Cleanup of the directory structure
by Matej Tyc
Dear ComplianceAsCode community,
the project is thriving, so there are many pull requests open at the
same time, and it is easy to miss the big ones - such as
https://github.com/ComplianceAsCode/content/pull/7018 that aims to move
products to a separate directory.
The benefit of this PR is a cleanup of the project structure and less
disruption when a new project is added, but it is not without issues, as
it disrupts git history and it can cause issues if you maintain your
custom set of patches. Anyway, please let us know what you think in the
respective PR discussion!
2 years, 4 months
RHEL 8 Security Guide
by MyNicePC
Hello,
I just installed Openscap Workbench on my laptop. I have apways been able
to scan RHEL 6 and RHEL 7 servers using security guides provided within
OpenScap. Does anyone know if you support a security guide for RHEL 8?
Thank you,
JR
2 years, 4 months
Stabilization of v0.1.56
by Vojtech Polasek
Hello all,
*Release of Content version 0.1.56 is scheduled for May 21st*, so I've
created a stabilization branch for it.
Now it is a good time to hunt for bugs and propose fixes for them.
Starting today, merged Pull Requests should be assigned to milestone 0.1.57.
Bug fixes should be proposed to master and labeled "bugfix", they will
be cherry-picked to the stabilization branch.
The next release 0.1.57 will happen on July 23rd. Stabilization phase
will start on July 12th.
Best regards,
--
Vojtech Polasek
Software engineer, security compliance
Red Hat <https://www.redhat.com>
vpolasek(a)redhat.com <mailto:vpolasek@redhat.com>
<https://www.redhat.com>
2 years, 4 months
RHEL7 STIG on Local Interactive Users
by Parker, Ryan
Hello,
I have been working on automating some of the manual items within the RHEL7 STIG that are not covered by the DISA-provided SCAP benchmark nor are they covered by OpenSCAP content. Specifically, I have been working on automating the items that pertain to what the STIG describes as "local interactive users." A significant portion of these items use specific commands referencing /etc/passwd to check the home directory assignment for all local interactive users.
For example, in the Check Text section of RHEL-07-020620 (All local interactive users must have a home directory assigned and defined in the /etc/passwd file):
awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd
However, nearly all of the RHEL7 systems that I support are joined to an Active Directory domain using realmd and SSSD. Therefore, the above check command does not work out-of-the-box for AD-authenticated users since none of them have an entry in /etc/passwd.
Therefore, I wanted to discuss what others have done for these STIG items and to bring up the subject of what constitutes as a "local interactive user," or at least what DISA is defining such user as. I presume local interactive users would mean root and various service accounts, but I am unsure if this is what DISA is targeting.
V/r,
Ryan Parker
Research Scientist I
GTRI | ISD - Secure Computing Department
w: 404-407-7320
e: ryan.parker(a)gtri.gatech.edu<mailto:ryan.parker@gtri.gatech.edu><mailto:Ryan.Parker@gtri.gatech.edu>
2 years, 5 months