scap-security-guide June 2017

scap-security-guide@lists.fedorahosted.org

20 participants
13 discussions

Any new OpenSCAP / SSG presentations?
by Shawn Wells 08 Jun '17

08 Jun '17

Realize the 'Conference Presentations' page on the OpenSCAP/SSG wiki has gotten a bit stale. Anyone present on OpenSCAP or SSG things lately? Would love to see community presentations get added to the wiki! Feel free to edit the wiki directly (just add a change note), or reply on-list with your presentation date/title/link and I'll add it for you :)

2 1

Audit Offloading in the EL7 STIG
by Trevor Vaughan 07 Jun '17

07 Jun '17

So, I was digging through and found the following: RHEL-07-030300 The operating system must off-load audit records onto a different system or media from the system being audited. and RHEL-07-030310 The operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited. This poses a real problem since there are pretty much limitless methods to meet this requirement and, given that actual proof is multi-node, this is going to be *really* difficult to evaluate properly. As much as I like auditd, I don't care for the thought of the network blocking all of my operations, so I've opted to pass it along to syslog. My syslog is then TLS encrypted to the various shipping points. This obviously meets the requirement, and I can automatically test that configuration in my code but I feel like this is yet another place where we're going to have difficulty with the SSG. I also noticed that this one hasn't been implemented in the SSG and I'm guessing that this is why. What are the plans for things like this moving forward? Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

6 12

Thoughts on RHEL-07-020600-690?
by Sean 06 Jun '17

06 Jun '17

Hi SCAP folks... I am curious what anyone working on the RHEL 7 STIG Alignment or remediation thinks about these controls relating to "interactive user" home directories. Is this something you see fit to implement through a remediation script? It's one thing to setup a new system that complies with these rules before new users start using it, but running a script to correct this kind of stuff on an existing system seems like inviting a lot of trouble. Also, clearly there is nothing new in these controls specific to RHEL7, should we expect to see these controls pushed into the RHEL6 STIG too? Thanks for your thoughts! --Sean

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2017