We have moved the lists to a new email server and need to test that
lists are working.
Stephen J Smoogen.
"Don't derail a useful feature for the 99% because you're not in it."
"Years ago my mother used to say to me,... Elwood, you must be oh
so smart or oh so pleasant. Well, for years I was smart. I
recommend pleasant. You may quote me." —James Stewart as Elwood P. Dowd
limit_password_reuse doesn't map to anything and limiting_password_reuse
is already in the profile. Removed limit_password_reuse from common profile.
Thanks to Willem Bos for pointing it out.
Kevin Spargur (1):
Removed a redundant profile reference to the remember password rule
RHEL6/input/profiles/common.xml | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
group limiting_password_reuse was causing the oval line not to properly
transform and making it into the final output. Changing Group to Rule
fixes this. Not sure why this is a group instead of a rule in anycase.
Also mapped CCI 1343 to the rule for auditd to drop to single user mode
when storage fills then removed that from the "needs new rule" group.
Kevin Spargur (2):
Mapped CCI 1343 to rule for action on full storage for auditd
Changed group limiting_password_reuse to a rule
RHEL6/input/auxiliary/srg_support.xml | 2 +-
RHEL6/input/system/accounts/pam.xml | 31 +++++++++++++++----------------
RHEL6/input/system/auditing.xml | 2 +-
3 files changed, 17 insertions(+), 18 deletions(-)
Before the consensus meeting next week, we should have the STIG-server
Profile expanded to include all items which bear CCIs.
Even though a few of these are not practical (such as disabling all USB
support), the conversation should start with a strict mapping of the SRG
requirements, captured in the STIG-server Profile.
Note: I've pushed the script that can identify Rules with references
which are missing from a Profile, but I'm not pushing the other part of
that commitset until we've been able to sync on how/when the Profile
updating (and likely reorganization between common and STIG-server)
There are likely Rules for disabling service in the common Profile which
likely belong only in the desktop Profile, too (as these would be normal
for a server).
Technology and Systems Analysis / Network Components
NSA Information Assurance
This set of patches contains changes/additions based on feedback from DISA FSO. These are also documented as tickets in the project's wiki.
Willy Santos (5):
Corrected rule mapping for CCI-143.
Corrected mapping of CCI 206.
Corrected mapping of CCI 154.
Removed mapping of CCI-1414 from unmet_impractical_guidance.
Created prose for NFS insecure_locks option.
RHEL6/input/auxiliary/srg_support.xml | 4 +-
RHEL6/input/services/nfs.xml | 26 +++++++++++++++++++-
RHEL6/input/system/accounts/accounts.xml | 1 -
RHEL6/input/system/auditing.xml | 6 ++--
RHEL6/input/system/software/disk_partitioning.xml | 2 +-
5 files changed, 30 insertions(+), 9 deletions(-)
Well, almost. But the tooling now exists to make sure it will (or that it's clear
where/why we haven't).
Jeffrey Blank (2):
improved verify-references script to show if Profile does not include
all Rules with certain references
added Rules to STIG profile, based on output from
verify-references.py * some Rules are still tagged but have
not been added yet * some of these need Values specified or
require a little more investigation
RHEL6/input/profiles/STIG-server.xml | 10 +++++
RHEL6/input/profiles/common.xml | 4 ++
RHEL6/utils/verify-references.py | 65 ++++++++++++++++++++++++++++++---
3 files changed, 73 insertions(+), 6 deletions(-)