+1

EVERYONE wants to modify at least one rule. It needs to be easy to do so and run your own checks else people will just start writing other tools.

Trevor


On Sat, Oct 5, 2013 at 7:57 AM, Brian Millett <bmillett@gmail.com> wrote:
On Fri, 04 Oct 2013 08:50:23 -0400
fcaviggi@redhat.com wrote:

> I was thinking this trough last night - I was wondering if we can use
> checksums (sha256+) to determine if someone is using the "stock"
> configuration and replace it with a fully STIGed version - I'm thinking this
> would be best applicable to new installations of RHEL. I understand the need
> for  atomic fixes for pre-existing systems, where the SA has modified the
> defaults, but I can guarantee you that most people just want a STIG'ed box
> out of the gate on install. I'm just trying to think in terms of long term
> and short term goals - the quicker we can satisfy the majority of the users
> (the ones that want something STIG'ed out of the box) the better acceptance
> the product will have, the long term should be to modify things for the
> people that mucked with their configurations, which I'm arguing is a
> minority.

Well, not really.  I've set up ssg for several clients and not a single one
wants to use it as is, they have all different requirements.  Some need a
different banner, some different password parameters, some different ssh,
etc.  All I'm saying is my experience is that most want to modify.

--
Brian Millett
"The guerrillas, whose ancestors migrated to Mars from Earth over the past
 hundred years, have demanded independence for the Mars Colony or, and I
 quote, 'The sand will run red with Earther blood.'"
   -- [ Derek Mobotabwe, ISN News, "A Voice in the Wilderness I"]
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --