----- Original Message -----
From: "Shawn Wells" <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Monday, July 2, 2012 9:37:57 PM
Subject: Re: [PATCH 04/25] Mapped CCI-000804 to unmet_impractical_guidance.
On 7/2/12 8:51 PM, Willy Santos wrote:
CCI-000804 requires uniquely identifying and authenticating non-organizational users. This
is an organization-defined policy (e.g. group membership, identifier appended to username,
etc.) and out of the scope of this guide.
Signed-off-by: Willy Santos <wsantos(a)redhat.com> ---
rhel6/src/input/auxiliary/srg_support.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/rhel6/src/input/auxiliary/srg_support.xml
b/rhel6/src/input/auxiliary/srg_support.xml
index fe2d83e..f5cac5a 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design.
The guidance does not meet this requirement.
The requirement is impractical or out of scope.
</description>
-<ref
disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24"
/>
+<ref
disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,804"
/>
</Group> <!-- end unmet_impractical_guidance -->
<Group id="unmet_impractical_product">
SRG-OS-000121 CCI-000804 The operating system must uniquely identify and must
authenticate non-organizational users (or processes acting on behalf of non-organizational
users). Non-organizational users include all operating system users other than
organizational users which include employees or individuals the organization deems to have
equivalent status of employees (e.g., contractors, guest researchers, individuals from
allied nations). Non-organizational users shall be uniquely identified and authenticated
for all accesses other than those accesses explicitly identified and documented by the
organization when related to the use of anonymous access.
Could we make an argument that this requirement is met by uniquely identifying ALL users
-- organizational or non-organizational -- by assigning them UIDs?
IIRC, this requirement is frequently interpreted as "blue badgers staff are
organizational users, green badgers are non-organizational users. both get unique
identifiers." Through this interpretation could we map to met_inherently?
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide
I would agree with that. We'll discuss it with Jeff today and see where he stands on
it.
-Willy