Cron, at, and sudo rules pointless? (and some other goodies)
by Trevor Vaughan
Hi All,
In my never ending quest to find new and annoying ways to do everything, I
figured that I'd throw out the new list of fun.
1. Using pkexec makes sudo relatively pointless. Sure, it logs things, but
we now effectively have two sudo subsystems and one can't really have the
rules audited per my last discussion with Steve because JavaScript as a
configuration language is amazing. Not sure what to do about this one but
people should really be watching for it and I don't see any mention of it
in the rules anywhere.
2. Systemd timers can be run in user mode and effectively make all the
restrictions around cron and at pointless from what I can tell. So far, I
can't figure out how to disable user space timers or 'systemctl --user'
calls without completely removing 'pam_systemd' from the stack. No idea
what this would break but it's probably the only solution right now (or
maybe having a group-based jump stack in PAM).
3. There should probably be some sort of check to make sure that
'enable-linger' has not been set for users.
In summary, the SSG simply does not cover any of the new EL7+ capabilities
very well, particularly those that replace traditional services that are
already expected to be controlled. As systemd becomes more of an operating
system and less of service manager, this will only get worse.
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
4 years, 5 months
Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL
in January 2019?
by Trevor Vaughan
Heh, no offense taken. I just needed to turn the little lights green with a
.ckl file...and I did :-D
On Wed, Nov 28, 2018 at 11:37 AM Brent Kimberley <Brent.Kimberley(a)durham.ca>
wrote:
> No disrespect intended. That’s exactly what I would do under the
> circumstances.
>
>
>
> *From:* Brent Kimberley
> *Sent:* Wednesday, November 28, 2018 11:36 AM
> *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
> *Subject:* RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8
> is EOL in January 2019?
>
>
>
> That speaks volumes.
>
>
>
> http://www.crosstalkonline.org/back-issues/
>
>
>
> *From:* Trevor Vaughan [mailto:tvaughan@onyxpoint.com
> <tvaughan(a)onyxpoint.com>]
> *Sent:* Wednesday, November 28, 2018 11:31 AM
> *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
> *Subject:* Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8
> is EOL in January 2019?
>
>
>
> Brent, that may be the funniest message I've ever read.
>
>
>
> There isn't one, I just reverse engineered it from the pseudo-XML that it
> outputs.
>
>
>
> On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca>
> wrote:
>
> Where can I find the controlled schema / ICD / metadata for the checklist
> file format?
>
>
>
> *From:* Trevor Vaughan [mailto:tvaughan@onyxpoint.com]
> *Sent:* Wednesday, November 28, 2018 9:02 AM
> *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
> *Subject:* Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8
> is EOL in January 2019?
>
>
>
> Yep, this is the one.
>
>
>
> That said, if you dig through the archives of this mailing list, I figured
> out how to create the bare minimum .ckl file that you need for reporting so
> that should give people a head start.
>
>
>
> On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com> wrote:
>
> The .ckl issue is the answer to why use. I know not everyone works for
> gov't entities, but they typically require it, with very little options for
> other products. Management likes graphs and charts.
>
>
>
> On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com
> wrote:
>
> On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote:
> >
> >
> > On 11/27/18 2:06 PM, James Ralston wrote:
> > > I apologize if this is a little off-topic for this list, but a
> > > question: what are others who use STIG Viewer planning to do once
> > > Oracle JDK 8 / JavaFX go EOL in January 2019?
> > >
> [...]
> > > Ideally, I'd like to find a Linux replacement for STIG
> > > Viewer—something that can read, annotate, and write STIG Viewer
> > > checklist (*.ckl) files. But although SCAP Workbench can load and
> > > check STIGs, unless I'm missing something, it has no support for STIG
> > > Viewer checklist files.
> >
> > Not being snide, should this come across wrongly.... genuine question:
> > Why use STIG Viewer in the first place?
> >
>
> The STIG Viewer produces *.ckl checklist files, which some auditors and
> many security departments want.
>
> V/r,
> James Cassell
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
>
>
> --
>
> Trevor Vaughan
> Vice President, Onyx Point, Inc
>
> (410) 541-6699 x788
>
>
> -- This account not approved for unencrypted proprietary information --
>
> THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY
> CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR
> EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to
> any privilege have been waived. If you are not the intended recipient, you
> are hereby notified that any review, re-transmission, dissemination,
> distribution, copying, conversion to hard copy, taking of action in
> reliance on or other use of this communication is strictly prohibited. If
> you are not the intended recipient and have received this message in error,
> please notify me by return e-mail and delete or destroy all copies of this
> message.
>
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
>
>
> --
>
> Trevor Vaughan
> Vice President, Onyx Point, Inc
>
> (410) 541-6699 x788
>
>
> -- This account not approved for unencrypted proprietary information --
> THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY
> CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR
> EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to
> any privilege have been waived. If you are not the intended recipient, you
> are hereby notified that any review, re-transmission, dissemination,
> distribution, copying, conversion to hard copy, taking of action in
> reliance on or other use of this communication is strictly prohibited. If
> you are not the intended recipient and have received this message in error,
> please notify me by return e-mail and delete or destroy all copies of this
> message.
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
4 years, 5 months
RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL
in January 2019?
by Brent Kimberley
Lt Col Tom summed it up as follows: https://turing.cs.hbg.psu.edu/comp413/cimm.pdf
From: Brent Kimberley
Sent: Wednesday, November 28, 2018 11:38 AM
To: 'SCAP Security Guide' <scap-security-guide(a)lists.fedorahosted.org>
Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
No disrespect intended. That’s exactly what I would do under the circumstances.
From: Brent Kimberley
Sent: Wednesday, November 28, 2018 11:36 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
That speaks volumes.
http://www.crosstalkonline.org/back-issues/
From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com]
Sent: Wednesday, November 28, 2018 11:31 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
Brent, that may be the funniest message I've ever read.
There isn't one, I just reverse engineered it from the pseudo-XML that it outputs.
On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca<mailto:Brent.Kimberley@durham.ca>> wrote:
Where can I find the controlled schema / ICD / metadata for the checklist file format?
From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com<mailto:tvaughan@onyxpoint.com>]
Sent: Wednesday, November 28, 2018 9:02 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
Yep, this is the one.
That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start.
On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com<mailto:simontek@gmail.com>> wrote:
The .ckl issue is the answer to why use. I know not everyone works for gov't entities, but they typically require it, with very little options for other products. Management likes graphs and charts.
On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com<mailto:fedoraproject@cyberpear.com> wrote:
On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote:
>
>
> On 11/27/18 2:06 PM, James Ralston wrote:
> > I apologize if this is a little off-topic for this list, but a
> > question: what are others who use STIG Viewer planning to do once
> > Oracle JDK 8 / JavaFX go EOL in January 2019?
> >
[...]
> > Ideally, I'd like to find a Linux replacement for STIG
> > Viewer—something that can read, annotate, and write STIG Viewer
> > checklist (*.ckl) files. But although SCAP Workbench can load and
> > check STIGs, unless I'm missing something, it has no support for STIG
> > Viewer checklist files.
>
> Not being snide, should this come across wrongly.... genuine question:
> Why use STIG Viewer in the first place?
>
The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want.
V/r,
James Cassell
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
4 years, 6 months
RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL
in January 2019?
by Brent Kimberley
Major Tom summed it up as follows: https://turing.cs.hbg.psu.edu/comp413/cimm.pdf
From: Brent Kimberley
Sent: Wednesday, November 28, 2018 11:38 AM
To: 'SCAP Security Guide' <scap-security-guide(a)lists.fedorahosted.org>
Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
No disrespect intended. That’s exactly what I would do under the circumstances.
From: Brent Kimberley
Sent: Wednesday, November 28, 2018 11:36 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
That speaks volumes.
http://www.crosstalkonline.org/back-issues/
From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com]
Sent: Wednesday, November 28, 2018 11:31 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
Brent, that may be the funniest message I've ever read.
There isn't one, I just reverse engineered it from the pseudo-XML that it outputs.
On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca<mailto:Brent.Kimberley@durham.ca>> wrote:
Where can I find the controlled schema / ICD / metadata for the checklist file format?
From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com<mailto:tvaughan@onyxpoint.com>]
Sent: Wednesday, November 28, 2018 9:02 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
Yep, this is the one.
That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start.
On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com<mailto:simontek@gmail.com>> wrote:
The .ckl issue is the answer to why use. I know not everyone works for gov't entities, but they typically require it, with very little options for other products. Management likes graphs and charts.
On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com<mailto:fedoraproject@cyberpear.com> wrote:
On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote:
>
>
> On 11/27/18 2:06 PM, James Ralston wrote:
> > I apologize if this is a little off-topic for this list, but a
> > question: what are others who use STIG Viewer planning to do once
> > Oracle JDK 8 / JavaFX go EOL in January 2019?
> >
[...]
> > Ideally, I'd like to find a Linux replacement for STIG
> > Viewer—something that can read, annotate, and write STIG Viewer
> > checklist (*.ckl) files. But although SCAP Workbench can load and
> > check STIGs, unless I'm missing something, it has no support for STIG
> > Viewer checklist files.
>
> Not being snide, should this come across wrongly.... genuine question:
> Why use STIG Viewer in the first place?
>
The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want.
V/r,
James Cassell
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
4 years, 6 months
RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL
in January 2019?
by Brent Kimberley
No disrespect intended. That’s exactly what I would do under the circumstances.
From: Brent Kimberley
Sent: Wednesday, November 28, 2018 11:36 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
That speaks volumes.
http://www.crosstalkonline.org/back-issues/
From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com]
Sent: Wednesday, November 28, 2018 11:31 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
Brent, that may be the funniest message I've ever read.
There isn't one, I just reverse engineered it from the pseudo-XML that it outputs.
On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca<mailto:Brent.Kimberley@durham.ca>> wrote:
Where can I find the controlled schema / ICD / metadata for the checklist file format?
From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com<mailto:tvaughan@onyxpoint.com>]
Sent: Wednesday, November 28, 2018 9:02 AM
To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
Yep, this is the one.
That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start.
On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com<mailto:simontek@gmail.com>> wrote:
The .ckl issue is the answer to why use. I know not everyone works for gov't entities, but they typically require it, with very little options for other products. Management likes graphs and charts.
On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com<mailto:fedoraproject@cyberpear.com> wrote:
On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote:
>
>
> On 11/27/18 2:06 PM, James Ralston wrote:
> > I apologize if this is a little off-topic for this list, but a
> > question: what are others who use STIG Viewer planning to do once
> > Oracle JDK 8 / JavaFX go EOL in January 2019?
> >
[...]
> > Ideally, I'd like to find a Linux replacement for STIG
> > Viewer—something that can read, annotate, and write STIG Viewer
> > checklist (*.ckl) files. But although SCAP Workbench can load and
> > check STIGs, unless I'm missing something, it has no support for STIG
> > Viewer checklist files.
>
> Not being snide, should this come across wrongly.... genuine question:
> Why use STIG Viewer in the first place?
>
The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want.
V/r,
James Cassell
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
4 years, 6 months
Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL
in January 2019?
by Trevor Vaughan
Brent, that may be the funniest message I've ever read.
There isn't one, I just reverse engineered it from the pseudo-XML that it
outputs.
On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca>
wrote:
> Where can I find the controlled schema / ICD / metadata for the checklist
> file format?
>
>
>
> *From:* Trevor Vaughan [mailto:tvaughan@onyxpoint.com]
> *Sent:* Wednesday, November 28, 2018 9:02 AM
> *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org>
> *Subject:* Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8
> is EOL in January 2019?
>
>
>
> Yep, this is the one.
>
>
>
> That said, if you dig through the archives of this mailing list, I figured
> out how to create the bare minimum .ckl file that you need for reporting so
> that should give people a head start.
>
>
>
> On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com> wrote:
>
> The .ckl issue is the answer to why use. I know not everyone works for
> gov't entities, but they typically require it, with very little options for
> other products. Management likes graphs and charts.
>
>
>
> On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com
> wrote:
>
> On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote:
> >
> >
> > On 11/27/18 2:06 PM, James Ralston wrote:
> > > I apologize if this is a little off-topic for this list, but a
> > > question: what are others who use STIG Viewer planning to do once
> > > Oracle JDK 8 / JavaFX go EOL in January 2019?
> > >
> [...]
> > > Ideally, I'd like to find a Linux replacement for STIG
> > > Viewer—something that can read, annotate, and write STIG Viewer
> > > checklist (*.ckl) files. But although SCAP Workbench can load and
> > > check STIGs, unless I'm missing something, it has no support for STIG
> > > Viewer checklist files.
> >
> > Not being snide, should this come across wrongly.... genuine question:
> > Why use STIG Viewer in the first place?
> >
>
> The STIG Viewer produces *.ckl checklist files, which some auditors and
> many security departments want.
>
> V/r,
> James Cassell
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
>
>
> --
>
> Trevor Vaughan
> Vice President, Onyx Point, Inc
>
> (410) 541-6699 x788
>
>
> -- This account not approved for unencrypted proprietary information --
> THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY
> CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR
> EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to
> any privilege have been waived. If you are not the intended recipient, you
> are hereby notified that any review, re-transmission, dissemination,
> distribution, copying, conversion to hard copy, taking of action in
> reliance on or other use of this communication is strictly prohibited. If
> you are not the intended recipient and have received this message in error,
> please notify me by return e-mail and delete or destroy all copies of this
> message.
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
4 years, 6 months
alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in
January 2019?
by James Ralston
I apologize if this is a little off-topic for this list, but a
question: what are others who use STIG Viewer planning to do once
Oracle JDK 8 / JavaFX go EOL in January 2019?
Any Oracle Java 8 security updates released after January 2019 will
require a commercial support license from Oracle:
https://developers.redhat.com/blog/2018/11/05/migrating-from-oracle-jdk-t...
STIG Viewer requires Oracle JDK 8 and JavaFX 8 in order to function.
Oracle JDK 11 is the next LTS (long term support) version of Java.
(Java 9 and Java 10 are not LTS releases, and are already EOL.) But
in Java 11, Oracle removed JavaFX:
https://www.infoworld.com/article/3305073/java/removed-from-jdk-11-javafx...
The OpenJFX project provides a JavaFX 11 implementation that works
with OpenJDK 11:
https://openjfx.io/
But: I tested the latest STIG Viewer (version 2.8) with OpenJDK 11 /
OpenJFX 11, and it does not work; it simply crashes at startup.
This will shortly place all STIG Viewer users in the situation where
they must purchase a commercial support contract from Oracle in order
to run STIG Viewer, because STIG Viewer requires outdated / EOL
technology.
I asked DISA/IASE what their intentions were with STIG Viewer in light
of this. As of 2018-11-27, this was their response:
> There are currently no plans on creating a non-Oracle java version
> of STIG Viewer at this time. We also have no information regarding
> how DoD will be addressing the licensing requirement for Oracle java
> going forward.
So.
Ideally, I'd like to find a Linux replacement for STIG
Viewer—something that can read, annotate, and write STIG Viewer
checklist (*.ckl) files. But although SCAP Workbench can load and
check STIGs, unless I'm missing something, it has no support for STIG
Viewer checklist files.
I can't be the only person in this boat. What are others doing?
4 years, 6 months
Audit 3.0 and SCAP rule "Encrypt Audit Records Sent With audispd
Plugin"
by Jan Cerny
Hi,
We have a rule 'Encrypt Audit Records Sent With audispd Plugin' [1].
It checks that enable_krb5 = yes is set in /etc/audisp/audisp-remote.conf.
We have found that it doesn't work anymore on Fedora 29 and RHEL 8.
I have found that the audisp-remote.conf has moved to /etc/audit and
that "enable_krb5 = yes" option has been superseded by "transport = KRB5".
I have created a patch [2] that fixes the rule, OVAL, etc.
However, it turned out that 'transport' option can be set also in
/etc/audit/auditd.conf. It's not clear to me if we should check
/etc/audisp/audisp-remote.conf or /etc/audit/auditd.conf or both.
Which of the 2 configuration files is correct to configure authentication
and encryption for remote logging? Does each of the files mean a different thing?
Thank you.
Regards
[1] https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/sy...
[2] https://github.com/ComplianceAsCode/content/pull/3619
Jan Černý
Security Technologies | Red Hat, Inc.
4 years, 6 months