scap-security-guide May 2021

scap-security-guide@lists.fedorahosted.org

6 participants
7 discussions

Correct links for ComplianceAsCode Content 0.1.56
by Vojtech Polasek 26 May '21

26 May '21

Hello all, the previous mail had wrong links, I am sorry for the noise. Here links are correct.ComplianceAsCode/Content 0.1.56 has been released. Among the highlights of this release are: Align ism_o profile with latest ISM SSP (#6878) Align RHEL 7 STIG profile with DISA STIG V3R3 Creating new RHEL 7 STIG GUI profile (#6863) Creating new RHEL 8 STIG GUI profile (#6862) Add the RHEL9 product (#6801) Initial support for SUSE SLE-15 (#6666) add support for osbuild blueprint remediations (#6970) For full release notes, please have a look at: - https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 Zip archive with pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.56/scap-… Zip archive with pre-built content using only OVAL-5.10: https://github.com/ComplianceAsCode/content/releases/download/v0.1.56/scap-… Thank you to everyone who contributed! Happy hardening! -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

2 3

ComplianceAsCode Content 0.1.56
by Vojtech Polasek 26 May '21

26 May '21

Hello all, ComplianceAsCode/Content 0.1.56 has been released. Among the highlights of this release are: Align ism_o profile with latest ISM SSP (#6878) Align RHEL 7 STIG profile with DISA STIG V3R3 Creating new RHEL 7 STIG GUI profile (#6863) Creating new RHEL 8 STIG GUI profile (#6862) Add the RHEL9 product (#6801) Initial support for SUSE SLE-15 (#6666) add support for osbuild blueprint remediations (#6970) For full release notes, please have a look at: - https://github.com/ComplianceAsCode/content/releases/tag/v0.1.56 Zip archive with pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.56/scap-… Zip archive with pre-built content using only OVAL-5.10: https://github.com/ComplianceAsCode/content/releases/download/v0.1.56/scap-… Thank you to everyone who contributed! Happy hardening! -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

Cleanup of the directory structure
by Matej Tyc 21 May '21

21 May '21

Dear ComplianceAsCode community, the project is thriving, so there are many pull requests open at the same time, and it is easy to miss the big ones - such as https://github.com/ComplianceAsCode/content/pull/7018 that aims to move products to a separate directory. The benefit of this PR is a cleanup of the project structure and less disruption when a new project is added, but it is not without issues, as it disrupts git history and it can cause issues if you maintain your custom set of patches. Anyway, please let us know what you think in the respective PR discussion!

1 0

RHEL 8 Security Guide
by MyNicePC 14 May '21

14 May '21

Hello, I just installed Openscap Workbench on my laptop. I have apways been able to scan RHEL 6 and RHEL 7 servers using security guides provided within OpenScap. Does anyone know if you support a security guide for RHEL 8? Thank you, JR

4 3

Adding support for tags into the policy definition files
by Vojtech Polasek 11 May '21

11 May '21

Hello all, I would like to point you to a Github discussion which proposes adding support for tags into policy definition files (files within "controls" directory which are used for higher abstraction of profile definition). https://github.com/ComplianceAsCode/content/discussions/6996 Please direct your feedback into the discussion if possible, so that we can follow it easier. I am looking forward to your suggestions. Best regards, -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

Stabilization of v0.1.56
by Vojtech Polasek 11 May '21

11 May '21

Hello all, *Release of Content version 0.1.56 is scheduled for May 21st*, so I've created a stabilization branch for it. Now it is a good time to hunt for bugs and propose fixes for them. Starting today, merged Pull Requests should be assigned to milestone 0.1.57. Bug fixes should be proposed to master and labeled "bugfix", they will be cherry-picked to the stabilization branch. The next release 0.1.57 will happen on July 23rd. Stabilization phase will start on July 12th. Best regards, -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

RHEL7 STIG on Local Interactive Users
by Parker, Ryan 30 Apr '21

30 Apr '21

Hello, I have been working on automating some of the manual items within the RHEL7 STIG that are not covered by the DISA-provided SCAP benchmark nor are they covered by OpenSCAP content. Specifically, I have been working on automating the items that pertain to what the STIG describes as "local interactive users." A significant portion of these items use specific commands referencing /etc/passwd to check the home directory assignment for all local interactive users. For example, in the Check Text section of RHEL-07-020620 (All local interactive users must have a home directory assigned and defined in the /etc/passwd file): awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd However, nearly all of the RHEL7 systems that I support are joined to an Active Directory domain using realmd and SSSD. Therefore, the above check command does not work out-of-the-box for AD-authenticated users since none of them have an entry in /etc/passwd. Therefore, I wanted to discuss what others have done for these STIG items and to bring up the subject of what constitutes as a "local interactive user," or at least what DISA is defining such user as. I presume local interactive users would mean root and various service accounts, but I am unsure if this is what DISA is targeting. V/r, Ryan Parker Research Scientist I GTRI | ISD - Secure Computing Department w: 404-407-7320 e: ryan.parker(a)gtri.gatech.edu<mailto:ryan.parker@gtri.gatech.edu><mailto:Ryan.Parker@gtri.gatech.edu>

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2021