Here are the notes that Michele and I took during the call. Before I send to a wider list (gov-sec, mil-oss, etc) what'd I forget? Also using this list to generate action items.
Procedural Next Steps: (1) Flurry of activity today to finalize severity ratings, services, etc. (2) Shawn to generate a "STIG Informal Draft RC1" RPM. Perhaps using a more clever name. (3) DISA FSO to publicly publish a "Informal Draft" by 7-NOV. This draft will include prose only -- no automation. (4) DISA FSO to publicly publish a "Formal Draft" by 26-DEC. Still no automation. (5) Public comment period on "Formal Draft" ends on 17-DEC (6) Once comments are included/requirements formalized by DISA FSO, OVAL content review begins 9-JAN (7) DSAWG (sp?) review 12/13-FEB (8) Delivery of OVAL to government in April (9) Final RHEL6 STIG, including automation, ~20-MAY-2013
Required changes based on 25-OCT DoD Consensus Call: (1) Need to remove notes about network services. (2) Change banner severity to medium. Strong feedback from DoD community this must be medium for legal requirements (3) SELinux should never be disabled, but permissive could be OK. Need to update wording. Need to include prose around how to disable specific enforcement types to allow SELinux to remain enforcing while unenforcing select apps. (4) Re-enforce RHEL6 STIG should not mandate a host security tool. Double check wording AND OVAL of existing content (5) GEN 1780 still applies? Need decision (6) System Security Daemon content (7) Add OVAL check for recursive filesystem walks to only check local filesystems, otherwise locks machine. Michele thinks xdev will do the trick. (8) Remove the V-7 check or add language somehow indicating it's OK to run RHNSD when connecting to Satellite (9) Add content for RHSM, Red Hat Subscription Manager (10) OVAL content broke for " fixing keeping system up2date" (11) Create table that lists STIG items that do not have OVAL check (12)