Insight into release timing of RHEL7 STIG as "official" -- any help needed on the Project?
by Jeffrey Hawkins
Anyone have any insight on when the RHEL7 STIG is going to be ready for prime time to be picked up by DISA? I work for a company the delivers RHEL based Products that use the STIG as part of the Security Standards /Benchmark to follow, and right now we are middle of development cycle of migrating our Products from RHEL6 to RHEL7. We are leveraging existing RHEL6 STIG, and the early RHEL7 drafts where it make sense within our own Hardening Framework (developed and carried forward from pre-RHEL4 days). We would like to avoid what we faced with RHEL6 with chasing the Draft verses RHEL5 STIG, and speculating what would be in the final . So, thought I would raise a query of the Benchmark rollout...
Are there areas where help is needed as I/we would be more than happy to help the Project?
Thanks,
Jeff
8 years, 2 months
SSG 0.1.26 release timing
by Martin Preisler
Hi Jan!
I plan to make SCAP Workbench 1.1.1 release in the short-term.
The Windows and MacOSX versions bundle SSG. For obvious reasons
I'd like to bundle fresh SSG 0.1.26. I am willing to wait a few
days with the release to achieve that.
Do you have specific plans regarding the timing?
--
Martin Preisler
Security Technologies | Red Hat, Inc.
8 years, 2 months
Public Jenkins infrastructure
by Zbynek Moravec
Hi contributors,
We have make our Jenkins server public - https://jenkins.open-scap.org/ (self signed certificate currently).
Test-machines with Fedora22/RHEL6/RHEL7 are used.
When you push something to your pull requests, Jenkins will automatically start testing (or ask admin to verification).
White-list for automatic testing currently should contains people which have ever contributed to OpenSCAP/scap-security-guide.
Tips:
- If you don't want to test your your pull request automatically, you can add "[skip ci]" phrase to pull request description.
- If you are in admin-list(currently OpenSCAP team in Brno), you can control jenkins testing by pull-request comments:
- "ok to test" to accept this pull request for testing
- "test this please" for a one time test run
- "add to whitelist" to add the author to the whitelist
If you have any tips/issue with jenkins, feel free to contact me.
Zbynek Moravec
8 years, 2 months
Why is Fedora xccdf missing so much compared to RHEL?
by Bruno Wolff III
I was looking at what is available for checks in Fedora compared to RHEL
by using scap-workbench customization and found tha Fedora was missing a
lot, even when the test commands were available (e.g yum check-update) in
Fedora.
I can believe that doing CVE checks for Fedora would be a significant
amount of ongoing work that no one might want to do, but most stuff that
works in RHEL is probably available in Fedora. And new stuff in Fedora
that requires changes is likely to eventually show up in future RHEL
versions and not be completely extra work.
8 years, 2 months
A tool for support of SCAP content development
by Jan Cerny
Hello,
Nowadays, there is almost no support for OVAL content development.
The developers have to edit the XML files manually, there is no
analysis tool, no debugger or any other tool that could make
the content development faster and easier.
I have started working on a new utility that will be able to
debug OVAL checks, show step-by-step how they are evaluated,
browse collected objects and system characteristics, communicate
with probes, etc.
I'm working on design of the utility now. I'm considering many
alternatives, so I would like to ask you a few questions.
* Can you describe most common problems that you have to face
when you create the OVAL content?
* How do you usually solve these problems?
* Can you tell me an example when did you run into issues with OVAL?
* Imagine an ideal tool for an OVAL developer. What should it be
able to do? What would be its features?
I would appreciate any suggestions, remarks or other inputs.
Thank you very much for your reply.
Regards
Jan Černý
Security Technologies | Red Hat, Inc.
8 years, 2 months