scap-security-guide January 2021

scap-security-guide@lists.fedorahosted.org

11 participants
8 discussions

New CaC/content Developer Documentation page on ReadTheDocs.org
by Gabriel Gaspar Becker 19 Jan '21

19 Jan '21

Hello all, I'm glad to announce availability of the page: https://complianceascode.readthedocs.io. It contains the developer documentation of https://github.com/ComplianceAsCode/content/ Additionally, contains documentation of our Jinja macros and Python Modules. In future, it will have even more documentation. With this new documentation hosting platform in place, we are deprecating the older Developer Guide <https://github.com/ComplianceAsCode/content/blob/master/docs/manual/develop…>. It will still exist for some time, but the preferred version is the ReadTheDocs.org one. We needed a platform where we could scale and organize better the documentation as it only gets bigger. If you would like to build the same documentation locally, follow the Sphinx build instructions on Building <https://complianceascode.readthedocs.io/en/latest/manual/developer/02_build…> Regards. -- Gabriel Gaspar Becker Software Engineer Red Hat <https://www.redhat.com> <https://red.ht/sig>

1 1

scap-security-guide copr repository is going to be discontinued
by Vojtech Polasek 13 Jan '21

13 Jan '21

Hello, I would like to announce that a decision was made to discontinue publishing of Scap Security Guide upstream releases in the Copr repository [1]. Lately, maintaining these releases has started to be more and more difficult, while the content of the scap-security-guide package in this repository is actually identical to the content published through Github release process, therefore it brings very low benefit. Therefore, if you use the repository to download upstream releases of Scap Security Guide, you will not receive any further updates. I recommend you to watch the Github repository [2] and download a zip file provided with every release. The latest zip file is at [3]. If there is a need, instructions for creating your own Copr builds are currently at [4]. I hope that this decision does not cause any inconvenience. Best regards, Vojta [1]: https://copr.fedorainfracloud.org/coprs/openscapmaint/openscap-latest/ [2]: https://github.com/ComplianceAsCode/content [3]: https://github.com/ComplianceAsCode/content/releases/download/v0.1.53/scap-… [4]: https://github.com/ComplianceAsCode/content/blob/master/release_tools/READM… -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

2 2

Stabilization ov 0.1.54
by Vojtech Polasek 11 Jan '21

11 Jan '21

Hello all, *Release of Content version 0.1.54 is scheduled for January 22nd*, so I've created a stabilization branch for it. Now is a good time to hunt for bugs and propose fixes for them. Starting today, merged Pull Requests should be assigned to milestone 0.1.55. Bug fixes should be proposed to master and labeled "bugfix", they will be cherry-picked to the stabilization branch. The next release 0.1.55 will happen on March 19th. Stabilization phase will start on March 8th. Best regards, -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

Re: Any rumors on next draft for RHEL 8 STIG from DISA?
by Mark Thacker 07 Jan '21

07 Jan '21

Hello all, A few of items of discussion here: 1. Red Hat validates the shipped crypto modules in RHEL itself. CentOS Stream is the evolving next release of those same modules. However, because CentOS Stream is a developer-focused, evolving project, Red Hat will not be validating the CentOS Stream modules themselves. Any issues, bugs, functional or security problems discovered in CentOS Stream (including the crypto modules) would indeed be filed as bugs, and addressed in CentOS and RHEL. 2. While OpenSCAP and the profiles we build will be included in CentOS Stream, they are treated as upstream from a support perspective. Our work flow still starts with the Compliance As Code GIT repository upstream, through CentOS Stream and into RHEL. 3. To be clear, code modifications and changes required to obtain certifications such as FIPS and Common Criteria will certainly be reflected in CentOS Stream (as all changes are, with the exception of embargoed content).Â But the certifications themselves will only ever be done on RHEL itself as that is the stable, long term supported release. On 1/5/21 5:30 PM, Jeffrey Hawkins wrote: > Hi Mark, > > Related topic.... > > Do you know if the FIPS Software Modules/Libraries that RedHat > certifies RHEL8.x will be included in CENTOS Stream (similar to > existing CENTOS approach), or will CENTOS Stream have different Crypto > Software?Â Â Â Also, any nuances or strategy changes we may need to be > aware of as to OpenScap and Benchmarks for CENTOS Stream? > > Jeff > > ------------------------------------------------------------------------ > *From:* Mark Thacker <mthacker(a)redhat.com> > *Sent:* Sunday, December 27, 2020 8:05 AM > *To:* SCAP Security Guide > <scap-security-guide(a)lists.fedorahosted.org>; Ted Brunell > <tbrunell(a)redhat.com> > *Subject:* Re: Any rumors on next draft for RHEL 8 STIG from DISA? > > Hi all, > > An update : > > * RHEL 8 Common Criteria is in process and we expect to complete and > announce in EARLY Q1 CY2021 > > * RHEL 8 FIPS is finishing now! Actually, two of our certs are in hand > now for RHEL 8 with three more in the final stages (in Coordination > state). We expect to push a press release when we have all of the > module validation certificates completed. > > Again, expect that we will announce more publicly when we have > completed the certifications for each of these standards. > > > On 12/2/20 4:30 PM, Ted Brunell wrote: >> I cannot really talk much about CC and FIPS, but the STIG is expected >> to be published by DISA (based on the draft STIG content on RHEL 8.2 >> and 8.3) sometime early next year. >> >> DISA may be able to provide a more concise timeframe. >> (disa.stig_spt(a)mail.mil <mailto:disa.stig_spt@mail.mil>). >> >> R/ >> >> Ted Brunell >> >> >> >> >> On Wed, Dec 2, 2020 at 12:14 PM Hayden,Robert <RHAYDEN(a)cerner.com >> <mailto:RHAYDEN@cerner.com>> wrote: >> >> Curious on if anyone has any information on the next draft >> release from DISA on RHEL 8 STIG benchmarks?Â The one in May was >> pretty rough and did not really match where the current upstream >> was moving towards. >> >> Thanks in advance >> >> Robert >> >> *Robert Hayden*| Lead Technology Architect | Cerner Corporation >> >> CONFIDENTIALITY NOTICE This message and any included attachments >> are from Cerner Corporation and are intended only for the >> addressee. The information contained in this message is >> confidential and may constitute inside or non-public information >> under international, federal, or state securities laws. >> Unauthorized forwarding, printing, copying, distribution, or use >> of such information is strictly prohibited and may be unlawful. >> If you are not the addressee, please promptly delete this message >> and notify the sender of the delivery error by e-mail or you may >> call Cerner's corporate offices in Kansas City, Missouri, U.S.A >> at (+1) (816)221-1024. >> >> _______________________________________________ >> scap-security-guide mailing list -- >> scap-security-guide(a)lists.fedorahosted.org >> <mailto:scap-security-guide@lists.fedorahosted.org> >> To unsubscribe send an email to >> scap-security-guide-leave(a)lists.fedorahosted.org >> <mailto:scap-security-guide-leave@lists.fedorahosted.org> >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> >> List Guidelines: >> https://fedoraproject.org/wiki/Mailing_list_guidelines >> <https://fedoraproject.org/wiki/Mailing_list_guidelines> >> List Archives: >> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… >> <https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo…> >> >> >> _______________________________________________ >> scap-security-guide mailing list --scap-security-guide(a)lists.fedorahosted.org <mailto:scap-security-guide@lists.fedorahosted.org> >> To unsubscribe send an email toscap-security-guide-leave(a)lists.fedorahosted.org <mailto:scap-security-guide-leave@lists.fedorahosted.org> >> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> >> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> >> List Archives:https://lists.fedorahosted.org/archives/list/scap-security-guide@l… <https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo…> > -- > > Mark Thacker > > He/Him > > Team Lead & Security Experience Product Manager, Red Hat Enterprise Linux > > Red Hat <https://www.redhat.com> > > mthacker(a)redhat.com <mailto:mthacker@redhat.com> > M: +1-214-636-7004 <tel:+1-214-636-7004> Twitter / IRC: @thackman > > <https://www.redhat.com> > > > _______________________________________________ > scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Mark Thacker He/Him Team Lead & Security Experience Product Manager, Red Hat Enterprise Linux Red Hat <https://www.redhat.com> mthacker(a)redhat.com <mailto:mthacker@redhat.com> M: +1-214-636-7004 <tel:+1-214-636-7004> Twitter / IRC: @thackman <https://www.redhat.com>

4 4

RE: Any rumors on next draft for RHEL 8 STIG from DISA?
by Todd, Charles 06 Jan '21

06 Jan '21

Or the FIPS 140-2/3 and CC certifications? They seem to be stuck in limbo too. Charlie Todd Ball Aerospace & Technologies From: Hayden,Robert <RHAYDEN(a)CERNER.COM> Sent: Wednesday, December 2, 2020 12:12 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: [EXTERNAL] Any rumors on next draft for RHEL 8 STIG from DISA? Curious on if anyone has any information on the next draft release from DISA on RHEL 8 STIG benchmarks? The one in May was pretty rough and did not really match where the current upstream was moving towards. Thanks in advance Robert Robert Hayden | Lead Technology Architect | Cerner Corporation CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024. This message and any enclosures are intended only for the addressee. Please notify the sender by email if you are not the intended recipient. If you are not the intended recipient, you may not use, copy, disclose, or distribute this message or its contents or enclosures to any other person and any such actions may be unlawful. Ball reserves the right to monitor and review all messages and enclosures sent to or from this email address.

4 3

Collecting system info with SCAP rules for manual inspection - informational rules
by Watson Sato 06 Jan '21

06 Jan '21

Hello all, Most of the Rules implemented in ComplianceAsCode/content <https://github.com/ComplianceAsCode/content> (if not all of them) have been focused on checking and remediating a specific configuration. Typically configurations that are easy to automate. For example, ensuring that packages installed have the signature verified is implemented by a rule checking that the repo files have "gpgcheck = 1". But there are cases where automation is not reasonably achievable, they would require hard coding parameters or an extensive tailoring harness for the rule. For example, how to ensure that configured repositories are the ones officially supported by the distro. In these cases the check needs to be done by some other process, maybe manually checking the repositories enabled, or some administrative process guarantees it. I don't know details of the auditory nor how these non-automatable requirements are handled. So I wonder if an Informational Rule that would collect the data for manual analysis would be of help. Following the examples, this informational rule would collect the list of repositories enabled, and present it / aggregate it somehow. Regards, -- Watson Sato Software Engineer Red Hat EMEA <https://www.redhat.com> <https://www.redhat.com>

2 2

Re: Any rumors on next draft for RHEL 8 STIG from DISA?
by Trevor Vaughan 06 Jan '21

06 Jan '21

Jeff, AFAIK, CentOS *never* had FIPS-approved crypto (and never will). From my functional testing, it's still a good test platform but for the real deal, you have to use an approved platform product. Trevor On Tue, Jan 5, 2021 at 5:30 PM Jeffrey Hawkins <rtswguru(a)hotmail.com> wrote: > Hi Mark, > > Related topic.... > > Do you know if the FIPS Software Modules/Libraries that RedHat certifies > RHEL8.x will be included in CENTOS Stream (similar to existing CENTOS > approach), or will CENTOS Stream have different Crypto Software? Also, > any nuances or strategy changes we may need to be aware of as to OpenScap > and Benchmarks for CENTOS Stream? > > Jeff > > ------------------------------ > *From:* Mark Thacker <mthacker(a)redhat.com> > *Sent:* Sunday, December 27, 2020 8:05 AM > *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>; > Ted Brunell <tbrunell(a)redhat.com> > *Subject:* Re: Any rumors on next draft for RHEL 8 STIG from DISA? > > > Hi all, > > An update : > > * RHEL 8 Common Criteria is in process and we expect to complete and > announce in EARLY Q1 CY2021 > > * RHEL 8 FIPS is finishing now! Actually, two of our certs are in hand now > for RHEL 8 with three more in the final stages (in Coordination state). We > expect to push a press release when we have all of the module validation > certificates completed. > > Again, expect that we will announce more publicly when we have completed > the certifications for each of these standards. > > > On 12/2/20 4:30 PM, Ted Brunell wrote: > > I cannot really talk much about CC and FIPS, but the STIG is expected to > be published by DISA (based on the draft STIG content on RHEL 8.2 and 8.3) > sometime early next year. > > DISA may be able to provide a more concise timeframe. ( > disa.stig_spt(a)mail.mil). > > R/ > > Ted Brunell > > > > > On Wed, Dec 2, 2020 at 12:14 PM Hayden,Robert <RHAYDEN(a)cerner.com> wrote: > > Curious on if anyone has any information on the next draft release from > DISA on RHEL 8 STIG benchmarks? The one in May was pretty rough and did > not really match where the current upstream was moving towards. > > > > Thanks in advance > > Robert > > > > *Robert Hayden* | Lead Technology Architect | Cerner Corporation > > > > > CONFIDENTIALITY NOTICE This message and any included attachments are from > Cerner Corporation and are intended only for the addressee. The information > contained in this message is confidential and may constitute inside or > non-public information under international, federal, or state securities > laws. Unauthorized forwarding, printing, copying, distribution, or use of > such information is strictly prohibited and may be unlawful. If you are not > the addressee, please promptly delete this message and notify the sender of > the delivery error by e-mail or you may call Cerner's corporate offices in > Kansas City, Missouri, U.S.A at (+1) (816)221-1024. > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > > _______________________________________________ > scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > -- > > Mark Thacker > > He/Him > > Team Lead & Security Experience Product Manager, Red Hat Enterprise Linux > > Red Hat <https://www.redhat.com> > > mthacker(a)redhat.com > M: +1-214-636-7004 Twitter / IRC: @thackman > <https://www.redhat.com> > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

1 0

Re: Any rumors on next draft for RHEL 8 STIG from DISA?
by Ted Brunell 05 Jan '21

05 Jan '21

I cannot really talk much about CC and FIPS, but the STIG is expected to be published by DISA (based on the draft STIG content on RHEL 8.2 and 8.3) sometime early next year. DISA may be able to provide a more concise timeframe. ( disa.stig_spt(a)mail.mil). R/ Ted Brunell On Wed, Dec 2, 2020 at 12:14 PM Hayden,Robert <RHAYDEN(a)cerner.com> wrote: > Curious on if anyone has any information on the next draft release from > DISA on RHEL 8 STIG benchmarks? The one in May was pretty rough and did > not really match where the current upstream was moving towards. > > > > Thanks in advance > > Robert > > > > *Robert Hayden* | Lead Technology Architect | Cerner Corporation > > > > > CONFIDENTIALITY NOTICE This message and any included attachments are from > Cerner Corporation and are intended only for the addressee. The information > contained in this message is confidential and may constitute inside or > non-public information under international, federal, or state securities > laws. Unauthorized forwarding, printing, copying, distribution, or use of > such information is strictly prohibited and may be unlawful. If you are not > the addressee, please promptly delete this message and notify the sender of > the delivery error by e-mail or you may call Cerner's corporate offices in > Kansas City, Missouri, U.S.A at (+1) (816)221-1024. > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… >

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2021