scap-security-guide July 2012

scap-security-guide@lists.fedorahosted.org

12 participants
83 discussions

[PATCH] removed non-applicable CCI references (which could be added in an automated way later, if wanted)
by Jeffrey Blank 11 Jul '12

11 Jul '12

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil> --- rhel6/src/input/auxiliary/srg_support.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml index d3fbec0..2379931 100644 --- a/rhel6/src/input/auxiliary/srg_support.xml +++ b/rhel6/src/input/auxiliary/srg_support.xml @@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design. The guidance does not meet this requirement. The requirement is impractical or out of scope. </description> -<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,1112,1111,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1687,1121,417,71,69,1444,1443,1688,152,145,1247,1245,1243,1242,1241,1240,1308,1306,1305,1196,1677,1188,1187,1673,1186,1672,1185,1671,1184,1183,1664,1663,1182,1181,1180,1179,1574,1178,1167,1463,1273,1272,1266,1262,1259,1249,1119,870,833,1340,1352,1401,1414,1555,1556,1150" /> +<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,1112,1111,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1340,1352,1401,1414,1555,1556,1150" /> </Group>  <Group id="unmet_impractical_product"> -- 1.7.1

2 1

[PATCH] minor modification to Makefile
by Jeffrey Blank 10 Jul '12

10 Jul '12

"make all" shouldn't cleanse subprojects Jeffrey Blank (1): update so that toplevel "Make all" leaves output files in subprojects * imperfectly, this also causes project building twice: once for the subproject, and again during RPM building. But this behavior feels more appropriate than a Make rule which leaves subprojects cleaned Makefile | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-)

2 2

[PATCH 0/4] Updated CCI Mappings
by Willy Santos 09 Jul '12

09 Jul '12

The following mappings are changes made based on input from the list. Willy Santos (4): Remapped CCI-001311 to servcie_rsyslog_enabled, based on input from the list. Remapped CCI-001395 to unmet_impractical_product based on input from list. Remapped CCI-000553 to unmet_impractical_product based on input from the list. Remapped CCI-001150 to unmet_impractical_guidance based on input from the list. rhel6/src/input/auxiliary/srg_support.xml | 6 +++--- rhel6/src/input/system/logging.xml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) -- 1.7.7.6

2 5

[PATCH 00/37] More CCI mappings
by Willy Santos 06 Jul '12

06 Jul '12

More CCI mapping in support of the OS SRG compliance. This batch of CCI mappings were done with the help Cliff Trueman. As usual, these are open for discussion and change as necessary. Willy Santos (37): Fixed missing mapping of CCI-001311. Remapped CCI-001328 to met_inherently, based on input from Shawn Wells. Remapped CCI-001340 to unmet_impractical_guidance, based on input from Shawn Wells. Remapped CCI-001252 to unmet_impractical_guidance, based on input from Shawn Wells. Remapped CCI-001356 to auditd_configure_rules, based on input from Shawn Wells. Mapped CCI-001200 to new_rule_needed. Mapped CCI-001391 to accounts-pam. Mapped CCI-001392 to accounts-pam. Mapped CCI-001395 to requirement_unclear. Mapped CCI-001399 to met-inherently. Mapped CCI-001400 to met-inherently. Mapped CCI-001401 to unmet_impractical_guidance. Mapped CCI-001414 to unmet_impractical_guidance. Mapped CCI-001424 to enabling_selinux. Mapped CCI-001425 to met-inherently. Mapped CCI-001426 to enabling_selinux. Mapped CCI-001427 to met-inherently. Mapped CCI-001428 to requirement_unclear. Mapped CCI-001499 to met-inherently. Mapped CCI-001500 to requirement_unclear. Mapped CCI-001555 to unmet_impractical_guidance. Mapped CCI-001555 to unmet_impractical_guidance. Mapped CCI-001693 to met-inherently. Mapped CCI-001662 to unmet_impractical_product. Mapped CCI-001665 to met_inherently. Mapped CCI-001668 to unmet_impractical_product. Mapped CCI-001670 to met_inherently. Mapped CCI-001674 to met_inherently. Mapped CCI-001683 to audit_account_changes. Mapped CCI-001685 to audit_account_changes. Mapped CCI-001686 to audit_account_changes. Mapped CCI-001496 to rpm_verify_hashes and aide_periodic_cron_checking. Mapped CCI-000187 to network_ssl. Mapped CCI-000374 to auditd_configure_rules. Mapped CCI-000553 to requirement_unclear. Mapped CCI-000802 to enabling_selinux. Mapped CCI-001150 to requirement_unclear. rhel6/src/input/auxiliary/srg_support.xml | 10 +++++----- rhel6/src/input/system/accounts/pam.xml | 1 + rhel6/src/input/system/auditing.xml | 4 ++-- rhel6/src/input/system/network/ssl.xml | 2 +- rhel6/src/input/system/selinux.xml | 2 +- rhel6/src/input/system/software/integrity.xml | 4 ++-- 6 files changed, 12 insertions(+), 11 deletions(-) -- 1.7.7.6

2 44

[PATCH 0/2] support for listing STIG Rules in tables
by Jeffrey Blank 06 Jul '12

06 Jul '12

Additional work remains to properly imitate the STIG format. However, this should make all proposed CCI mappings for the STIG profile clear. Jeffrey Blank (2): added new transform to reformat our XCCDF into STIG-like structure updated Makerules to activate transforms which do STIG formatting rhel6/src/Makefile | 8 +++--- rhel6/src/transforms/xccdf2stigformat.xslt | 35 ++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 4 deletions(-) create mode 100644 rhel6/src/transforms/xccdf2stigformat.xslt

2 5

[PATCH 00/33] More CCI Mappings
by Willy Santos 06 Jul '12

06 Jul '12

More CCI mapping in support of the OS SRG compliance. This batch of CCI mappings were done with the help Cliff Trueman. As usual, these are open for discussion and change as necessary. Willy Santos (33): Mapped CCI-001209 to met_inherently. Mapped CCI-001210 to unmet_impractical_guidance. Mapped CCI-001211 to unmet_impractical_guidance. Mapped CCI-001214 to met_inherently. Mapped CCI-001232 to security_patches_up_to_date. Mapped CCI-001233 to updating. Mapped CCI-001237 to met_inherently. Mapped CCI-001239 to requirement_unclear. Mapped CCI-001248 to met_inherently. Mapped CCI-001263 to aide_periodic_cron_checking. Mapped CCI-001265 to met_inherently. Mapped CCI-001265 to met_inherently. Mapped CCI-001291 to requirement_unclear. Mapped CCI-001294 to requirement_unclear. Mapped CCI-001295 to requirement_unclear. Mapped CCI-001310 to requirement_unclear. Mapped CCI-001311 to requirement_unclear. Mapped CCI-001312 to service_syslog_enabled and enable_auditd_service. Mapped CCI-001314 to met_inherently. Mapped CCI-001328 to requirement_unclear. Mapped CCI-001340 to requirement_unclear. Mapped CCI-001341 to unmet_impractical_guidance. Mapped CCI-001274 to audit_configure_rules. Mapped CCI-001350 to new_rule_needed. Mapped CCI-001352 to unmet_impractical_product. Mapped CCI-001356 to requirement_unclear. Mapped CCI-001362 to met_inherently. Mapped CCI-001368 to met_inherently. Mapped CCI-001372 to unmet_impractical_guidance. Mapped CCI-00137 to unmet_impractical_guidance. Mapped CCI-001374 to unmet_impractical_guidance. Mapped CCI-001376 to unmet_impractical_guidance. Mapped CCI-001377 to unmet_impractical_guidance. rhel6/src/input/auxiliary/srg_support.xml | 10 +++++----- rhel6/src/input/system/auditing.xml | 4 ++-- rhel6/src/input/system/logging.xml | 2 +- rhel6/src/input/system/software/integrity.xml | 2 +- rhel6/src/input/system/software/updating.xml | 3 ++- 5 files changed, 11 insertions(+), 10 deletions(-) -- 1.7.7.6

4 44

[PATCH 01/11] Mapped all SRG-OS-NA to unmet_impractical_guidance
by Shawn Wells 06 Jul '12

06 Jul '12

3 2

[PATCH 00/12] CCI Remaps based on list input.
by Willy Santos 06 Jul '12

06 Jul '12

Remapping of CCIs initially on requirement_unclear, based on input from list. (Thanks Shawn!) Willy Santos (12): Remapped CCI-001159 from requirement_unclear to new_rule_needed, based on input from Shawn Wells. Remapped CCI-001125 from requirement_unclear to new_rule_needed, based on input from Shawn Wells. Remapped CCI-001126 from requirement_unclear to unmet_impractical_product, based on input from Shawn Wells. Remapped CCI-001140 from requirement_unclear to new_rule_needed, based on guidance from Shawn Wells. Remapped CCI-001143 from requirement_unclear to new_rule_needed, based on guidance from Shawn Wells. Remapped CCI-001126 from unmet_impractical_product to unmet_impractical_guidance, it was incorrectly mapped initially. Remapped CCI-001149 from requirement_unclear to unmet_impractical_guidance, based on guidance from Shawn Wells. Remapped CCI-001157 from requirement_unclear to unmet_impractical_guidance, based on guidance from Shawn Wells. Remapped CCI-001166 from requirement_unclear to aide_periodic_cron_checking, based on guidance from Shawn Wells. Remapped CCI-001695 from requirement_unclear to unmet_impractical_product, based on guidance from Shawn Wells. Remapped CCI-001169 from requirement_unclear to unmet_impractical_product, based on guidance from Shawn Wells. Remapped CCI-001170 from requirement_unclear to unmet_impractical_product, based on guidance from Shawn Wells. rhel6/src/input/auxiliary/srg_support.xml | 8 ++++---- rhel6/src/input/system/software/integrity.xml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) -- 1.7.7.6

2 13

[PATCH 11/11] Fixed typo on line 153
by Shawn Wells 05 Jul '12

05 Jul '12

2 1

[PATCH 10/11] Mapped sshd_disable_root_login to CCI-000770
by Shawn Wells 05 Jul '12

05 Jul '12

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2012