A larger community invitation:
Please email me (including your information) if you'd like to join the
call tomorrow, and I can send dial-in info.
The current draft of settings is here:
The audience is typically those involved in risk decisions or C&A
processes, as well as those who deploy systems. This is a chance to
influence settings, including a chance to voice operational concerns
Aside from the call, the fedorahosted.org/scap-security-guide mailing
list continues to provide a forum for discussion of security settings
and their impact.
Thanks to our friends at DISA FSO for this patch!
David Smith (1):
additional rationale entries and added check text for ftp logging
RHEL6/input/services/ftp.xml | 13 +++++++++++++
RHEL6/input/services/ldap.xml | 1 +
RHEL6/input/services/nfs.xml | 3 +++
RHEL6/input/services/xorg.xml | 2 ++
RHEL6/input/system/permissions/files.xml | 8 ++++++++
5 files changed, 27 insertions(+), 0 deletions(-)
moved a few severity listings from "low" to either "high" or "medium"
David Smith (1):
RHEL6/input/system/network/iptables.xml | 8 ++++----
RHEL6/input/system/selinux.xml | 6 +++---
RHEL6/input/system/software/updating.xml | 8 ++++----
3 files changed, 11 insertions(+), 11 deletions(-)
G'Morning. New to the list & getting spun up on SSG for RHEL-6. Couple
In the current content, the rules fail even if the supporting package is
not installed (e.g. shows vulnerable for postfix checks even if postfix is
1. Are there currently any mappings between OVAL tests and the RPMs that
are dependencies (e.g. "test_postfix_server_banner" requires postfix-x-x.rpm
to be installed)? If not, I can start mapping this out in a
spreadsheet/CSV to get started.
2. Would the correct way to handle this be in the individual OVAL checks
("AND" the current test and an RPM test for the package)? Or is there a
more elegant way to handle this with OVAL_CPE?
hopefully this is .. close?
Jeffrey Blank (3):
added alternate text for STIG titles. Problematic if titles must be
updated XSLT transform for unique Vuln-ID insertion
new "flat" output format for CCI-based table
RHEL6/input/auxiliary/alt-titles-stig.xml | 9 +++
RHEL6/transforms/table-add-vulnids.xslt | 10 +++-
RHEL6/transforms/xccdf2table-profileccirefs.xslt | 72 ++++++++++++++++++++-
3 files changed, 86 insertions(+), 5 deletions(-)
Rules that require use of Postfix instead of Sendmail. Postfix
is the RHEL default now, and this will catch those who try to cling to
Addition of a Rule from the RHEL 5 STIG (updated for RHEL 6) requiring that
Ctrl-Alt-Del result in logging instead of a reboot. This was based on
discussion that unintended reboots were occurring (since another platform uses
this key sequence) and creating availability problems.
The transform which creates the table with CCI refs now includes the associated
NIST 800-53 refs as a separate column.
Jeffrey Blank (6):
added new alternate titles for new Rules, removed old Rule title
added new Rules to require Postfix not sendmail, removed path Rule
added Rule content for Postfix vs Sendmail
added Rule text for disabling Ctrl-Alt-Del reboots
display 800-53-refs as separate column in CCI table
RHEL6/input/auxiliary/alt-titles-stig.xml | 10 +++-
RHEL6/input/profiles/STIG-server.xml | 6 ++-
RHEL6/input/services/mail.xml | 55 +++++++++++----------
RHEL6/input/system/accounts/physical.xml | 29 +++++++++++
RHEL6/input/system/logging.xml | 2 +-
RHEL6/input/system/software/updating.xml | 3 +-
RHEL6/transforms/xccdf2table-profileccirefs.xslt | 15 ++++--
7 files changed, 84 insertions(+), 36 deletions(-)