scap-security-guide May 2017

scap-security-guide@lists.fedorahosted.org

2 participants
3 discussions

VMs, containers vs. bare-metal machines in SSG
by Martin Preisler 15 Aug '17

15 Aug '17

We have had increasing requests to scan containers and VM storage images for compliance. In those use-cases a lot of our rules don't make sense. For example separate partition for /tmp isn't really applicable to containers. I thought about how we can deal with this in SSG. We have several options: 1) Separate benchmark and datastreams for containers and VM storage images: ssg-rhel7-ds.xml and ssg-rhel7-container-ds.xml 2) Separate profile for containers and VM storage images: pci-dss and pci-dss-container 3) Use applicability and CPE platforms to distinguish between what is being scanned. That allows us to use the same pci-dss profile for bare-metal, VM, VM storage image and container image. Right now I am leaning towards 3) because it "unlocks" the feature transparently to our users. There is nothing extra they have to study to start scanning containers. The downside is that we will have to add "fake" CPE IDs for platforms like "vm-storage" and "container". Rules that apply to everything will have no <platform> element in them. Rules that apply to just containers will have something like: <platform idref="cpe:/a:*:container-image"/> or <platform idref="cpe:/a:*:vm-storage"/> Official NIST CPE ID dictionary has these related CPE IDs cpe:/a:redhat:docker:1.5.0-27 cpe:/a:linuxcontainers:lxc:0.5.0 cpe:/a:redhat:libvirt:1.2.7 Not sure we want to go with any of those though. I would like to keep it container and VM tech agnostic. Before I start hacking this I would like to hear your thoughts. -- Martin Preisler Identity Management and Platform Security | Red Hat, Inc.

7 12

Fwd: Fedora 'gitscap-security-guide' sponsor needed for xxxx
by Shawn Wells 10 May '17

10 May '17

Turns out we never removed the SSG FedoraHosted repo after the migration to GitHub. Before I blow it away, is there any reason to keep it lingering? Wanted to double check here before making a irreversible repo deletion. IIRC, at one point it was mentioned to mirror code there, but I do not believe that was ever setup (or why it would be a good idea). -------- Forwarded Message -------- Subject: Fedora 'gitscap-security-guide' sponsor needed for xxxxx Date: Wed, 10 May 2017 07:04:22 +0000 From: accounts(a)fedoraproject.org To: gitscap-security-guide-sponsors(a)fedoraproject.org Fedora user xxxx <xxxx> has requested membership for xxxx in the gitscap-security-guide group and needs a sponsor. Please go to https://admin.fedoraproject.org/accounts/group/view/gitscap-security-guide to take action.

1 0

SCAP Security Guide 0.1.33
by Watson Yuuma Sato 03 May '17

03 May '17

Hello folks, We have the pleasure to announce that SCAP Security Guide version 0.1.33 has been released. Highlights of this release: * DISA RHEL7 STIG profile alignment improved * Introduction of remediation roles * RPM and DEB test packages are built by CMake with CPack * Lots of remediation fixes For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.33 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.33 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.33/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.33/s… (Zip archive using OVAL-5.10 language version only) Thank you to everyone who contributed with issues, patches and discussion. Happy hardening! -- Watson Sato Security Technologies | Red Hat, Inc

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2017