Will anyone else be at the MITRE Dev Days conference next week? There's
going to be a session on the SCAP Security Guide project, and
<shameless_plug>Red Hat willl be sponsoring some of the 'social event'
at Gordon Biersch</shameless_plug>.
Would be great to meet catch up with members of the SSG community!
-------- Original Message --------
Subject: CONFIRMATION: Developer Days 2013
Date: Thu, 18 Jul 2013 16:40:43 +0000
From: Hansbury, Matt <mhansbury(a)mitre.org>
To: Hansbury, Matt <mhansbury(a)mitre.org>
You have officially registered as an attendee of MITRE's Developer Days
2013 workshop, held at MITRE's McLean site. This email serves as a
reminder and confirmation for the event, beginning this upcoming Monday
(July 22, 2013) at 10AM EST. The event runs for 3 days, ending on
Wednesday (July 24, 2013), at around 6PM. The official agenda can be
found at the event web site.
To ensure your stay during the event is enjoyable, we have a few
reminders for you:
1.There is no cost or fee to attend the workshop, but you will be on
your own for all meals. Note that the MITRE cafeteria is on the same
floor as the event, so easy access to food and drink will be available.
2.Please join us for our Social Event at Gordon Biersch at the Tyson's
Corner Mall location. The cost for this will not exceed $20 (the exact
cost will vary on the number of attendees that join us, so the exact
figure won't be available until the event, but we can commit to holding
it to $20 or under).
If you know that you will (or will not) be able to attend the Social
Event, and have not already responded, please notify *oval(a)mitre.org
<mailto:email@example.com>*so an accurate head count can be determined.
3.If you are not a US citizen, we remind that you that you will **not**
be able to bring electronic devices into any of the MITRE buildings and
will need to be escorted by a MITRE employee at all times. Please leave
your devices in your hotel room or car.
4.Lastly, if you are **no longer** able to attend the event for any
reason, I would request that you let us know so that folks on our
waiting list can be accommodated.
The event will be held in the MITRE 1 building (also known a 'H'
building) at the MITRE McLean, VA campus (the room number is 1H300).
For more information and directions, please review the following:
Additional workshop details can be found at:
We look forward to sharing with you some detailed technical
conversations that will help drive OVAL and the other related efforts
forward. See you in a few days!
The OVAL Team
The text in the guide suggests that AES and 3DES ciphers are allowed in CBC
and CTR versions.
"Limit the ciphers to those algorithms which are FIPS-approved. Counter
(CTR) mode is also preferred over cipher-block chaining (CBC) mode. The
following line in /etc/ssh/sshd_config demonstrates use of FIPS-approved
However, the test has the old CTR only list.
This fixes one of the annoying false-positives that occur when I run the
SSG against my systems which have been hardened according to the guide.
Signed-off-by: Andrew Gilmore <agilmore2(a)gmail.com>
diff --git a/RHEL6/input/checks/sshd_use_approved_ciphers.xml
index 267fe93..1807d56 100644
@@ -21,7 +21,7 @@
<ind:textfilecontent54_object id="obj_20251" version="1">
- <ind:pattern operation="pattern
+ <ind:pattern operation="pattern
Is there a tentative date for the next release by DISA of the RHEL6 STIG, both the manual and the benchmark? I'm writing code right now looking at what is on the IASE web site (because that is what is 'official'), but I know there are just a few differences between that and what is in the SSG 'upstream' code base (kernel module /bin/true vice /bin/false for example). Just wondering when the next iteration will become official....
I appreciate all the great work folks have done, and somehow missed
the big announcement that DISA had put a final out there.
Now, I'd like to evaluate against the final STIG, from
It appears that the profiles listed are fairly different than the SSG
version, but I can get behind that. I can try MAC-3_Public to start.
What I don't see is the CPE dictionary, etc. Where do I get evaluation
content to match the DISA STIG?
Just had some questions related to the rpm verification items in the RHEL6 STIG.
1) How are people handling 3rd party software that isn't installed from a yum repo?
2) On my RHEL6.4 VM I ran an 'rpm -Va' right after I installed the system, and received the following output:
S.5....T. c /etc/maven/maven2-depmap.xml
SM5....T. c /etc/sysconfig/rhn/up2date
..5....T. c /usr/lib/security/classpath.security
..5....T. c /etc/inittab
....L.... c /etc/pam.d/fingerprint-auth
....L.... c /etc/pam.d/password-auth
....L.... c /etc/pam.d/smartcard-auth
....L.... c /etc/pam.d/system-auth
S.5....T. c /etc/rsyslog.conf
So this shows there are 6 'issues' to be dealt with since we can ignore the config issues (c). Most of these are non-issues so far as I can see, due to files being rebuilt/tweaked during install or known transient files, and could be avoided if the owning rpms labeled the files as configuration files perhaps.