scap-security-guide March 2018

scap-security-guide@lists.fedorahosted.org

8 participants
5 discussions

Issue with Repo GPG Checking
by Trevor Vaughan 20 Oct '18

20 Oct '18

Hi All, I've been re-roaming through the SSG and this is probably the first of a many part thread regarding different checks. TL;DR; The potential risk caused by enabling 'repo_gpgcheck' outweighs any potential benefit if TLS is enabled. In my opinion, the following check should *only* be enabled if all of your repositories are internally managed xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata. The reason for this is that YUM presently does not (to my knowledge) have any way to differentiate between package signing GPG keys and repo signing GPG keys. This means that if, for instance, I host my packages via some shared Nexus, then I have to add the Nexus GPG key to my trust list for the repo. I fundamentally do *not* want to do this! I shouldn't be allowing my Nexus maintainer to potentially install software on my system without my explicit knowledge. You should use TLS, and the repo should have a trusted certificate there and that should be sufficient for the metadata until RPM can tell the difference between these two certificates. Please let me know if I've missed something, but I don't remember seeing options to split out the two sets of certs. Additionally, this is marked as 'high' severity and that seems to be massive overkill considering that 1) the packages are still signed and validated and 2) TLS is required. -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

7 20

Host tables on static.open-scap.org?
by Shawn Wells 20 Mar '18

20 Mar '18

Was looking through the table of contents of https://static.open-scap.org/ Is there a way we could also host the policy mapping tables?

1 0

Tweet by Dave Cohn on Twitter
by Shawn Wells 07 Mar '18

07 Mar '18

Holy crap! OpenSCAP is included in the list! Incredible how far the community has come. Dave Cohn (@daveyupst8s) 3/6/18, 2:28 PM 14 projects from @RedHatNews are recognized by the @CloudNativeFdn and the list keeps growing... #open #kubernetes #CloudNative pic.twitter.com/xbw5UDFI8E Download the Twitter app

1 0

Disabling specific bash remediations
by Fen Labalme 05 Mar '18

05 Mar '18

The goal is to create a hardened EC2 server on AWS from scratch. After provisioning a new RHEL/7 instance on AWS, we run `yum -y update` followed by the bash remediations from SSG using: command: 'oscap xccdf eval --profile {{ scapprofile }} --remediate \ --results-arf /tmp/results-arf.xml --report /tmp/report.html \ /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml' But there are some remediations I don't want to run for an EC2 server such as install_smartcard_packages.sh and dracut-fips. Is there a way to prevent certain remediations from running? Thanks, =Fen

5 4

SCAP Security Guide 0.1.38
by Watson Yuuma Sato 02 Mar '18

02 Mar '18

Hello folks, We have the pleasure to announce that SCAP Security Guide version 0.1.38 has been released. Highlights of this release: * New License - BSD-3 Clause * New Profiles for development introduced: * ANSSI * HIPAA * C2S-Docker * Adoption of CTest for schema validation * Several remediation fixes For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.38 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.38 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.38/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.38/s… (Zip archive using OVAL-5.10 language version only) Great thanks to everyone who contributed with issues, patches and discussion. Happy hardening! -- Watson Sato Security Technologies | Red Hat, Inc

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide March 2018