banner_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ftp_log_transactions_action:testaction:1" question_ref="ocil:ssg-ftp_log_transactions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_vsftpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_vsftpd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_vsftpd_removed_action:testaction:1" question_ref="ocil:ssg-package_vsftpd_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-snmpd_use_newer_protocol_action:testaction:1" question_ref="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-snmpd_not_default_password_action:testaction:1" question_ref="ocil:ssg-snmpd_not_default_password_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_net-snmp_removed_action:testaction:1" question_ref="ocil:ssg-package_net-snmp_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_snmpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_snmpd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-disable_anacron_action:testaction:1" question_ref="ocil:ssg-disable_anacron_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_crond_enabled_action:testaction:1" question_ref="ocil:ssg-service_crond_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_atd_disabled_action:testaction:1" question_ref="ocil:ssg-service_atd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_cron_enabled_action:testaction:1" question_ref="ocil:ssg-service_cron_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1" question_ref="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-xwindows_runlevel_setting_action:testaction:1" question_ref="ocil:ssg-xwindows_runlevel_setting_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_named_disabled_action:testaction:1" question_ref="ocil:ssg-service_named_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_bind_removed_action:testaction:1" question_ref="ocil:ssg-package_bind_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_openldap-servers_removed_action:testaction:1" question_ref="ocil:ssg-package_openldap-servers_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ldap_client_start_tls_action:testaction:1" question_ref="ocil:ssg-ldap_client_start_tls_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ldap_client_tls_cacertpath_action:testaction:1" question_ref="ocil:ssg-ldap_client_tls_cacertpath_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysconfig_networking_bootproto_ifcfg_action:testaction:1" question_ref="ocil:ssg-sysconfig_networking_bootproto_ifcfg_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_dhcp_removed_action:testaction:1" question_ref="ocil:ssg-package_dhcp_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_dhcpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_dhcpd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_smb_disabled_action:testaction:1" question_ref="ocil:ssg-service_smb_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_samba_removed_action:testaction:1" question_ref="ocil:ssg-package_samba_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_samba-common_installed_action:testaction:1" question_ref="ocil:ssg-package_samba-common_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-mount_option_smb_client_signing_action:testaction:1" question_ref="ocil:ssg-mount_option_smb_client_signing_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-require_smb_client_signing_action:testaction:1" question_ref="ocil:ssg-require_smb_client_signing_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_usbguard_installed_action:testaction:1" question_ref="ocil:ssg-package_usbguard_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_httpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_httpd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_httpd_removed_action:testaction:1" question_ref="ocil:ssg-package_httpd_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-dir_perms_etc_httpd_conf_action:testaction:1" question_ref="ocil:ssg-dir_perms_etc_httpd_conf_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_httpd_server_conf_files_action:testaction:1" question_ref="ocil:ssg-file_permissions_httpd_server_conf_files_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-dir_perms_var_log_httpd_action:testaction:1" question_ref="ocil:ssg-dir_perms_var_log_httpd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-httpd_configure_firewall_action:testaction:1" question_ref="ocil:ssg-httpd_configure_firewall_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sssd_memcache_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_memcache_timeout_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_sssd-ipa_installed_action:testaction:1" question_ref="ocil:ssg-package_sssd-ipa_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sssd_offline_cred_expiration_action:testaction:1" question_ref="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_sssd_installed_action:testaction:1" question_ref="ocil:ssg-package_sssd_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_sssd_enabled_action:testaction:1" question_ref="ocil:ssg-service_sssd_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_timesyncd_enabled_action:testaction:1" question_ref="ocil:ssg-service_timesyncd_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntpd_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ntpd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-ntpd_specify_remote_server_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_ntp_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntp_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_cgred_disabled_action:testaction:1" question_ref="ocil:ssg-service_cgred_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_messagebus_disabled_action:testaction:1" question_ref="ocil:ssg-service_messagebus_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_acpid_disabled_action:testaction:1" question_ref="ocil:ssg-service_acpid_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rdisc_disabled_action:testaction:1" question_ref="ocil:ssg-service_rdisc_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_cpuspeed_disabled_action:testaction:1" question_ref="ocil:ssg-service_cpuspeed_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_netconsole_disabled_action:testaction:1" question_ref="ocil:ssg-service_netconsole_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_certmonger_disabled_action:testaction:1" question_ref="ocil:ssg-service_certmonger_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_quota_nld_disabled_action:testaction:1" question_ref="ocil:ssg-service_quota_nld_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_psacct_enabled_action:testaction:1" question_ref="ocil:ssg-service_psacct_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rhnsd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rhnsd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_psacct_installed_action:testaction:1" question_ref="ocil:ssg-package_psacct_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_mdmonitor_disabled_action:testaction:1" question_ref="ocil:ssg-service_mdmonitor_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_irqbalance_enabled_action:testaction:1" question_ref="ocil:ssg-service_irqbalance_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_oddjobd_disabled_action:testaction:1" question_ref="ocil:ssg-service_oddjobd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_haldaemon_disabled_action:testaction:1" question_ref="ocil:ssg-service_haldaemon_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_smartd_disabled_action:testaction:1" question_ref="ocil:ssg-service_smartd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_qpidd_disabled_action:testaction:1" question_ref="ocil:ssg-service_qpidd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_abrtd_disabled_action:testaction:1" question_ref="ocil:ssg-service_abrtd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_saslauthd_disabled_action:testaction:1" question_ref="ocil:ssg-service_saslauthd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_cgconfig_disabled_action:testaction:1" question_ref="ocil:ssg-service_cgconfig_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_ntpdate_disabled_action:testaction:1" question_ref="ocil:ssg-service_ntpdate_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_kdump_disabled_action:testaction:1" question_ref="ocil:ssg-service_kdump_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rhsmcertd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rhsmcertd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_portreserve_disabled_action:testaction:1" question_ref="ocil:ssg-service_portreserve_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_sysstat_disabled_action:testaction:1" question_ref="ocil:ssg-service_sysstat_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_enable_strictmodes_action:testaction:1" question_ref="ocil:ssg-sshd_enable_strictmodes_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_empty_passwords_action:testaction:1" question_ref="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_rekey_limit_action:testaction:1" question_ref="ocil:ssg-sshd_rekey_limit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_use_approved_macs_action:testaction:1" question_ref="ocil:ssg-sshd_use_approved_macs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1" question_ref="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_kerb_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_allow_only_protocol2_action:testaction:1" question_ref="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_set_idle_timeout_action:testaction:1" question_ref="ocil:ssg-sshd_set_idle_timeout_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_info_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_info_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_use_approved_ciphers_action:testaction:1" question_ref="ocil:ssg-sshd_use_approved_ciphers_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-disable_host_auth_action:testaction:1" question_ref="ocil:ssg-disable_host_auth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_set_max_auth_tries_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_use_strong_macs_action:testaction:1" question_ref="ocil:ssg-sshd_use_strong_macs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_use_priv_separation_action:testaction:1" question_ref="ocil:ssg-sshd_use_priv_separation_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_print_last_log_action:testaction:1" question_ref="ocil:ssg-sshd_print_last_log_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_use_strong_ciphers_action:testaction:1" question_ref="ocil:ssg-sshd_use_strong_ciphers_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_compression_action:testaction:1" question_ref="ocil:ssg-sshd_disable_compression_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sshd_disable_root_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_login_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-postfix_network_listening_disabled_action:testaction:1" question_ref="ocil:ssg-postfix_network_listening_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_sendmail_removed_action:testaction:1" question_ref="ocil:ssg-package_sendmail_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_postfix_enabled_action:testaction:1" question_ref="ocil:ssg-service_postfix_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_dovecot_removed_action:testaction:1" question_ref="ocil:ssg-package_dovecot_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_dovecot_disabled_action:testaction:1" question_ref="ocil:ssg-service_dovecot_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_all_squash_exports_action:testaction:1" question_ref="ocil:ssg-no_all_squash_exports_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_insecure_locks_exports_action:testaction:1" question_ref="ocil:ssg-no_insecure_locks_exports_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-mount_option_nosuid_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_nosuid_remote_filesystems_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-mount_option_nodev_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_remote_filesystems_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-nfs_no_anonymous_action:testaction:1" question_ref="ocil:ssg-nfs_no_anonymous_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_nfs_disabled_action:testaction:1" question_ref="ocil:ssg-service_nfs_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_nfs-utils_removed_action:testaction:1" question_ref="ocil:ssg-package_nfs-utils_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cups_disable_browsing_action:testaction:1" question_ref="ocil:ssg-cups_disable_browsing_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_cups_disabled_action:testaction:1" question_ref="ocil:ssg-service_cups_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_avahi-daemon_disabled_action:testaction:1" question_ref="ocil:ssg-service_avahi-daemon_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_squid_disabled_action:testaction:1" question_ref="ocil:ssg-service_squid_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_squid_removed_action:testaction:1" question_ref="ocil:ssg-package_squid_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-partition_for_srv_action:testaction:1" question_ref="ocil:ssg-partition_for_srv_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-partition_for_home_action:testaction:1" question_ref="ocil:ssg-partition_for_home_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-encrypt_partitions_action:testaction:1" question_ref="ocil:ssg-encrypt_partitions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-partition_for_var_action:testaction:1" question_ref="ocil:ssg-partition_for_var_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-partition_for_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_tmp_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-partition_for_var_log_audit_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_audit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-partition_for_var_log_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sudo_require_authentication_action:testaction:1" question_ref="ocil:ssg-sudo_require_authentication_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sudo_remove_no_authenticate_action:testaction:1" question_ref="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sudo_remove_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_remove_nopasswd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_sudo_installed_action:testaction:1" question_ref="ocil:ssg-package_sudo_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_binutils_installed_action:testaction:1" question_ref="ocil:ssg-package_binutils_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-sosreport_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-sosreport_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-rhtsupport_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_libcap-ng-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_libcap-ng-utils_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_krb5-workstation_removed_action:testaction:1" question_ref="ocil:ssg-package_krb5-workstation_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_geolite2-country_removed_action:testaction:1" question_ref="ocil:ssg-package_geolite2-country_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_vim_installed_action:testaction:1" question_ref="ocil:ssg-package_vim_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-addon-kerneloops_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-kerneloops_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_iprutils_removed_action:testaction:1" question_ref="ocil:ssg-package_iprutils_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-logger_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-logger_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_geolite2-city_removed_action:testaction:1" question_ref="ocil:ssg-package_geolite2-city_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_scap-security-guide_installed_action:testaction:1" question_ref="ocil:ssg-package_scap-security-guide_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_tar_installed_action:testaction:1" question_ref="ocil:ssg-package_tar_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_rng-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_rng-tools_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_python-rhsm_installed_action:testaction:1" question_ref="ocil:ssg-package_python-rhsm_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_gssproxy_removed_action:testaction:1" question_ref="ocil:ssg-package_gssproxy_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-addon-ccpp_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-ccpp_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-cli_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-cli_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_tuned_removed_action:testaction:1" question_ref="ocil:ssg-package_tuned_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_openscap-scanner_installed_action:testaction:1" question_ref="ocil:ssg-package_openscap-scanner_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_abrt-addon-python_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-python_removed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1" question_ref="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_FIPS_certified_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-grub_legacy_enable_fips_mode_action:testaction:1" question_ref="ocil:ssg-grub_legacy_enable_fips_mode_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_dracut-fips-aesni_installed_action:testaction:1" question_ref="ocil:ssg-package_dracut-fips-aesni_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_dracut-fips_installed_action:testaction:1" question_ref="ocil:ssg-package_dracut-fips_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-harden_sshd_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_crypto_policy_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-install_antivirus_action:testaction:1" question_ref="ocil:ssg-install_antivirus_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-configure_user_data_backups_action:testaction:1" question_ref="ocil:ssg-configure_user_data_backups_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-install_hids_action:testaction:1" question_ref="ocil:ssg-install_hids_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rpm_verify_permissions_action:testaction:1" question_ref="ocil:ssg-rpm_verify_permissions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rpm_verify_ownership_action:testaction:1" question_ref="ocil:ssg-rpm_verify_ownership_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rpm_verify_hashes_action:testaction:1" question_ref="ocil:ssg-rpm_verify_hashes_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_aide_installed_action:testaction:1" question_ref="ocil:ssg-package_aide_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-aide_periodic_cron_checking_action:testaction:1" question_ref="ocil:ssg-aide_periodic_cron_checking_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-aide_build_database_action:testaction:1" question_ref="ocil:ssg-aide_build_database_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ensure_redhat_gpgkey_installed_action:testaction:1" question_ref="ocil:ssg-ensure_redhat_gpgkey_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screensaver_mode_blank_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screensaver_mode_blank_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screensaver_lock_enabled_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screensaver_lock_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screensaver_idle_activation_enabled_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screensaver_idle_activation_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screen_locking_keybindings_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screen_locking_keybindings_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screensaver_max_idle_time_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screensaver_max_idle_time_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screensaver_max_idle_action_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screensaver_max_idle_action_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_screensaver_idle_delay_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_screensaver_idle_delay_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_automount_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_automount_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_thumbnailers_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_thumbnailers_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_clock_weather_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_clock_weather_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_clock_temperature_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_clock_temperature_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_restart_shutdown_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_restart_shutdown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gdm_disable_user_list_action:testaction:1" question_ref="ocil:ssg-gconf_gdm_disable_user_list_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_wifi_create_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_wifi_create_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_wifi_notification_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_wifi_notification_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gnome_disable_wifi_disconnect_action:testaction:1" question_ref="ocil:ssg-gconf_gnome_disable_wifi_disconnect_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rsyslog_remote_loghost_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_loghost_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-ensure_logrotate_activated_action:testaction:1" question_ref="ocil:ssg-ensure_logrotate_activated_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rsyslog_files_groupownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_groupownership_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rsyslog_files_ownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_ownership_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-rsyslog_files_permissions_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_permissions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_syslogng_installed_action:testaction:1" question_ref="ocil:ssg-package_syslogng_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_syslogng_enabled_action:testaction:1" question_ref="ocil:ssg-service_syslogng_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_rsyslog_enabled_action:testaction:1" question_ref="ocil:ssg-service_rsyslog_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_rsyslog_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_libreswan_installed_action:testaction:1" question_ref="ocil:ssg-package_libreswan_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_ip6tables_enabled_action:testaction:1" question_ref="ocil:ssg-service_ip6tables_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_iptables_enabled_action:testaction:1" question_ref="ocil:ssg-service_iptables_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-set_ip6tables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_ip6tables_default_rule_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_forward_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_iptables_installed_action:testaction:1" question_ref="ocil:ssg-package_iptables_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_dccp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_atm_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_atm_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_tipc_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_sctp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_sctp_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_rds_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_rds_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_can_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_can_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-service_bluetooth_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-wireless_disable_interfaces_action:testaction:1" question_ref="ocil:ssg-wireless_disable_interfaces_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-network_sniffer_disabled_action:testaction:1" question_ref="ocil:ssg-network_sniffer_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-grub_legacy_enable_selinux_action:testaction:1" question_ref="ocil:ssg-grub_legacy_enable_selinux_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-selinux_policytype_action:testaction:1" question_ref="ocil:ssg-selinux_policytype_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_policycoreutils_installed_action:testaction:1" question_ref="ocil:ssg-package_policycoreutils_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1" question_ref="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-selinux_state_action:testaction:1" question_ref="ocil:ssg-selinux_state_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-grub_legacy_password_action:testaction:1" question_ref="ocil:ssg-grub_legacy_password_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_owner_grub_conf_action:testaction:1" question_ref="ocil:ssg-file_owner_grub_conf_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_groupowner_grub_conf_action:testaction:1" question_ref="ocil:ssg-file_groupowner_grub_conf_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_grub_conf_action:testaction:1" question_ref="ocil:ssg-file_permissions_grub_conf_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-restrict_serial_port_logins_action:testaction:1" question_ref="ocil:ssg-restrict_serial_port_logins_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-root_path_default_action:testaction:1" question_ref="ocil:ssg-root_path_default_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_direct_root_logins_action:testaction:1" question_ref="ocil:ssg-no_direct_root_logins_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_root_webbrowsing_action:testaction:1" question_ref="ocil:ssg-no_root_webbrowsing_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-securetty_root_login_console_only_action:testaction:1" question_ref="ocil:ssg-securetty_root_login_console_only_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_no_uid_except_zero_action:testaction:1" question_ref="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-account_use_centralized_automated_auth_action:testaction:1" question_ref="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-account_unique_name_action:testaction:1" question_ref="ocil:ssg-account_unique_name_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-account_disable_post_pw_expiration_action:testaction:1" question_ref="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-account_temp_expire_date_action:testaction:1" question_ref="ocil:ssg-account_temp_expire_date_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_netrc_files_action:testaction:1" question_ref="ocil:ssg-no_netrc_files_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_empty_passwords_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gid_passwd_group_same_action:testaction:1" question_ref="ocil:ssg-gid_passwd_group_same_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_retry_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_retry_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_ocredit_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_ocredit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_dcredit_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_dcredit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_maxrepeat_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_maxrepeat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_ucredit_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_ucredit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_lcredit_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_lcredit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_minlen_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_minlen_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_minclass_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_minclass_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-cracklib_accounts_password_pam_difok_action:testaction:1" question_ref="ocil:ssg-cracklib_accounts_password_pam_difok_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-display_login_attempts_action:testaction:1" question_ref="ocil:ssg-display_login_attempts_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_screen_installed_action:testaction:1" question_ref="ocil:ssg-package_screen_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-smartcard_auth_action:testaction:1" question_ref="ocil:ssg-smartcard_auth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-require_singleuser_auth_action:testaction:1" question_ref="ocil:ssg-require_singleuser_auth_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-grub_legacy_disable_interactive_boot_action:testaction:1" question_ref="ocil:ssg-grub_legacy_disable_interactive_boot_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gdm_enable_warning_gui_banner_action:testaction:1" question_ref="ocil:ssg-gconf_gdm_enable_warning_gui_banner_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-gconf_gdm_set_login_banner_text_action:testaction:1" question_ref="ocil:ssg-gconf_gdm_set_login_banner_text_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-banner_etc_issue_action:testaction:1" question_ref="ocil:ssg-banner_etc_issue_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_bashrc_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_csh_cshrc_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_profile_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_profile_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1" question_ref="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_tmout_action:testaction:1" question_ref="ocil:ssg-accounts_tmout_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_home_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_home_dirs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_logon_fail_delay_action:testaction:1" question_ref="ocil:ssg-accounts_logon_fail_delay_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1" question_ref="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_flush_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_flush_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_disk_full_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_full_action_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_disk_error_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_error_action_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_num_logs_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_time_stime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_stime_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_time_settimeofday_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_time_clock_settime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_time_adjtimex_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_renameat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lchown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_chmod_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_unlinkat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_setxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchmodat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_truncate_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_removexattr_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_ftruncate_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_chown_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_unlink_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchownat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_rename_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchmod_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgidmap_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newuidmap_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-directory_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-directory_access_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_access_var_log_audit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1" question_ref="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_media_export_action:testaction:1" question_ref="ocil:ssg-audit_rules_media_export_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_audit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_ownership_var_log_audit_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_mac_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_mac_modification_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_name_format_action:testaction:1" question_ref="ocil:ssg-auditd_name_format_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-grub_legacy_audit_argument_action:testaction:1" question_ref="ocil:ssg-grub_legacy_audit_argument_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_write_logs_action:testaction:1" question_ref="ocil:ssg-auditd_write_logs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-package_audispd-plugins_installed_action:testaction:1" question_ref="ocil:ssg-package_audispd-plugins_installed_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_auditd_enabled_action:testaction:1" question_ref="ocil:ssg-service_auditd_enabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_local_events_action:testaction:1" question_ref="ocil:ssg-auditd_local_events_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_freq_action:testaction:1" question_ref="ocil:ssg-auditd_freq_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-auditd_log_format_action:testaction:1" question_ref="ocil:ssg-auditd_log_format_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_owner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_shadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_owner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_group_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_group_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_owner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_passwd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_owner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_gshadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_group_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_passwd_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_binary_dirs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_library_dirs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_binary_dirs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_library_dirs_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_ungroupowned_action:testaction:1" question_ref="ocil:ssg-file_permissions_ungroupowned_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-no_files_unowned_by_user_action:testaction:1" question_ref="ocil:ssg-no_files_unowned_by_user_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-file_permissions_systemmap_action:testaction:1" question_ref="ocil:ssg-file_permissions_systemmap_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-umask_for_daemons_action:testaction:1" question_ref="ocil:ssg-umask_for_daemons_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-coredump_disable_backtraces_action:testaction:1" question_ref="ocil:ssg-coredump_disable_backtraces_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-coredump_disable_storage_action:testaction:1" question_ref="ocil:ssg-coredump_disable_storage_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-disable_users_coredumps_action:testaction:1" question_ref="ocil:ssg-disable_users_coredumps_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-service_autofs_disabled_action:testaction:1" question_ref="ocil:ssg-service_autofs_disabled_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
    <ns0:boolean_question_test_action id="ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
      <ns0:when_true>
        <ns0:result>PASS</ns0:result>
      </ns0:when_true>
      <ns0:when_false>
        <ns0:result>FAIL</ns0:result>
      </ns0:when_false>
    </ns0:boolean_question_test_action>
  </ns0:test_actions>
  <ns0:questions>
    <ns0:boolean_question id="ocil:ssg-package_rsh_removed_question:question:1">
      <ns0:question_text>The rsh package can be removed with the following command:  $ sudo yum erase rsh
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rlogin_disabled_question:question:1">
      <ns0:question_text>
      Is it the case that service and/or socket are running?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rexec_disabled_question:question:1">
      <ns0:question_text>
      Is it the case that service and/or socket are running?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rsh_disabled_question:question:1">
      <ns0:question_text>
      Is it the case that service and/or socket are running?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_rsh-server_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the rsh-server package is installed:
$ rpm -q rsh-server
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_rsh_trust_files_question:question:1">
      <ns0:question_text>The existence of the file /etc/hosts.equiv or a file named
.rhosts inside a user home directory indicates the presence
of an Rsh trust relationship.
      Is it the case that these files exist?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_telnet_removed_question:question:1">
      <ns0:question_text>The telnet package can be removed with the following command:  $ sudo yum erase telnet
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_telnet_disabled_question:question:1">
      <ns0:question_text>
      Is it the case that service and/or socket are running?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_telnet-server_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the telnet-server package is installed:
$ rpm -q telnet-server
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_ypbind_removed_question:question:1">
      <ns0:question_text>The ypbind package can be removed with the following command:  $ sudo yum erase ypbind
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_ypbind_disabled_question:question:1">
      <ns0:question_text> To check that the ypbind service is disabled in system boot configuration, run the following command: $ sudo chkconfig ypbind --list Output should indicate the ypbind service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig ypbind --list ypbind       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify ypbind is disabled through current runtime configuration: $ sudo service ypbind status
If the service is disabled the command will return the following output: ypbind is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_ypserv_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the ypserv package is installed:
$ rpm -q ypserv
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_tftp_disabled_question:question:1">
      <ns0:question_text> To check that the tftp service is disabled in system boot configuration, run the following command: $ sudo chkconfig tftp --list Output should indicate the tftp service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig tftp --list tftp       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify tftp is disabled through current runtime configuration: $ sudo service tftp status
If the service is disabled the command will return the following output: tftp is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_tftp_removed_question:question:1">
      <ns0:question_text>The tftp package can be removed with the following command:  $ sudo yum erase tftp
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-tftpd_uses_secure_mode_question:question:1">
      <ns0:question_text>If TFTP is not installed, this is not applicable. To determine if TFTP is
installed, run the following command:
$ rpm -qa | grep tftp

Verify tftp is configured by with the -s option by
running the following command:
grep "server_args" /etc/xinetd.d/tftp
The output should indicate the server_args variable is configured
with the -s flag, matching the example below:
$ grep "server_args" /etc/xinetd.d/tftp
server_args = -s /var/lib/tftpboot
      Is it the case that this flag is missing?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_tftp-server_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the tftp-server package is installed:
$ rpm -q tftp-server
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_xinetd_disabled_question:question:1">
      <ns0:question_text>If network services are using the xinetd service, this is not applicable.


To check that the xinetd service is disabled in system boot configuration, run the following command:
$ sudo chkconfig xinetd --list
Output should indicate the xinetd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo chkconfig xinetd --list
xinetd       0:off   1:off   2:off   3:off   4:off   5:off   6:off

Run the following command to verify xinetd is disabled through current runtime configuration:
$ sudo service xinetd status

If the service is disabled the command will return the following output:
xinetd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_xinetd_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the xinetd package is installed:
$ rpm -q xinetd
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_talk_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the talk package is installed:
$ rpm -q talk
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_talk-server_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the talk-server package is installed:
$ rpm -q talk-server
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ftp_present_banner_question:question:1">
      <ns0:question_text>If FTP services are not installed, this is not applicable.

To verify this configuration, run the following command:

grep "banner_file" /etc/vsftpd/vsftpd.conf


The output should show the value of banner_file is set to /etc/issue, an example of which is shown below:

$ sudo grep "banner_file" /etc/vsftpd/vsftpd.conf

banner_file=/etc/issue
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ftp_log_transactions_question:question:1">
      <ns0:question_text>Find if logging is applied to the FTP daemon.

Procedures:

If vsftpd is started by xinetd the following command will indicate the xinetd.d startup file:
$ grep vsftpd /etc/xinetd.d/*
$ grep server_args vsftpd xinetd.d startup file
This will indicate the vsftpd config file used when starting through xinetd.
If the server_args line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
$ sudo grep xferlog_enable vsftpd config file
      Is it the case that xferlog_enable is missing, or is not set to yes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_vsftpd_disabled_question:question:1">
      <ns0:question_text> To check that the vsftpd service is disabled in system boot configuration, run the following command: $ sudo chkconfig vsftpd --list Output should indicate the vsftpd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig vsftpd --list vsftpd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify vsftpd is disabled through current runtime configuration: $ sudo service vsftpd status
If the service is disabled the command will return the following output: vsftpd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_vsftpd_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the vsftpd package is installed:
$ rpm -q vsftpd
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
      <ns0:question_text>To ensure only SNMPv3 or newer is used, run the following command:
$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"
There should be no output.
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-snmpd_not_default_password_question:question:1">
      <ns0:question_text>To ensure the default password is not set, run the following command:
$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep -E 'public|private'
There should be no output.
      Is it the case that the default SNMP passwords public and private have not been changed or removed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_net-snmp_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the net-snmp package is installed:
$ rpm -q net-snmp
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_snmpd_disabled_question:question:1">
      <ns0:question_text> To check that the snmpd service is disabled in system boot configuration, run the following command: $ sudo chkconfig snmpd --list Output should indicate the snmpd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig snmpd --list snmpd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify snmpd is disabled through current runtime configuration: $ sudo service snmpd status
If the service is disabled the command will return the following output: snmpd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-disable_anacron_question:question:1">
      <ns0:question_text>Run the following command to determine if the cronie-anacron package is installed:
$ rpm -q cronie-anacron
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_crond_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the crond service: $ sudo service crond status If the service is enabled, it should return the following: crond is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_atd_disabled_question:question:1">
      <ns0:question_text> To check that the atd service is disabled in system boot configuration, run the following command: $ sudo chkconfig atd --list Output should indicate the atd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig atd --list atd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify atd is disabled through current runtime configuration: $ sudo service atd status
If the service is disabled the command will return the following output: atd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_cron_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the cron service: $ sudo service cron status If the service is enabled, it should return the following: cron is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
      <ns0:question_text>To ensure the X Windows package group is removed, run the following command:
$ rpm -qi xorg-x11-server-common
The output should be:
package xorg-x11-server-common is not installed
      Is it the case that the X Windows package group or xorg-x11-server-common has not be removed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-xwindows_runlevel_setting_question:question:1">
      <ns0:question_text>To verify the default runlevel is 3, run the following command:
$ grep initdefault /etc/inittab
The output should show the following:
id:3:initdefault:
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_named_disabled_question:question:1">
      <ns0:question_text> To check that the named service is disabled in system boot configuration, run the following command: $ sudo chkconfig named --list Output should indicate the named service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig named --list named       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify named is disabled through current runtime configuration: $ sudo service named status
If the service is disabled the command will return the following output: named is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_bind_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the bind package is installed:
$ rpm -q bind
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_openldap-servers_removed_question:question:1">
      <ns0:question_text>To verify the openldap-servers package is not installed, run the
following command:
$ rpm -q openldap-servers
The output should show the following:
package openldap-servers is not installed
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ldap_client_start_tls_question:question:1">
      <ns0:question_text>To ensure LDAP is configured to use TLS for all transactions, run the following command:
$ grep start_tls /etc/pam_ldap.conf
The result should contain:
ssl start_tls
      Is it the case that LDAP is not in use, the line is commented out, or not configured correctly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ldap_client_tls_cacertpath_question:question:1">
      <ns0:question_text>To ensure TLS is configured with trust certificates, run the following command:
$ grep cert /etc/nslcd.conf
      Is it the case that LDAP is not in use, the line is commented out, or not configured correctly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysconfig_networking_bootproto_ifcfg_question:question:1">
      <ns0:question_text>To verify that DHCP is not being used, examine the following file for each interface:
# /etc/sysconfig/network-scripts/ifcfg-interface
Look for the following:
BOOTPROTO=none
and the following, substituting the appropriate values based on your site's addressing scheme:
NETMASK=255.255.255.0
IPADDR=192.168.1.2
GATEWAY=192.168.1.1
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_dhcp_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the dhcp package is installed:
$ rpm -q dhcp
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_dhcpd_disabled_question:question:1">
      <ns0:question_text> To check that the dhcpd service is disabled in system boot configuration, run the following command: $ sudo chkconfig dhcpd --list Output should indicate the dhcpd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig dhcpd --list dhcpd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify dhcpd is disabled through current runtime configuration: $ sudo service dhcpd status
If the service is disabled the command will return the following output: dhcpd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_smb_disabled_question:question:1">
      <ns0:question_text> To check that the smb service is disabled in system boot configuration, run the following command: $ sudo chkconfig smb --list Output should indicate the smb service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig smb --list smb       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify smb is disabled through current runtime configuration: $ sudo service smb status
If the service is disabled the command will return the following output: smb is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_samba_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the samba package is installed:
$ rpm -q samba
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_samba-common_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the samba-common package is installed: $ rpm -q samba-common
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-mount_option_smb_client_signing_question:question:1">
      <ns0:question_text>To verify that Samba clients using mount.cifs must use packet signing, run the following command:
$ grep sec /etc/fstab
The output should show either krb5i or ntlmv2i in use.
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-require_smb_client_signing_question:question:1">
      <ns0:question_text>To verify that Samba clients running smbclient must use packet signing, run the following command:
$ grep signing /etc/samba/smb.conf
The output should show:
client signing = mandatory
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_usbguard_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the usbguard package is installed: $ rpm -q usbguard
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_httpd_disabled_question:question:1">
      <ns0:question_text> To check that the httpd service is disabled in system boot configuration, run the following command: $ sudo chkconfig httpd --list Output should indicate the httpd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig httpd --list httpd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify httpd is disabled through current runtime configuration: $ sudo service httpd status
If the service is disabled the command will return the following output: httpd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_httpd_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the httpd package is installed:
$ rpm -q httpd
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-dir_perms_etc_httpd_conf_question:question:1">
      <ns0:question_text>To check the permissions of /etc/http/conf, run the command: $ ls -l /etc/http/conf If properly configured, the output should indicate the following permissions: -rwxr-x---
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_httpd_server_conf_files_question:question:1">
      <ns0:question_text>To check the permissions of /etc/http/conf/*, run the command: $ ls -l /etc/http/conf/* If properly configured, the output should indicate the following permissions: -rw-r-----
      Is it the case that /etc/http/conf/* has unix mode -rw-r-----?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-dir_perms_var_log_httpd_question:question:1">
      <ns0:question_text>Run the following command to check the mode of the httpd log
directory:
$ ls -l /var/log/ | grep httpd
Log directory must be mode 0700 or less permissive.
      Is it the case that it is more permissive?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-httpd_configure_firewall_question:question:1">
      <ns0:question_text>Review the web site to determine if HTTP and HTTPs are used in accordance with
well known ports (e.g., 80 and 443) or those ports and services as registered
and approved for use by the DoD PPSM.

To configure firewalld to allow access, run the following command(s):


firewall-cmd --permanent --add-service=http


To configure firewalld to allow access, run the following command(s):


firewall-cmd --permanent --add-service=https
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sssd_memcache_timeout_question:question:1">
      <ns0:question_text>To verify that SSSD's in-memory cache expires after a day, run the following command:
$ sudo grep memcache_timeout /etc/sssd/sssd.conf
If configured properly, output should be memcache_timeout = .
      Is it the case that it does not exist or is not configured properly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_sssd-ipa_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the sssd-ipa package is installed: $ rpm -q sssd-ipa
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
      <ns0:question_text>To verify that SSSD expires offline credentials, run the following command:
$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf
If configured properly, output should be
offline_credentials_expiration = 1
      Is it the case that it does not exist or is not configured properly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_sssd_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the sssd package is installed: $ rpm -q sssd
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
      <ns0:question_text>To verify that SSSD expires known SSH host keys, run the following command:
$ sudo grep ssh_known_hosts_timeout /etc/sssd/sssd.conf
If configured properly, output should be
ssh_known_hosts_timeout = 
      Is it the case that it does not exist or is not configured properly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_sssd_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the sssd service: $ sudo service sssd status If the service is enabled, it should return the following: sssd is running...
      Is it the case that the service is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_timesyncd_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the systemd_timesyncd service: $ sudo service systemd_timesyncd status If the service is enabled, it should return the following: systemd_timesyncd is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_ntpd_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the ntpd service: $ sudo service ntpd status If the service is enabled, it should return the following: ntpd is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ntpd_specify_remote_server_question:question:1">
      <ns0:question_text>To verify that a remote NTP service is configured for time synchronization,
open the following file:
/etc/ntp.conf
In the file, there should be a section similar to the following:
server ntpserver
      Is it the case that this is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_ntp_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the ntp service: $ sudo service ntp status If the service is enabled, it should return the following: ntp is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt package is installed:
$ rpm -q abrt
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_cgred_disabled_question:question:1">
      <ns0:question_text> To check that the cgred service is disabled in system boot configuration, run the following command: $ sudo chkconfig cgred --list Output should indicate the cgred service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig cgred --list cgred       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify cgred is disabled through current runtime configuration: $ sudo service cgred status
If the service is disabled the command will return the following output: cgred is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_messagebus_disabled_question:question:1">
      <ns0:question_text> To check that the messagebus service is disabled in system boot configuration, run the following command: $ sudo chkconfig messagebus --list Output should indicate the messagebus service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig messagebus --list messagebus       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify messagebus is disabled through current runtime configuration: $ sudo service messagebus status
If the service is disabled the command will return the following output: messagebus is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_acpid_disabled_question:question:1">
      <ns0:question_text> To check that the acpid service is disabled in system boot configuration, run the following command: $ sudo chkconfig acpid --list Output should indicate the acpid service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig acpid --list acpid       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify acpid is disabled through current runtime configuration: $ sudo service acpid status
If the service is disabled the command will return the following output: acpid is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rdisc_disabled_question:question:1">
      <ns0:question_text> To check that the rdisc service is disabled in system boot configuration, run the following command: $ sudo chkconfig rdisc --list Output should indicate the rdisc service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig rdisc --list rdisc       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify rdisc is disabled through current runtime configuration: $ sudo service rdisc status
If the service is disabled the command will return the following output: rdisc is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_cpuspeed_disabled_question:question:1">
      <ns0:question_text> To check that the cpuspeed service is disabled in system boot configuration, run the following command: $ sudo chkconfig cpuspeed --list Output should indicate the cpuspeed service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig cpuspeed --list cpuspeed       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify cpuspeed is disabled through current runtime configuration: $ sudo service cpuspeed status
If the service is disabled the command will return the following output: cpuspeed is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_netconsole_disabled_question:question:1">
      <ns0:question_text> To check that the netconsole service is disabled in system boot configuration, run the following command: $ sudo chkconfig netconsole --list Output should indicate the netconsole service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig netconsole --list netconsole       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify netconsole is disabled through current runtime configuration: $ sudo service netconsole status
If the service is disabled the command will return the following output: netconsole is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_certmonger_disabled_question:question:1">
      <ns0:question_text> To check that the certmonger service is disabled in system boot configuration, run the following command: $ sudo chkconfig certmonger --list Output should indicate the certmonger service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig certmonger --list certmonger       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify certmonger is disabled through current runtime configuration: $ sudo service certmonger status
If the service is disabled the command will return the following output: certmonger is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_quota_nld_disabled_question:question:1">
      <ns0:question_text> To check that the quota_nld service is disabled in system boot configuration, run the following command: $ sudo chkconfig quota_nld --list Output should indicate the quota_nld service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig quota_nld --list quota_nld       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify quota_nld is disabled through current runtime configuration: $ sudo service quota_nld status
If the service is disabled the command will return the following output: quota_nld is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_psacct_enabled_question:question:1">
      <ns0:question_text> To check that the psacct service is disabled in system boot configuration, run the following command: $ sudo chkconfig psacct --list Output should indicate the psacct service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig psacct --list psacct       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify psacct is disabled through current runtime configuration: $ sudo service psacct status
If the service is disabled the command will return the following output: psacct is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rhnsd_disabled_question:question:1">
      <ns0:question_text> To check that the rhnsd service is disabled in system boot configuration, run the following command: $ sudo chkconfig rhnsd --list Output should indicate the rhnsd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig rhnsd --list rhnsd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify rhnsd is disabled through current runtime configuration: $ sudo service rhnsd status
If the service is disabled the command will return the following output: rhnsd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_psacct_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the psacct package is installed: $ rpm -q psacct
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_mdmonitor_disabled_question:question:1">
      <ns0:question_text> To check that the mdmonitor service is disabled in system boot configuration, run the following command: $ sudo chkconfig mdmonitor --list Output should indicate the mdmonitor service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig mdmonitor --list mdmonitor       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify mdmonitor is disabled through current runtime configuration: $ sudo service mdmonitor status
If the service is disabled the command will return the following output: mdmonitor is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_irqbalance_enabled_question:question:1">
      <ns0:question_text> To check that the irqbalance service is disabled in system boot configuration, run the following command: $ sudo chkconfig irqbalance --list Output should indicate the irqbalance service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig irqbalance --list irqbalance       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify irqbalance is disabled through current runtime configuration: $ sudo service irqbalance status
If the service is disabled the command will return the following output: irqbalance is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_oddjobd_disabled_question:question:1">
      <ns0:question_text> To check that the oddjobd service is disabled in system boot configuration, run the following command: $ sudo chkconfig oddjobd --list Output should indicate the oddjobd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig oddjobd --list oddjobd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify oddjobd is disabled through current runtime configuration: $ sudo service oddjobd status
If the service is disabled the command will return the following output: oddjobd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_haldaemon_disabled_question:question:1">
      <ns0:question_text> To check that the haldaemon service is disabled in system boot configuration, run the following command: $ sudo chkconfig haldaemon --list Output should indicate the haldaemon service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig haldaemon --list haldaemon       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify haldaemon is disabled through current runtime configuration: $ sudo service haldaemon status
If the service is disabled the command will return the following output: haldaemon is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_smartd_disabled_question:question:1">
      <ns0:question_text> To check that the smartd service is disabled in system boot configuration, run the following command: $ sudo chkconfig smartd --list Output should indicate the smartd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig smartd --list smartd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify smartd is disabled through current runtime configuration: $ sudo service smartd status
If the service is disabled the command will return the following output: smartd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_qpidd_disabled_question:question:1">
      <ns0:question_text> To check that the qpidd service is disabled in system boot configuration, run the following command: $ sudo chkconfig qpidd --list Output should indicate the qpidd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig qpidd --list qpidd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify qpidd is disabled through current runtime configuration: $ sudo service qpidd status
If the service is disabled the command will return the following output: qpidd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_abrtd_disabled_question:question:1">
      <ns0:question_text> To check that the abrtd service is disabled in system boot configuration, run the following command: $ sudo chkconfig abrtd --list Output should indicate the abrtd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig abrtd --list abrtd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify abrtd is disabled through current runtime configuration: $ sudo service abrtd status
If the service is disabled the command will return the following output: abrtd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_saslauthd_disabled_question:question:1">
      <ns0:question_text> To check that the saslauthd service is disabled in system boot configuration, run the following command: $ sudo chkconfig saslauthd --list Output should indicate the saslauthd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig saslauthd --list saslauthd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify saslauthd is disabled through current runtime configuration: $ sudo service saslauthd status
If the service is disabled the command will return the following output: saslauthd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_cgconfig_disabled_question:question:1">
      <ns0:question_text> To check that the cgconfig service is disabled in system boot configuration, run the following command: $ sudo chkconfig cgconfig --list Output should indicate the cgconfig service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig cgconfig --list cgconfig       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify cgconfig is disabled through current runtime configuration: $ sudo service cgconfig status
If the service is disabled the command will return the following output: cgconfig is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_ntpdate_disabled_question:question:1">
      <ns0:question_text> To check that the ntpdate service is disabled in system boot configuration, run the following command: $ sudo chkconfig ntpdate --list Output should indicate the ntpdate service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig ntpdate --list ntpdate       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify ntpdate is disabled through current runtime configuration: $ sudo service ntpdate status
If the service is disabled the command will return the following output: ntpdate is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_kdump_disabled_question:question:1">
      <ns0:question_text> To check that the kdump service is disabled in system boot configuration, run the following command: $ sudo chkconfig kdump --list Output should indicate the kdump service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig kdump --list kdump       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify kdump is disabled through current runtime configuration: $ sudo service kdump status
If the service is disabled the command will return the following output: kdump is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rhsmcertd_disabled_question:question:1">
      <ns0:question_text> To check that the rhsmcertd service is disabled in system boot configuration, run the following command: $ sudo chkconfig rhsmcertd --list Output should indicate the rhsmcertd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig rhsmcertd --list rhsmcertd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify rhsmcertd is disabled through current runtime configuration: $ sudo service rhsmcertd status
If the service is disabled the command will return the following output: rhsmcertd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_portreserve_disabled_question:question:1">
      <ns0:question_text> To check that the portreserve service is disabled in system boot configuration, run the following command: $ sudo chkconfig portreserve --list Output should indicate the portreserve service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig portreserve --list portreserve       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify portreserve is disabled through current runtime configuration: $ sudo service portreserve status
If the service is disabled the command will return the following output: portreserve is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_sysstat_disabled_question:question:1">
      <ns0:question_text> To check that the sysstat service is disabled in system boot configuration, run the following command: $ sudo chkconfig sysstat --list Output should indicate the sysstat service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig sysstat --list sysstat       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify sysstat is disabled through current runtime configuration: $ sudo service sysstat status
If the service is disabled the command will return the following output: sysstat is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_enable_strictmodes_question:question:1">
      <ns0:question_text>To check if StrictModes is enabled or set correctly, run the
following command:
$ sudo grep StrictModes /etc/ssh/sshd_config
If configured properly, output should be yes
      Is it the case that it is commented out or is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's IgnoreUserKnownHosts option is set, run the following command:
$ sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's PermitEmptyPasswords option is set, run the following command:
$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_set_keepalive_question:question:1">
      <ns0:question_text>To ensure the SSH idle timeout will occur when the ClientAliveInterval is set, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, output should be:
ClientAliveCountMax 
      Is it the case that it is commented out or not configured properly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
      <ns0:question_text>To check which SSH protocol version is allowed, check version of
openssh-server with following command:
$ rpm -qi openssh-server | grep Version
Versions equal to or higher than 7.4 have deprecated the RhostsRSAAuthentication option.
If version is lower than 7.4, run the following command to check configuration:
To determine how the SSH daemon's RhostsRSAAuthentication option is set, run the following command:
$ sudo grep -i RhostsRSAAuthentication /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_enable_warning_banner_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's Banner option is set, run the following command:
$ sudo grep -i Banner /etc/ssh/sshd_config

If a line indicating /etc/issue is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_rekey_limit_question:question:1">
      <ns0:question_text>To check if RekeyLimit is set correctly, run the
following command:
$ sudo grep RekeyLimit /etc/ssh/sshd_config
If configured properly, output should be
RekeyLimit 512M 1h
      Is it the case that it is commented out or is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_use_approved_macs_question:question:1">
      <ns0:question_text>Only FIPS-approved MACs should be used. To verify that only FIPS-approved
MACs are in use, run the following command:
$ sudo grep -i macs /etc/ssh/sshd_config
The output should contain only those MACs which are FIPS-approved. Any use of other
ciphers or algorithms will result in the module entering the non-FIPS mode of
operation.
      Is it the case that MACs option is commented out or not using FIPS-approved hash algorithms?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
      <ns0:question_text>To ensure users are not able to send environment variables, run the following command:
$ sudo grep PermitUserEnvironment /etc/ssh/sshd_config
If properly configured, output should be:
PermitUserEnvironment no
      Is it the case that PermitUserEnvironment is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
      <ns0:question_text>To check if KerberosAuthentication is disabled or set correctly, run the
following command:
$ sudo grep KerberosAuthentication /etc/ssh/sshd_config
If configured properly, output should be no
      Is it the case that it is commented out or is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
      <ns0:question_text>To check which SSH protocol version is allowed, check version of openssh-server with following command:

$ rpm -qi openssh-server | grep Version

Versions equal to or higher than 7.4 only allow Protocol 2.
If version is lower than 7.4, run the following command to check configuration:
$ sudo grep Protocol /etc/ssh/sshd_config
If configured properly, output should be Protocol 2
      Is it the case that it is commented out or is not set correctly to Protocol 2?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_rhosts_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's IgnoreRhosts option is set, run the following command:
$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_set_idle_timeout_question:question:1">
      <ns0:question_text>Run the following command to see what the timeout interval is:
$ sudo grep ClientAliveInterval /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveInterval 
      Is it the case that it is commented out or not configured properly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_set_loglevel_info_question:question:1">
      <ns0:question_text>To check if LogLevel is enabled or set correctly, run the
following command:
$ sudo grep "^LogLevel" /etc/ssh/sshd_config
If configured properly, output should be LogLevel INFO
      Is it the case that it is commented out or is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:
$ sudo grep -i X11Forwarding /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_use_approved_ciphers_question:question:1">
      <ns0:question_text>Only FIPS ciphers should be used. To verify that only FIPS-approved
ciphers are in use, run the following command:
$ sudo grep Ciphers /etc/ssh/sshd_config
The output should contain only those ciphers which are FIPS-approved.
      Is it the case that FIPS ciphers are not configured or the enabled ciphers are not FIPS-approved?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-disable_host_auth_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's HostbasedAuthentication option is set, run the following command:
$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
      <ns0:question_text>To ensure the MaxAuthTries parameter is set, run the following command:
$ sudo grep MaxAuthTries /etc/ssh/sshd_config
If properly configured, output should be:
MaxAuthTries tries
      Is it the case that it is commented out or not configured properly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
      <ns0:question_text>To check if LogLevel is enabled or set correctly, run the
following command:
$ sudo grep "^LogLevel" /etc/ssh/sshd_config
If configured properly, output should be LogLevel VERBOSE
      Is it the case that it is commented out or is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_use_strong_macs_question:question:1">
      <ns0:question_text>Only strong MACs should be used. To verify that only strong
MACs are in use, run the following command:
$ sudo grep -i macs /etc/ssh/sshd_config
The output should contain only those MACs which are strong, namely,
hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 hash functions.
      Is it the case that MACs option is commented out or not using strong hash algorithms?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_use_priv_separation_question:question:1">
      <ns0:question_text>To check if UsePrivilegeSeparation is enabled or set correctly, run the
following command:
$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config
If configured properly, output should be .
      Is it the case that it is commented out or is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_print_last_log_question:question:1">
      <ns0:question_text>To check if PrintLastLog is enabled or set correctly, run the
following command:
$ sudo grep PrintLastLog /etc/ssh/sshd_config
If configured properly, output should be yes
      Is it the case that it is commented out or is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_use_strong_ciphers_question:question:1">
      <ns0:question_text>Only strong ciphers should be used. To verify that only strong
ciphers are in use, run the following command:
$ sudo grep Ciphers /etc/ssh/sshd_config
The output should contain only those ciphers which are considered strong, namely,
chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
      Is it the case that ciphers are not configured or not using strong ciphers?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
      <ns0:question_text>To check if GSSAPIAuthentication is disabled or set correctly, run the following
command:
$ sudo grep GSSAPIAuthentication /etc/ssh/sshd_config
If configured properly, output should be no
      Is it the case that it is commented out or is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_compression_question:question:1">
      <ns0:question_text>To check if compression is enabled or set correctly, run the
following command:
$ sudo grep Compression /etc/ssh/sshd_config
If configured properly, output should be no or delayed.
      Is it the case that it is commented out, or is not set to no or delayed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sshd_disable_root_login_question:question:1">
      <ns0:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:
$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
      <ns0:question_text>To check the permissions of /etc/ssh/*_key, run the command: $ ls -l /etc/ssh/*_key If properly configured, the output should indicate the following permissions: -rw-r-----
      Is it the case that /etc/ssh/*_key has unix mode -rw-r-----?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
      <ns0:question_text>To check the permissions of /etc/ssh/*.pub, run the command: $ ls -l /etc/ssh/*.pub If properly configured, the output should indicate the following permissions: -rw-r--r--
      Is it the case that /etc/ssh/*.pub has unix mode -rw-r--r--?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
      <ns0:question_text>Find the list of alias maps used by the Postfix mail server:
$ sudo postconf alias_maps
Query the Postfix alias maps for an alias for the root user:
$ sudo postmap -q root hash:/etc/aliases
The output should return an alias.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-postfix_network_listening_disabled_question:question:1">
      <ns0:question_text>Run the following command to ensure postfix accepts mail messages from only the local system:
$ grep inet_interfaces /etc/postfix/main.cf
If properly configured, the output should show only localhost.
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_sendmail_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the sendmail package is installed:
$ rpm -q sendmail
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_postfix_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the postfix service: $ sudo service postfix status If the service is enabled, it should return the following: postfix is running...
      Is it the case that the system is not a cross domain solution and the service is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_dovecot_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the dovecot package is installed:
$ rpm -q dovecot
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_dovecot_disabled_question:question:1">
      <ns0:question_text> To check that the dovecot service is disabled in system boot configuration, run the following command: $ sudo chkconfig dovecot --list Output should indicate the dovecot service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig dovecot --list dovecot       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify dovecot is disabled through current runtime configuration: $ sudo service dovecot status
If the service is disabled the command will return the following output: dovecot is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_all_squash_exports_question:question:1">
      <ns0:question_text>To verify all squashing has been disabled, run the following command:
$ grep all_squash /etc/exports
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_insecure_locks_exports_question:question:1">
      <ns0:question_text>To verify insecure file locking has been disabled, run the following command:
$ grep insecure_locks /etc/exports
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-mount_option_nosuid_remote_filesystems_question:question:1">
      <ns0:question_text>To verify the nosuid option is configured for all NFS mounts, run
the following command:
$ mount | grep nfs
All NFS mounts should show the nosuid setting in parentheses. This
is not applicable if NFS is not implemented.
      Is it the case that the setting does not show?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-mount_option_nodev_remote_filesystems_question:question:1">
      <ns0:question_text>To verify the nodev option is configured for all NFS mounts, run
the following command:
$ mount | grep nfs
All NFS mounts should show the nodev setting in parentheses. This
is not applicable if NFS is not implemented.
      Is it the case that the setting does not show?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-nfs_no_anonymous_question:question:1">
      <ns0:question_text>Inspect the mounts configured in /etc/exports. Each mount should specify a value
greater than UID_MAX and GID_MAX as defined in /etc/login.defs.
      Is it the case that anonuid or anongid are not set to a value greater than UID_MAX (for anonuid) and GID_MAX (for anongid)?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_nfs_disabled_question:question:1">
      <ns0:question_text> To check that the nfs service is disabled in system boot configuration, run the following command: $ sudo chkconfig nfs --list Output should indicate the nfs service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig nfs --list nfs       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify nfs is disabled through current runtime configuration: $ sudo service nfs status
If the service is disabled the command will return the following output: nfs is stopped
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
      <ns0:question_text> To check that the rpcsvcgssd service is disabled in system boot configuration, run the following command: $ sudo chkconfig rpcsvcgssd --list Output should indicate the rpcsvcgssd service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig rpcsvcgssd --list rpcsvcgssd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify rpcsvcgssd is disabled through current runtime configuration: $ sudo service rpcsvcgssd status
If the service is disabled the command will return the following output: rpcsvcgssd is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_nfs-utils_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the nfs-utils package is installed:
$ rpm -q nfs-utils
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cups_disable_browsing_question:question:1">
      <ns0:question_text>To verify that CUPS printer browsing is disabled, run the following command:
$ sudo grep "Browsing\|BrowseAllow" /etc/cups/cupsd.conf
The output should return the following:
Browsing Off
BrowseAllow none
      Is it the case that printer browsing is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_cups_disabled_question:question:1">
      <ns0:question_text> To check that the cups service is disabled in system boot configuration, run the following command: $ sudo chkconfig cups --list Output should indicate the cups service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig cups --list cups       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify cups is disabled through current runtime configuration: $ sudo service cups status
If the service is disabled the command will return the following output: cups is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_avahi-daemon_disabled_question:question:1">
      <ns0:question_text> To check that the avahi-daemon service is disabled in system boot configuration, run the following command: $ sudo chkconfig avahi-daemon --list Output should indicate the avahi-daemon service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig avahi-daemon --list avahi-daemon       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify avahi-daemon is disabled through current runtime configuration: $ sudo service avahi-daemon status
If the service is disabled the command will return the following output: avahi-daemon is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_squid_disabled_question:question:1">
      <ns0:question_text> To check that the squid service is disabled in system boot configuration, run the following command: $ sudo chkconfig squid --list Output should indicate the squid service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig squid --list squid       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify squid is disabled through current runtime configuration: $ sudo service squid status
If the service is disabled the command will return the following output: squid is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_squid_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the squid package is installed:
$ rpm -q squid
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-partition_for_srv_question:question:1">
      <ns0:question_text>Run the following command to determine if /srv
is on its own partition or logical volume:
$ mount | grep "on /srv"
If /srv has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-partition_for_home_question:question:1">
      <ns0:question_text>Run the following command to determine if /home
is on its own partition or logical volume:
$ mount | grep "on /home"
If /home has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-encrypt_partitions_question:question:1">
      <ns0:question_text>Check the system partitions to determine if they are encrypted with the following command:
blkid

Output will be similar to:
/dev/sda1: UUID=" ab12c3de-4f56-789a-8f33-3850cc8ce3a2
" TYPE="crypto_LUKS"
/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2
" TYPE="crypto_LUKS"

Pseudo-file systems, such as /proc, /sys, and tmpfs, are not required to use disk encryption and are not a finding.
      Is it the case that partitions do not have a type of crypto_LUKS?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-partition_for_var_question:question:1">
      <ns0:question_text>Run the following command to determine if /var
is on its own partition or logical volume:
$ mount | grep "on /var"
If /var has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-partition_for_tmp_question:question:1">
      <ns0:question_text>Run the following command to determine if /tmp
is on its own partition or logical volume:
$ mount | grep "on /tmp"
If /tmp has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-partition_for_var_log_audit_question:question:1">
      <ns0:question_text>Run the following command to determine if /var/log/audit
is on its own partition or logical volume:
$ mount | grep "on /var/log/audit"
If /var/log/audit has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-partition_for_var_log_question:question:1">
      <ns0:question_text>Run the following command to determine if /var/log
is on its own partition or logical volume:
$ mount | grep "on /var/log"
If /var/log has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sudo_require_authentication_question:question:1">
      <ns0:question_text>To determine if NOPASSWD or !authenticate have been configured for
sudo, run the following command:
$ sudo grep -ri "nopasswd\|\!authenticate" /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd and/or !authenticate is enabled in sudo?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
      <ns0:question_text>To determine if NOPASSWD has been configured for the vdsm user for sudo,
run the following command:
$ sudo grep -ri nopasswd /etc/sudoers.d/
The command should return output only for the vdsm user.
      Is it the case that nopasswd is set for any users beyond vdsm?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
      <ns0:question_text>To determine if !authenticate has not been configured for sudo, run the following command:
$ sudo grep -r \!authenticate /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that !authenticate is enabled in sudo?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sudo_remove_nopasswd_question:question:1">
      <ns0:question_text>To determine if NOPASSWD has been configured for sudo, run the following command:
$ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd is enabled in sudo?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_sudo_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the sudo package is installed: $ rpm -q sudo
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_binutils_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the binutils package is installed: $ rpm -q binutils
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-plugin-sosreport_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-plugin-sosreport package is installed:
$ rpm -q abrt-plugin-sosreport
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-plugin-rhtsupport package is installed:
$ rpm -q abrt-plugin-rhtsupport
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_libcap-ng-utils_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the libcap-ng-utils package is installed: $ rpm -q libcap-ng-utils
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_krb5-workstation_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the krb5-workstation package is installed:
$ rpm -q krb5-workstation
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_geolite2-country_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the geolite2-country package is installed:
$ rpm -q geolite2-country
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_vim_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the vim package is installed: $ rpm -q vim
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-addon-kerneloops_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-addon-kerneloops package is installed:
$ rpm -q abrt-addon-kerneloops
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_iprutils_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the iprutils package is installed:
$ rpm -q iprutils
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-plugin-logger_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-plugin-logger package is installed:
$ rpm -q abrt-plugin-logger
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_geolite2-city_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the geolite2-city package is installed:
$ rpm -q geolite2-city
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_scap-security-guide_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the scap-security-guide package is installed: $ rpm -q scap-security-guide
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_tar_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the tar package is installed: $ rpm -q tar
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_rng-tools_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the rng-tools package is installed: $ rpm -q rng-tools
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_python-rhsm_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the python-rhsm package is installed: $ rpm -q python-rhsm
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_gssproxy_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the gssproxy package is installed:
$ rpm -q gssproxy
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-addon-ccpp_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-addon-ccpp package is installed:
$ rpm -q abrt-addon-ccpp
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-cli_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-cli package is installed:
$ rpm -q abrt-cli
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_tuned_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the tuned package is installed:
$ rpm -q tuned
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_openscap-scanner_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the openscap-scanner package is installed: $ rpm -q openscap-scanner
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_abrt-addon-python_removed_question:question:1">
      <ns0:question_text>Run the following command to determine if the abrt-addon-python package is installed:
$ rpm -q abrt-addon-python
      Is it the case that the package is installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the cryptsetup-luks package is installed: $ rpm -q cryptsetup-luks
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
      <ns0:question_text>To verify that the installed operating system is supported, run
the following command:

$ grep -i "red hat" /etc/redhat-release

The output should contain something similar to:
Red Hat Enterprise Linux 6
      Is it the case that the installed operating system is not supported?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-installed_OS_is_FIPS_certified_question:question:1">
      <ns0:question_text>To verify that the installed operating system is supported or certified, run
the following command:

$ grep -i "red hat" /etc/redhat-release

The output should contain something similar to:
Red Hat Enterprise Linux 6
      Is it the case that the installed operating system is not FIPS 140-2 certified?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-grub_legacy_enable_fips_mode_question:question:1">
      <ns0:question_text>To verify that FIPS is enabled properly in grub, run the following command:
$ grep fips /etc/grub.conf
The output should contain fips=1
      Is it the case that FIPS is not configured or enabled in grub?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_dracut-fips-aesni_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the dracut-fips-aesni package is installed: $ rpm -q dracut-fips-aesni
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_dracut-fips_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the dracut-fips package is installed: $ rpm -q dracut-fips
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
      <ns0:question_text>To verify if the OpenSSH Client uses defined Crypto Policy, run:
$ cat /etc/ssh/ssh_config.d/02-ospp.conf
and verify that the line matches
Match final all
RekeyLimit 512M 1h
GSSAPIAuthentication no
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
MACs hmac-sha2-512,hmac-sha2-256
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1
      Is it the case that Crypto Policy for OpenSSH Client is not configured according to CC requirements?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-harden_sshd_crypto_policy_question:question:1">
      <ns0:question_text>To verify if the OpenSSH server uses defined Crypto Policy, run:
$ grep 'CRYPTO_POLICY' /etc/crypto-policies/back-ends/opensshserver.config | tail -n 1
and verify that the line matches
CRYPTO_POLICY", value="'-oCiphers=aes128-ctr,aes256-ctr,aes128-cbc,aes256-cbc -oMACs=hmac-sha2-256,hmac-sha2-512 -oGSSAPIKeyExchange=no -oKexAlgorithms=diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 -oHostKeyAlgorithms=rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384'
      Is it the case that Crypto Policy for OpenSSH Server is not configured according to CC requirements?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-install_antivirus_question:question:1">
      <ns0:question_text>Verify an anti-virus solution is installed on the system. The anti-virus solution may be
bundled with an approved host-based security solution.
      Is it the case that there is no anti-virus solution installed on the system?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-configure_user_data_backups_question:question:1">
      <ns0:question_text>Verify that the system backups user data.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-install_hids_question:question:1">
      <ns0:question_text>Inspect the system to determine if intrusion detection software has been installed.
Verify this intrusion detection software is active.
      Is it the case that no host-based intrusion detection tools are installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rpm_verify_permissions_question:question:1">
      <ns0:question_text>The following command will list which files on the system have permissions different from what
is expected by the RPM database:
$ rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rpm_verify_ownership_question:question:1">
      <ns0:question_text>The following command will list which files on the system have ownership different from what
is expected by the RPM database:
$ rpm -Va | rpm -Va --nofiledigest | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rpm_verify_hashes_question:question:1">
      <ns0:question_text>The following command will list which files on the system
have file hashes different from what is expected by the RPM database.
$ rpm -Va | awk '$1 ~ /..5/ &amp;&amp; $2 != "c"'
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_aide_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the aide package is installed: $ rpm -q aide
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-aide_periodic_cron_checking_question:question:1">
      <ns0:question_text>To determine that periodic AIDE execution has been scheduled, run the following command:
$ grep aide /etc/crontab
The output should return some similiar to the following:
05 4 * * * root /usr/sbin/aide --check

NOTE: The usage of special cron times, such as @daily or @weekly, is acceptable.
      Is it the case that there is no output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-aide_build_database_question:question:1">
      <ns0:question_text>To find the location of the AIDE databse file, run the following command:
$ sudo ls -l DBDIR/database_file_name
      Is it the case that there is no database file?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
      <ns0:question_text>To determine whether yum is configured to use gpgcheck,
inspect /etc/yum.conf and ensure the following appears in the
[main] section:
gpgcheck=1
A value of 1 indicates that gpgcheck is enabled. Absence of a
gpgcheck line or a setting of 0 indicates that it is
disabled.
      Is it the case that GPG checking is not enabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ensure_redhat_gpgkey_installed_question:question:1">
      <ns0:question_text>To ensure that the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return the string below:
gpg(Red Hat, Inc. (release key 2)  &lt;security@redhat.com&gt;
      Is it the case that the Red Hat GPG Key is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
      <ns0:question_text>To determine whether yum has been configured to disable
gpgcheck for any repos,  inspect all files in
/etc/yum.repos.d and ensure the following does not appear in any
sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo.
      Is it the case that GPG checking is disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screensaver_mode_blank_question:question:1">
      <ns0:question_text>To ensure the screensaver is configured to be blank, run the following command:
$ gconftool-2 -g /apps/gnome-screensaver/mode
If properly configured, the output should be blank-only
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screensaver_lock_enabled_question:question:1">
      <ns0:question_text>To check the status of the idle screen lock activation, run the following command:
$ gconftool-2 -g /apps/gnome-screensaver/lock_enabled
If properly configured, the output should be true.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screensaver_idle_activation_enabled_question:question:1">
      <ns0:question_text>To check the screensaver mandatory use status, run the following command:
$ gconftool-2 -g /apps/gnome-screensaver/idle_activation_enabled
If properly configured, the output should be true.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screen_locking_keybindings_question:question:1">
      <ns0:question_text>To check the screensaver locking keybindings, run the following command:
$ gconftool-2 -g /apps/gnome_settings_daemon/keybindings/screensaver
If properly configured, the output should be &lt;Control&gt;&lt;Alt&gt;l.
      Is it the case that GNOME screensaver locking keybindings are configured and cannot be changed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screensaver_max_idle_time_question:question:1">
      <ns0:question_text>To check the current idle time-out value, run the following command:
$ gconftool-2 -g /desktop/gnome/session/max_idle_time
If properly configured, the output should be .
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screensaver_max_idle_action_question:question:1">
      <ns0:question_text>To check the current idle time-out value, run the following command:
$ gconftool-2 -g /desktop/gnome/session/max_idle_action
If properly configured, the output should be forced-logout.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_screensaver_idle_delay_question:question:1">
      <ns0:question_text>To check the current idle time-out value, run the following command:
$ gconftool-2 -g /desktop/gnome/session/idle_delay
If properly configured, the output should be .
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_automount_question:question:1">
      <ns0:question_text>These settings can be verified by running the following:
$ gconftool-2 -g /apps/nautilus/preferences/media_automount
The output should return false.
$ gconftool-2 -g /apps/nautilus/preferences/media_autorun_never
The output should return true.
      Is it the case that GNOME automounting is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_thumbnailers_question:question:1">
      <ns0:question_text>These settings can be verified by running the following:
$ gconftool-2 -g /desktop/gnome/thumbnailers/disable_all
The output should return true.
      Is it the case that GNOME thumbnailers are not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
      <ns0:question_text>To ensure the system is configured to ignore the Ctrl-Alt-Del sequence,
run the following command:
$ gconftool-2 -g /apps/gnome_settings_daemon/keybindings/power
The output should return nothing.
      Is it the case that GNOME is configured to reboot when Ctrl-Alt-Del is pressed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_clock_weather_question:question:1">
      <ns0:question_text>To check the status of the idle screen lock activation, run the following command:
$ gconftool-2 -g /apps/panel/applets/clock/prefs/show_weather
If properly configured, the output should be false.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_clock_temperature_question:question:1">
      <ns0:question_text>To check the status of the idle screen lock activation, run the following command:
$ gconftool-2 -g /apps/panel/applets/clock/prefs/show_temperature
If properly configured, the output should be false.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
      <ns0:question_text>To verify that timed logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\ntimedlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
TimedLoginEnable=false
      Is it the case that GDM allows a guest to login without credentials?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_restart_shutdown_question:question:1">
      <ns0:question_text>To ensure disable and restart on the login screen are disabled, run the following command:
$ gconftool-2 -g /apps/gdm/simple-greeter/disable_restart_buttons
The output should be true.
      Is it the case that disable-restart-buttons has not been configured or is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
      <ns0:question_text>To verify that automatic logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\nautomaticlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
AutomaticLoginEnable=false
      Is it the case that GDM allows users to automatically login?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gdm_disable_user_list_question:question:1">
      <ns0:question_text>To ensure the user list is disabled, run the following command:
$ gconftool-2 -g /apps/gdm/simple-greeter/disable_user_list
The output should be true.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_wifi_create_question:question:1">
      <ns0:question_text>To ensure that WIFI connections cannot be created, run the following command:
$ gconftool-2 -g /apps/nm-applet/disable-wifi-create
The output should return true.
      Is it the case that WIFI connections can be created through GNOME?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_wifi_notification_question:question:1">
      <ns0:question_text>To ensure that wireless network notification is disabled, run the following command:
$ gconftool-2 -g /apps/nm-applet/disable-connected-notifications
The output should return true.
      Is it the case that wireless connecting network notification is enabled and not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gnome_disable_wifi_disconnect_question:question:1">
      <ns0:question_text>To ensure that wireless network notification is disabled, run the following command:
$ gconftool-2 -g /apps/nm-applet/disable-disconnected-notifications
The output should return true.
      Is it the case that wireless disconnecting network notification is enabled and not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rsyslog_remote_loghost_question:question:1">
      <ns0:question_text>To ensure logs are sent to a remote host, examine the file
/etc/rsyslog.conf.
If using UDP, a line similar to the following should be present:
 *.* @loghost.example.com
If using TCP, a line similar to the following should be present:
 *.* @@loghost.example.com
If using RELP, a line similar to the following should be present:
 *.* :omrelp:loghost.example.com
      Is it the case that none of these are present?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-ensure_logrotate_activated_question:question:1">
      <ns0:question_text>To determine the status and frequency of logrotate, run the following command:
$ sudo grep logrotate /var/log/cron*
If logrotate is configured properly, output should include references to
/etc/cron.daily.
      Is it the case that logrotate is not configured to run daily?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rsyslog_files_groupownership_question:question:1">
      <ns0:question_text>The group-owner of all log files written by rsyslog should be .
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the group-owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the group-owner is not correct?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rsyslog_files_ownership_question:question:1">
      <ns0:question_text>The owner of all log files written by rsyslog should be .
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the owner is not correct?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-rsyslog_files_permissions_question:question:1">
      <ns0:question_text>The file permissions for all log files written by rsyslog should
be set to 600, or more restrictive. These log files are determined by the
second part of each Rule line in /etc/rsyslog.conf and typically
all appear in /var/log. To see the permissions of a given log
file, run the following command:
$ ls -l LOGFILE
The permissions should be 600, or more restrictive.
      Is it the case that the permissions are not correct?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_syslogng_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the syslog-ng-core package is installed: $ rpm -q syslog-ng-core
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_syslogng_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the syslog-ng service: $ sudo service syslog-ng status If the service is enabled, it should return the following: syslog-ng is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the rsyslog-gnutls package is installed: $ rpm -q rsyslog-gnutls
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_rsyslog_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the rsyslog service: $ sudo service rsyslog status If the service is enabled, it should return the following: rsyslog is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_rsyslog_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the rsyslog package is installed: $ rpm -q rsyslog
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_libreswan_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the libreswan package is installed: $ rpm -q libreswan
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_ip6tables_enabled_question:question:1">
      <ns0:question_text>If IPv6 is disabled, this is not applicable.


Run the following command to determine the current status of the
ip6tables service:
$ sudo service ip6tables status
If the service is enabled, it should return the following: ip6tables is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_iptables_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the iptables service: $ sudo service iptables status If the service is enabled, it should return the following: iptables is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-set_ip6tables_default_rule_question:question:1">
      <ns0:question_text>If IPv6 is disabled, this is not applicable.

Inspect the file /etc/sysconfig/ip6tables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/ip6tables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
      <ns0:question_text>Run the following command to ensure the default FORWARD policy is DROP:
grep ":FORWARD" /etc/sysconfig/iptables
The output should be similar to the following:
$ sudo grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0
      Is it the case that the default policy for the FORWARD chain is not set to DROP?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-set_iptables_default_rule_question:question:1">
      <ns0:question_text>Inspect the file /etc/sysconfig/iptables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/iptables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_iptables_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the iptables package is installed: $ rpm -q iptables
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.default.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_source_route
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.all.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_source_route
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.all.forwarding kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.forwarding
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.all.forwarding /etc/sysctl.conf /etc/sysctl.d
The ability to forward packets is only appropriate for routers.
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.all.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.all.accept_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.default.accept_ra kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.default.accept_ra /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.all.accept_ra kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.all.accept_ra /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv6.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv6.conf.default.accept_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
      <ns0:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to disable the
ipv6 kernel module, it will contain a line
of the form:
options ipv6 disable=1
Such lines may be inside any file in /etc/modprobe.d or the
deprecated/etc/modprobe.conf.  This permits insertion of the IPv6
kernel module (which other parts of the system expect to be present), but
otherwise keeps it inactive.  Run the following command to search for such
lines in all files in /etc/modprobe.d and the deprecated
/etc/modprobe.conf:
preserve$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d
      Is it the case that the ipv6 kernel module is not disabled?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.default.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_source_route
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
      <ns0:question_text>The status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_ignore_bogus_error_responses
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.default.accept_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.default.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.rp_filter
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.all.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.secure_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.all.secure_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.default.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.secure_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.default.secure_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.all.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.all.accept_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.all.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.log_martians
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.all.log_martians /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.all.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.rp_filter
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
      <ns0:question_text>The status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_echo_ignore_broadcasts
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
      <ns0:question_text>The status of the net.ipv4.tcp_syncookies kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.tcp_syncookies
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.all.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_source_route
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
      <ns0:question_text>The status of the net.ipv4.ip_forward kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_forward
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d
The ability to forward packets is only appropriate for routers.
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.all.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.send_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.all.send_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
      <ns0:question_text>The status of the net.ipv4.conf.default.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.send_redirects
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r net.ipv4.conf.default.send_redirects /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the dccp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_atm_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the atm kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r atm /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the tipc kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r tipc /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_sctp_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the sctp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r sctp /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_rds_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the rds kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r rds /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_can_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the can kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r can /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the bluetooth kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_bluetooth_disabled_question:question:1">
      <ns0:question_text> To check that the bluetooth service is disabled in system boot configuration, run the following command: $ sudo chkconfig bluetooth --list Output should indicate the bluetooth service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig bluetooth --list bluetooth       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify bluetooth is disabled through current runtime configuration: $ sudo service bluetooth status
If the service is disabled the command will return the following output: bluetooth is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-wireless_disable_interfaces_question:question:1">
      <ns0:question_text>Verify that there are no wireless interfaces configured on the system
with the following command:
$ sudo nmcli device
The output should contain the following:
wifi disconnected
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-network_sniffer_disabled_question:question:1">
      <ns0:question_text>Promiscuous mode of an interface can be disabled with the following command:
$ sudo ip link set dev device_name promisc off
      Is it the case that any network device is in promiscuous mode?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-grub_legacy_enable_selinux_question:question:1">
      <ns0:question_text>Inspect /etc/grub.conf for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.
      Is it the case that SELinux is disabled at boot time?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-selinux_policytype_question:question:1">
      <ns0:question_text>Check the file /etc/selinux/config and ensure the following line appears:
SELINUXTYPE=
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_policycoreutils_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the policycoreutils package is installed: $ rpm -q policycoreutils
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
      <ns0:question_text>To check for unlabeled device files, run the following command:
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system.
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-selinux_state_question:question:1">
      <ns0:question_text>Check the file /etc/selinux/config and ensure the following line appears:
SELINUX=
      Is it the case that SELINUX is not set to enforcing?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-grub_legacy_password_question:question:1">
      <ns0:question_text>To verify the boot loader password has been set and encrypted, run the following command:
$ sudo grep password /etc/grub.conf
The output should show the following:
password --encrypted password-hash
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_owner_grub_conf_question:question:1">
      <ns0:question_text>To check the ownership of /etc/grub.conf, run the command: $ ls -lL /etc/grub.conf If properly configured, the output should indicate the following owner: root
      Is it the case that /etc/grub.conf has owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_groupowner_grub_conf_question:question:1">
      <ns0:question_text>To check the group ownership of /etc/grub.conf, run the command: $ ls -lL /etc/grub.conf If properly configured, the output should indicate the following group-owner: root
      Is it the case that /etc/grub.conf has group owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_grub_conf_question:question:1">
      <ns0:question_text>To check the permissions of /etc/grub.conf, run the command:
$ sudo ls -lL /etc/grub.conf
If properly configured, the output should indicate the following
permissions:
-rw-------
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-restrict_serial_port_logins_question:question:1">
      <ns0:question_text>To check for serial port entries which permit root login,
run the following command:
$ sudo grep ^ttyS/[0-9] /etc/securetty
If any output is returned, then root login over serial ports is permitted.
      Is it the case that root login over serial ports is permitted?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-root_path_default_question:question:1">
      <ns0:question_text>To view the root user's PATH, run the following command:
$ sudo env | grep PATH
If correctly configured, the PATH must: use vendor default settings,
have no empty entries, and have no entries beginning with a character
other than a slash (/).
      Is it the case that any of these conditions are not met?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_direct_root_logins_question:question:1">
      <ns0:question_text>To ensure root may not directly login to the system over physical consoles,
run the following command:
cat /etc/securetty
If any output is returned, this is a finding.
      Is it the case that the /etc/securetty file is not empty?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_root_webbrowsing_question:question:1">
      <ns0:question_text>Check the root home directory for a .mozilla directory. If
one exists, ensure browsing is limited to local service administration.
      Is it the case that this is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
      <ns0:question_text>To obtain a listing of all users and the contents of their shadow password
field, run the command:
$ sudo awk -F: '$1 !~ /^root$/ &amp;&amp; $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow
Identify the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration, UID_MIN is set to 500.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-securetty_root_login_console_only_question:question:1">
      <ns0:question_text>To check for virtual console entries which permit root login, run the
following command:
$ sudo grep ^vc/[0-9] /etc/securetty
If any output is returned, then root logins over virtual console devices is permitted.
      Is it the case that root login over virtual console devices is permitted?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
      <ns0:question_text>To obtain a listing of all users, their UIDs, and their shells, run the
command: $ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd Identify
the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration UID_MIN is set to 1000.
      Is it the case that any system account (other than root) has a login shell?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
      <ns0:question_text>To list all password file entries for accounts with UID 0, run the
following command:
$ awk -F: '($3 == \"0\") {print}' /etc/passwd
This should print only one line, for the user root.

If there is a finding, change the UID of the failing (non-root) user. If
the account is associated with the system commands or applications the UID
should be changed to one greater than 0 but less than
1000. Otherwise assign a UID of greater than 1000 that
has not already been assigned.
      Is it the case that any account other than root has a UID of 0?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
      <ns0:question_text>Verify that the system is integrated with a centralized authentication mechanism
such as as Active Directory, Kerberos, Directory Server, etc. that has
automated account mechanisms in place.
      Is it the case that the system is not using a centralized authentication mechanism, or it is not automated?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-account_unique_name_question:question:1">
      <ns0:question_text>Run the following command to check for duplicate account names:
$ sudo pwck -qr
If there are no duplicate names, no line will be returned.
      Is it the case that a line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
      <ns0:question_text>To verify the INACTIVE setting, run the following command:
$ grep "INACTIVE" /etc/default/useradd
The output should indicate the INACTIVE configuration option is set
to an appropriate integer as shown in the example below:
$ grep "INACTIVE" /etc/default/useradd
INACTIVE=
      Is it the case that the value of INACTIVE is greater than the expected value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-account_temp_expire_date_question:question:1">
      <ns0:question_text>For every temporary and emergency account, run the following command
to obtain its account aging and expiration information:
$ sudo chage -l USER
Verify each of these accounts has an expiration date set as documented.
      Is it the case that any temporary or emergency accounts have no expiration date set or do not expire within a documented time frame?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
      <ns0:question_text>To check the minimum password length, run the command:
$ grep PASS_MIN_LEN /etc/login.defs
The DoD requirement is 15.
      Is it the case that it is not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
      <ns0:question_text>To check the minimum password age, run the command:
$ grep PASS_MIN_DAYS /etc/login.defs
      Is it the case that it is not equal to or greater than the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
      <ns0:question_text>To check the maximum password age, run the command:
$ grep PASS_MAX_DAYS /etc/login.defs
The DoD and FISMA requirement is 60.
A value of 180 days is sufficient for many environments.
      Is it the case that PASS_MAX_DAYS is not set equal to or greater than the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
      <ns0:question_text>To check the password warning age, run the command:
$ grep PASS_WARN_AGE /etc/login.defs
The DoD requirement is 7.
      Is it the case that it is not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_netrc_files_question:question:1">
      <ns0:question_text>To check the system for the existence of any .netrc files,
run the following command:
$ sudo find /home -xdev -name .netrc
      Is it the case that any .netrc files exist?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_password_all_shadowed_question:question:1">
      <ns0:question_text>To check that no password hashes are stored in
/etc/passwd, run the following command:
awk '!/\S:x|\*/ {print}' /etc/passwd
If it produces any output, then a password hash is
stored in /etc/passwd.
      Is it the case that any stored hashes are found in /etc/passwd?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_empty_passwords_question:question:1">
      <ns0:question_text>To verify that null passwords cannot be used, run the following command:
$ grep nullok /etc/pam.d/system-auth
If this produces any output, it may be possible to log into accounts
with empty passwords. Remove any instances of the nullok option to
prevent logins with empty passwords.
      Is it the case that NULL passwords can be used?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gid_passwd_group_same_question:question:1">
      <ns0:question_text>To ensure all GIDs referenced in /etc/passwd are defined in /etc/group,
run the following command:
$ sudo pwck -qr
There should be no output.
      Is it the case that GIFs referenced in /etc/passwd are returned as not defined in /etc/group?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
      <ns0:question_text>Inspect /etc/login.defs and ensure the following line appears:
ENCRYPT_METHOD SHA512
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
      <ns0:question_text>Inspect the password section of /etc/pam.d/system-auth and
ensure that the pam_unix.so module includes the argument
sha512:
$ grep sha512 /etc/pam.d/system-auth
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
      <ns0:question_text>Inspect /etc/libuser.conf and ensure the following line appears
in the [default] section:
crypt_style = sha512
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
      <ns0:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth
The output should show unlock_time=&lt;some-large-number&gt; or never.
      Is it the case that unlock_time is less than the expected value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
      <ns0:question_text>To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=
      Is it the case that the value of remember is not set equal to or greater than the expected setting?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
      <ns0:question_text>To ensure the failed password attempt policy is configured correctly,
run the following command:
$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
For each file, the output should show fail_interval=&lt;interval-in-seconds&gt; where interval-in-seconds is  or greater.
If the fail_interval parameter is not set, the default setting
of 900 seconds is acceptable.
      Is it the case that fail_interval is less than the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
      <ns0:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth
The output should show deny=.
      Is it the case that that is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_retry_question:question:1">
      <ns0:question_text>To check how many retry attempts are permitted on a per-session basis, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The retry parameter will indicate how many attempts are permitted.
The DoD required value is less than or equal to 3.
This would appear as retry=3, or a lower value.
      Is it the case that it is not the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_ocredit_question:question:1">
      <ns0:question_text>To check how many special characters are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The ocredit parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one special character in a password.
This would appear as ocredit=-1.
      Is it the case that ocredit is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_dcredit_question:question:1">
      <ns0:question_text>To check how many digits are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The dcredit parameter (as a negative number) will indicate how many digits are required.
The DoD requires at least one digit in a password.
This would appear as dcredit=-1.
      Is it the case that dcredit is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_maxrepeat_question:question:1">
      <ns0:question_text>To check the maximum value for consecutive repeating characters, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
Look for the value of the maxrepeat parameter. The DoD requirement is 3.
      Is it the case that maxrepeat is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_ucredit_question:question:1">
      <ns0:question_text>To check how many uppercase characters are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The ucredit parameter (as a negative number) will indicate how many uppercase characters are required.
The DoD and FISMA require at least one uppercase character in a password.
This would appear as ucredit=-1.
      Is it the case that ucredit is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_lcredit_question:question:1">
      <ns0:question_text>To check how many lowercase characters are required in a password, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The lcredit parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one lowercase character in a password.
This would appear as lcredit=-1.
      Is it the case that lcredit is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_minlen_question:question:1">
      <ns0:question_text>To check how many characters are required in a password, run the following command:
$ grep cracklib /etc/pam.d/system-auth
Your output should contain minlen=
      Is it the case that minlen is not found or not set to the required value (or higher)?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_minclass_question:question:1">
      <ns0:question_text>To check how many categories of characters must be used in password during a password change,
run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The minclass parameter will indicate how many character classes must be used. If
the requirement was for the password to contain characters from three different categories,
then this would appear as minclass=3.
      Is it the case that minclass is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-cracklib_accounts_password_pam_difok_question:question:1">
      <ns0:question_text>To check how many characters must differ during a password change, run the following command:
$ grep pam_cracklib /etc/pam.d/system-auth
The difok parameter will indicate how many characters must differ.
The DoD requires four characters differ during a password change.
This would appear as difok=4.
      Is it the case that difok is not found or not set to the required value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-display_login_attempts_question:question:1">
      <ns0:question_text>To ensure that last logon/access notification is configured correctly, run
the following command:
$ grep pam_lastlog.so /etc/pam.d/postlogin
The output should show output showfailed.
      Is it the case that that is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_screen_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the screen package is installed: $ rpm -q screen
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-smartcard_auth_question:question:1">
      <ns0:question_text>Interview the SA to determine if all accounts not exempted by policy are
using CAC authentication. For DoD systems, the following systems and
accounts are exempt from using smart card (CAC) authentication:
SIPRNET systemsStandalone systemsApplication accountsTemporary employee accounts, such as students or interns, who cannot
easily receive a CAC or PIVOperational tactical locations that are not collocated with RAPIDS
workstations to issue CAC or ALTTest systems, such as those with an Interim Approval to Test (IATT) and
use a separate VPN, firewall, or security measure preventing access to
network and system components from outside the protection boundary
documented in the IATT.
      Is it the case that non-exempt accounts are not using CAC authentication?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
      <ns0:question_text>
To ensure the system is configured to log a message instead of rebooting the
system when Ctrl-Alt-Del is pressed, ensure the following line is in
/etc/init/control-alt-delete.conf:
exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"
      Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-require_singleuser_auth_question:question:1">
      <ns0:question_text>To check if authentication is required for single-user mode, run the following command:

$ grep SINGLE /etc/sysconfig/init
The output should be the following:
SINGLE=/sbin/sulogin
      Is it the case that the output is different?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-grub_legacy_disable_interactive_boot_question:question:1">
      <ns0:question_text>To check whether interactive boot is disabled, run the following commands:
$ grep PROMPT /etc/sysconfig/init If interactive boot is
disabled, the output will show: PROMPT=no$ grep confirm /etc/grub.conf If interactive boot is disabled,
there should be no output.
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gdm_enable_warning_gui_banner_question:question:1">
      <ns0:question_text>To ensure a login warning banner is enabled, run the following:
$ gconftool-2 -g /apps/gdm/simple-greeter/banner_message_enable
Search for the banner_message_enable schema.
If properly configured, the default value should be true.
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-gconf_gdm_set_login_banner_text_question:question:1">
      <ns0:question_text>To ensure the login warning banner text is properly set, run the following:
$ gconftool-2 -g /apps/gdm/simple-greeter/banner_message_text
If properly configured, the proper banner text will appear within this schema.
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-banner_etc_issue_question:question:1">
      <ns0:question_text>To check if the system login banner is compliant,
run the following command:
$ cat /etc/issue
      Is it the case that it does not display the required banner?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
      <ns0:question_text>Verify the UMASK setting is configured correctly in the /etc/login.defs file by
running the following command:
# grep -i "UMASK" /etc/login.defs
All output must show the value of umask set as shown in the below:
# grep -i "UMASK" /etc/login.defs
umask 
      Is it the case that the above command returns no output, or if the umask is configured incorrectly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_umask_etc_bashrc_question:question:1">
      <ns0:question_text>Verify the umask setting is configured correctly in the /etc/bashrc file by
running the following command:
# grep "umask" /etc/bashrc
All output must show the value of umask set as shown below:
# grep "umask" /etc/bashrc
umask 
umask 
      Is it the case that the above command returns no output, or if the umask is configured incorrectly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_umask_etc_csh_cshrc_question:question:1">
      <ns0:question_text>Verify the umask setting is configured correctly in the /etc/csh.cshrc file by
running the following command:
# grep "umask" /etc/csh.cshrc
All output must show the value of umask set as shown in the below:
# grep "umask" /etc/csh.cshrc
umask 
      Is it the case that the above command returns no output, or if the umask is configured incorrectly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_umask_etc_profile_question:question:1">
      <ns0:question_text>Verify the umask setting is configured correctly in the /etc/profile file by
running the following command:
# grep "umask" /etc/profile
All output must show the value of umask set as shown in the below:
# grep "umask" /etc/profile
umask 
      Is it the case that the above command returns no output, or if the umask is configured incorrectly?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
      <ns0:question_text>To ensure write permissions are disabled for group and other
 for each element in root's path, run the following command:
# ls -ld DIR
      Is it the case that group or other write permissions exist?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_tmout_question:question:1">
      <ns0:question_text>Run the following command to ensure the TMOUT value is configured for all users
on the system:
$ sudo grep TMOUT /etc/profile
The output should return the following:
TMOUT=
      Is it the case that value of TMOUT is not less than or equal to expected setting?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_home_dirs_question:question:1">
      <ns0:question_text>To ensure the user home directory is not group-writable or world-readable, run the following:
# ls -ld /home/USER
      Is it the case that the user home directory is group-writable or world-readable?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_logon_fail_delay_question:question:1">
      <ns0:question_text>Verify the FAIL_DELAY setting is configured correctly in the /etc/login.defs file by
running the following command:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
All output must show the value of FAIL_DELAY set as shown in the below:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
fail_delay 
      Is it the case that the above command returns no output, or FAIL_DELAY is configured less than the expected value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
      <ns0:question_text>Run the following command to ensure the maxlogins value is
configured for all users on the system:
# grep "maxlogins" /etc/security/limits.conf
You should receive output similar to the following:
*\t\thard\tmaxlogins\t
      Is it the case that maxlogins is not equal to or less than the expected value?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_flush_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to synchronize audit event data
with the log files on the disk:
$ sudo grep flush /etc/audit/auditd.conf
flush = DATA
Acceptable values are DATA, and SYNC. The setting is
case-insensitive.
      Is it the case that auditd is not configured to synchronously write audit event data to disk?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
      <ns0:question_text>To verify the audispd's syslog plugin is active, run the following command:

$ sudo grep active /etc/audisp/plugins.d/syslog.conf

If the plugin is active, the output will show yes.
      Is it the case that it is not activated?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_disk_full_action_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either log to syslog,
switch to single-user mode, execute a script,
or halt when the disk is out of space:
disk_full_action single
      Is it the case that the system is not configured to switch to single-user mode for corrective action?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine how much data the system will retain in each audit log file:
$ sudo grep max_log_file /etc/audit/auditd.conf
max_log_file = 6
      Is it the case that the system audit data threshold has not been properly configured?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_space_left_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured correctly:
space_left SIZE_in_MB
      Is it the case that the system is not configured a specfic size in MB to notify administrators of an issue?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to send email to an
account when it needs to notify an administrator:
action_mail_acct = root
      Is it the case that auditd is not configured to send emails per identified actions?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either suspend, switch to single user mode,
or halt when disk space has run low:
admin_space_left_action single
      Is it the case that the system is not configured to switch to single user mode for corrective action?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to email the administrator when
disk space is starting to run low:
$ sudo grep space_left_action /etc/audit/auditd.conf
space_left_action
Acceptable values are email, suspend, single, and halt.
      Is it the case that the system is not configured to send an email to the system administrator when disk space is starting to run low?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_disk_error_action_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either log to syslog,
switch to single-user mode, execute a script,
or halt when the disk errors:
disk_error_action single
      Is it the case that the system is not configured to switch to single-user mode for corrective action?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine how many logs the system is configured to retain after rotation:
$ sudo grep num_logs /etc/audit/auditd.conf
num_logs = 5
      Is it the case that the system log file retention has not been properly configured?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
      <ns0:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to rotate logs when they reach their
maximum size:
$ sudo grep max_log_file_action /etc/audit/auditd.conf
max_log_file_action rotate
      Is it the case that the system has not been properly configured to rotate audit logs?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
preserve$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
preserve$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_time_stime_question:question:1">
      <ns0:question_text>If the system is not configured to audit time changes, this is a finding.
If the system is 64-bit only, this is not applicable
ocil: |
To determine if the system is configured to audit calls to the
stime system call, run the following command:
preserve$ sudo grep "stime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
settimeofday system call, run the following command:
preserve$ sudo grep "settimeofday" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit attempts to
alter time via the /etc/localtime file, run the following
command:
$ sudo auditctl -l | grep "watch=/etc/localtime"
If the system is configured to audit this activity, it will return a line.
      Is it the case that the system is not configured to audit time changes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
clock_settime system call, run the following command:
preserve$ sudo grep "clock_settime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
adjtimex system call, run the following command:
preserve$ sudo grep "adjtimex" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
preserve$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_renameat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lchown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the lchown system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
preserve$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_chmod_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the chmod system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the fsetxattr system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
preserve$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
truncate system call, run the following command:
preserve$ sudo grep "truncate" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the fremovexattr system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the lsetxattr system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_setxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the setxattr system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the fchmodat system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the lremovexattr system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
creat system call, run the following command:
preserve$ sudo grep "creat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
preserve$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_truncate_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the truncate system call, run the following command:
preserve$ sudo grep "truncate" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_removexattr_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the removexattr system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the fchown system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the ftruncate system call, run the following command:
preserve$ sudo grep "ftruncate" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_chown_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the chown system call, run the following command:
preserve$ sudo grep "chown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
ftruncate system call, run the following command:
preserve$ sudo grep "ftruncate" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the creat system call, run the following command:
preserve$ sudo grep "creat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_unlink_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchownat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the fchownat system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_rename_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
      <ns0:question_text>To verify that the audit system collects unauthorized file accesses, run the following commands:
$ sudo grep EACCES /etc/audit/audit.rules
$ sudo grep EPERM /etc/audit/audit.rules
      Is it the case that 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
preserve$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchmod_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit successful calls
to the fchmod system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
preserve$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgidmap_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep passwd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep unix_chkpwd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep gpasswd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newuidmap_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command for each local partition PART to find relevant
setuid / setgid programs:
$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null
Run the following command to verify entries in the audit rules for all programs
found with the previous command:
$ sudo grep path /etc/audit/audit.rules
It should be the case that all relevant setuid / setgid programs have a line
in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep userhelper /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newgrp /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep crontab /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep umount /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
      <ns0:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep mount /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/shadow)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
      <ns0:question_text>Run the following command to check the mode of the system audit logs:
$ sudo ls -ld /var/log/audit
Audit log directories must be mode 0700 or less permissive.
      Is it the case that any are more permissive?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-directory_access_var_log_audit_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit accesses to
/var/log/audit directory, run the following command:
preserve$ sudo grep "dir=/var/log/audit" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
      <ns0:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/etc/sudoers\|watch=/etc/sudoers.d\|-w /etc/sudoers\|-w /etc/sudoers.d"
      Is it the case that there is not output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit changes to its network configuration,
run the following command:
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'
If the system is configured to watch for network configuration changes, a line should be returned for
each file specified (and perm=wa should be indicated for each).
      Is it the case that the system is not configured to audit changes of the network configuration?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit account changes,
run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/gshadow)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_media_export_question:question:1">
      <ns0:question_text>To verify that auditing is configured for all media exportation events, run the following command:
$ sudo auditctl -l | grep syscall | grep mount
      Is it the case that there is not output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_var_log_audit_question:question:1">
      <ns0:question_text>Run the following command to check the mode of the system audit logs:
$ sudo ls -l /var/log/audit
Audit logs must be mode 0640 or less permissive.
      Is it the case that any are more permissive?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_ownership_var_log_audit_question:question:1">
      <ns0:question_text>
To properly set the owner of /var/log/audit, run the command:
$ sudo chown root /var/log/audit 

To properly set the owner of /var/log/audit/*, run the command:
$ sudo chown root /var/log/audit/* 
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/passwd)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_mac_modification_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
$ sudo auditctl -l | grep "dir=/etc/selinux"
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
perm=wa indicating permissions that are watched).
      Is it the case that the system is not configured to audit attempts to change the MAC policy?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
      <ns0:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/group)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_name_format_question:question:1">
      <ns0:question_text>To verify that Audit Daemon is configured to record the hostname
in audit events, run the following command:
$ sudo grep name_format /etc/audit/auditd.conf
The output should return the following:
name_format = hostname
      Is it the case that name_format isn't set to hostname?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-grub_legacy_audit_argument_question:question:1">
      <ns0:question_text>Inspect the kernel boot arguments (which follow the word kernel) in
/etc/grub.conf. If they include audit=1, then
auditing is enabled at boot time.
      Is it the case that auditing is not enabled at boot time?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_write_logs_question:question:1">
      <ns0:question_text>To verify that Audit Daemon is configured to write logs to the disk, run the
following command:
$ sudo grep write_logs /etc/audit/auditd.conf
The output should return the following:
write_logs = yes
      Is it the case that write_logs isn't set to yes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-package_audispd-plugins_installed_question:question:1">
      <ns0:question_text>Run the following command to determine if the audispd-plugins package is installed: $ rpm -q audispd-plugins
      Is it the case that the package is not installed?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_auditd_enabled_question:question:1">
      <ns0:question_text> Run the following command to determine the current status of the auditd service: $ sudo service auditd status If the service is enabled, it should return the following: auditd is running...
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_local_events_question:question:1">
      <ns0:question_text>To verify that Audit Daemon is configured to include local events, run the
following command:
$ sudo grep local_events /etc/audit/auditd.conf
The output should return the following:
local_events = yes
      Is it the case that local_events isn't set to yes?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_freq_question:question:1">
      <ns0:question_text>To verify that Audit Daemon is configured to flush to disk after
every 50 records, run the following command:
$ sudo grep freq /etc/audit/auditd.conf
The output should return the following:
freq = 50
      Is it the case that freq isn't set to 50?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-auditd_log_format_question:question:1">
      <ns0:question_text>To verify that Audit Daemon is configured to resolve all uid, gid, syscall,
architecture, and socket address information before writing the event to disk,
run the following command:
$ sudo grep log_format /etc/audit/auditd.conf
The output should return the following:
log_format = ENRICHED
      Is it the case that log_format isn't set to ENRICHED?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_etc_shadow_question:question:1">
      <ns0:question_text>To check the permissions of /etc/shadow, run the command:
$ ls -l /etc/shadow
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/shadow has unix mode ----------?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_owner_etc_shadow_question:question:1">
      <ns0:question_text>To check the ownership of /etc/shadow, run the command: $ ls -lL /etc/shadow If properly configured, the output should indicate the following owner: root
      Is it the case that /etc/shadow has owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_owner_etc_group_question:question:1">
      <ns0:question_text>To check the ownership of /etc/group, run the command: $ ls -lL /etc/group If properly configured, the output should indicate the following owner: root
      Is it the case that /etc/group has owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_etc_group_question:question:1">
      <ns0:question_text>To check the permissions of /etc/passwd, run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group has unix mode -rw-r--r--?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
      <ns0:question_text>To check the group ownership of /etc/gshadow, run the command: $ ls -lL /etc/gshadow If properly configured, the output should indicate the following group-owner: root
      Is it the case that /etc/gshadow has group owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_owner_etc_passwd_question:question:1">
      <ns0:question_text>To check the ownership of /etc/passwd, run the command: $ ls -lL /etc/passwd If properly configured, the output should indicate the following owner: root
      Is it the case that /etc/passwd has owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
      <ns0:question_text>To check the group ownership of /etc/shadow, run the command: $ ls -lL /etc/shadow If properly configured, the output should indicate the following group-owner: root
      Is it the case that /etc/shadow has group owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_owner_etc_gshadow_question:question:1">
      <ns0:question_text>To check the ownership of /etc/gshadow, run the command: $ ls -lL /etc/gshadow If properly configured, the output should indicate the following owner: root
      Is it the case that /etc/gshadow has owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_groupowner_etc_group_question:question:1">
      <ns0:question_text>To check the group ownership of /etc/group, run the command: $ ls -lL /etc/group If properly configured, the output should indicate the following group-owner: root
      Is it the case that /etc/group has group owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
      <ns0:question_text>To check the permissions of /etc/gshadow, run the command:
$ ls -l /etc/gshadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow has unix mode ----------?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
      <ns0:question_text>To check the group ownership of /etc/passwd, run the command: $ ls -lL /etc/passwd If properly configured, the output should indicate the following group-owner: root
      Is it the case that /etc/passwd has group owner root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_etc_passwd_question:question:1">
      <ns0:question_text>To check the permissions of /etc/passwd, run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd has unix mode -rw-r--r--?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_binary_dirs_question:question:1">
      <ns0:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
To find system executables that are group-writable or world-writable,
run the following command for each directory DIR which contains system executables:
$ sudo find -L DIR -perm /022 -type f
      Is it the case that any system executables are found to be group or world writable?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_ownership_library_dirs_question:question:1">
      <ns0:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64
For each of these directories, run the following command to find files not
owned by root:
$ sudo find -L $DIR ! -user root -exec chown root {} \;
      Is it the case that any of these files are not owned by root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_ownership_binary_dirs_question:question:1">
      <ns0:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
To find system executables that are not owned by root,
run the following command for each directory DIR which contains system executables:
$ sudo find DIR/ \! -user root
      Is it the case that any system executables are found to not be owned by root?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_library_dirs_question:question:1">
      <ns0:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable,
run the following command for each directory DIR which contains shared libraries:
$ sudo find -L DIR -perm /022 -type f
      Is it the case that any of these files are group-writable or world-writable?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
      <ns0:question_text>To find SGID files, run the following command:
$ sudo find / -xdev -type f -perm -2000
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
      <ns0:question_text>The status of the fs.protected_symlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_symlinks
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r fs.protected_symlinks /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
      <ns0:question_text>The following command will discover and print world-writable directories that
are not owned by a system account, given the assumption that only system
accounts have a uid lower than 500.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +499 -print
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_ungroupowned_question:question:1">
      <ns0:question_text>The following command will discover and print any
files on local partitions which do not belong to a valid group.
$ sudo find / -xdev -fstype local -nogroup

Either remove all files and directories from the system that do not have a valid group,
or assign a valid group with the chgrp command:
$ sudo chgrp group file
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-no_files_unowned_by_user_question:question:1">
      <ns0:question_text>The following command will discover and print any
files on local partitions which do not belong to a valid user.
$ sudo find / -xdev -fstype local -nouser

Either remove all files and directories from the system that do not have a
valid user, or assign a valid user to all unowned files and directories on
the system with the chown command:
$ sudo chown user file
      Is it the case that files exist that are not owned by a valid user?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
      <ns0:question_text>The status of the fs.protected_hardlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_hardlinks
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r fs.protected_hardlinks /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
      <ns0:question_text>To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002
      Is it the case that there is output?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
      <ns0:question_text>To find SUID files, run the following command:
$ sudo find / -xdev -type f -perm -4000
      Is it the case that only authorized files appear in the output of the find command?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-file_permissions_systemmap_question:question:1">
      <ns0:question_text>To check the permissions of /boot/Sysem.map-*, run the command:
$ ls -l /boot/Sysem.map-*
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
      <ns0:question_text>To find world-writable directories that lack the sticky bit, run the following command:
$ sudo find / -xdev -type d -perm 002 ! -perm 1000
      Is it the case that any world-writable directories are missing the sticky bit?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-umask_for_daemons_question:question:1">
      <ns0:question_text>To check the value of the umask, run the following command:
$ grep umask /etc/init.d/functions
The output should show .
      Is it the case that it does not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-coredump_disable_backtraces_question:question:1">
      <ns0:question_text>To verify that logging core dump backtraces is disabled, run the
following command:
$ grep ProcessSizeMax /etc/systemd/coredump.conf
The output should be:
ProcessSizeMax=0
      Is it the case that ProcessSizeMax is not set to zero?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
      <ns0:question_text>The status of the fs.suid_dumpable kernel parameter can be queried
by running the following command:
$ sysctl fs.suid_dumpable
The output of the command should indicate a value of 0.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r fs.suid_dumpable /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-coredump_disable_storage_question:question:1">
      <ns0:question_text>To verify that storing core dumps are disabled, run the following command:
$ grep Storage /etc/systemd/coredump.conf
The output should be:
Storage=none
      Is it the case that Storage is not set to none?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-disable_users_coredumps_question:question:1">
      <ns0:question_text>To verify that core dumps are disabled for all users, run the following command:
$ grep core /etc/security/limits.conf
The output should be:
*     hard   core    0
      Is it the case that it is not?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
      <ns0:question_text>The status of the kernel.kptr_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.kptr_restrict
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r kernel.kptr_restrict /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
      <ns0:question_text>To verify ExecShield is enabled on 64-bit Red Hat Enterprise Linux 7 systems,
run the following command:
$ dmesg | grep '[NX|DX]*protection'
The output should not contain 'disabled by kernel command line option'.
To verify that ExecShield has not been disabled in the kernel configuration,
run the following command:
$ sudo grep noexec /boot/grub2/grub.cfg
The output should not return noexec=off.
For 32-bit Red Hat Enterprise Linux 7 systems, run the following command:
$ sysctl kernel.exec-shield
The output should be:
To set the runtime status of the kernel.exec-shield kernel parameter,
run the following command:
$ sudo sysctl -w kernel.exec-shield=1

If this is not the system default value, add the following line to a file in the
directory /etc/sysctl.d:
kernel.exec-shield = 1
      Is it the case that ExecShield is not supported by the hardware, is not enabled, or has been disabled by the kernel configuration.?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
      <ns0:question_text>The status of the kernel.randomize_va_space kernel parameter can be queried
by running the following command:
$ sysctl kernel.randomize_va_space
The output of the command should indicate a value of 2.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
      <ns0:question_text>The status of the kernel.kexec_load_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.kexec_load_disabled
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r kernel.kexec_load_disabled /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
      <ns0:question_text>The status of the kernel.yama.ptrace_scope kernel parameter can be queried
by running the following command:
$ sysctl kernel.yama.ptrace_scope
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r kernel.yama.ptrace_scope /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
      <ns0:question_text>The status of the kernel.dmesg_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.dmesg_restrict
The output of the command should indicate a value of 1.
If this value is not the default value, investigate how it could have been
adjusted at runtime, and verify it is not set improperly. This has to be checked
in all files in the /etc/sysctl.d directory and the deprecated
/etc/sysctl.conf. You can verify this by running the following command:
$ grep -r kernel.dmesg_restrict /etc/sysctl.conf /etc/sysctl.d

      Is it the case that the correct value is not returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
      <ns0:question_text>
If the system is configured to prevent the loading of the usb-storage kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-service_autofs_disabled_question:question:1">
      <ns0:question_text> To check that the autofs service is disabled in system boot configuration, run the following command: $ sudo chkconfig autofs --list Output should indicate the autofs service has either not been installed, or has been disabled at all runlevels, as shown in the example below: $ sudo chkconfig autofs --list autofs       0:off   1:off   2:off   3:off   4:off   5:off   6:off
Run the following command to verify autofs is disabled through current runtime configuration: $ sudo service autofs status
If the service is disabled the command will return the following output: autofs is stopped
      Is it the case that ?
      </ns0:question_text>
    </ns0:boolean_question>
    <ns0:boolean_question id="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
      <ns0:question_text>To verify that binaries cannot be directly executed from removable media, run the following command:
$ grep -v noexec /etc/fstab
The resulting output will show partitions which do not have the noexec flag. Verify all partitions
in the output are not removable media.
      Is it the case that removable media partitions are present?
      </ns0:question_text>
    </ns0:boolean_question>
  </ns0:questions>
</ns0:ocil>