Realize the 'Conference Presentations' page on the OpenSCAP/SSG wiki has
gotten a bit stale.
Anyone present on OpenSCAP or SSG things lately? Would love to see
community presentations get added to the wiki!
Feel free to edit the wiki directly (just add a change note), or reply
on-list with your presentation date/title/link and I'll add it for you :)
So, I was digging through and found the following:
The operating system must off-load audit records onto a different system or
media from the system being audited.
The operating system must encrypt the transfer of audit records off-loaded
onto a different system or media from the system being audited.
This poses a real problem since there are pretty much limitless methods to
meet this requirement and, given that actual proof is multi-node, this is
going to be *really* difficult to evaluate properly.
As much as I like auditd, I don't care for the thought of the network
blocking all of my operations, so I've opted to pass it along to syslog. My
syslog is then TLS encrypted to the various shipping points. This obviously
meets the requirement, and I can automatically test that configuration in
my code but I feel like this is yet another place where we're going to have
difficulty with the SSG.
I also noticed that this one hasn't been implemented in the SSG and I'm
guessing that this is why.
What are the plans for things like this moving forward?
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
Hi SCAP folks...
I am curious what anyone working on the RHEL 7 STIG Alignment or
remediation thinks about these controls relating to "interactive user" home
directories. Is this something you see fit to implement through a
remediation script? It's one thing to setup a new system that complies
with these rules before new users start using it, but running a script to
correct this kind of stuff on an existing system seems like inviting a lot
Also, clearly there is nothing new in these controls specific to RHEL7,
should we expect to see these controls pushed into the RHEL6 STIG too?
Thanks for your thoughts!