Classification: UNCLASSIFIED
Caveats: NONE
During the public comment period, should I be sending comments to DISA
regarding the benchmark content (which they didn't include in their download),
or just regarding the prose (e.g. "I would like to see ___ as an acceptable
setting as well as the stated value of ____")?
I have about 67 total checks that are failing (using SCC 3.1...getting
somewhat different results with Open SCAP 0.9.3, which I will have more
details on later). Many of them are false positives (they comply with the
prose, but - IMHO - the benchmark check is getting it wrong). For the others,
I'd like a change in the actual requirement. I just want to make sure I'm
reporting the right things to the right place.
[I also plan to try to "become a developer" and make contributions so I
don't
just feel like I'm complaining, but editing this sort of content is new to
me.]
The benchmark content I'm using is the recently rebased RPM
(scap-security-guide-0.1-10.el6.noarch.rpm).
Thanks,
--
Ray Shaw
Contractor, STG
Unix support, Army Research Labs
Classification: UNCLASSIFIED
Caveats: NONE
Attachments:
- smime.p7s
(application/x-pkcs7-signature — 5.5 KB)