On 03/16/2012 10:49 AM, Michael Palmiotto wrote:
> From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on>behalf of Kevin Spargur
[kspargur(a)redhat.com]
> Sent: Thursday, March 15, 2012 10:01 AM
> To: scap-security-guide(a)lists.fedorahosted.org
> Subject: SSG M1 Objectives
>
> Hey all,
>
> I've done a quick review of the SSG as far as were we stand in
> comparison milestone 1 objectives. We are missing roughly 195/634 or
> about 31% of the line items needed to meet milestone 1. The exact line
> items missing are specified in the attached. I've opened tickets for
> each piece up on the SSG site
> (
https://fedorahosted.org/scap-security-guide/report/2). If your
> working on a section it would be great if you took the ticket so we can
> try and avoid duplication of effort where possible.
>
> Thanks,
>
> Kevin Spargur
I'm working on some of the Incomplete Guidance tickets (#40, #23, 26),
and I just wanted to verify that I've got a handle on what needs to be done.
Correct me if there's something I'm missing.
It looks like if we want to achieve the "prose guide, with desktop and server
profiles
and content" milestones, content needs to be added to a couple of places:
1) The prose and rationale need to be added to rhel6/src/input/services or
rhel6/src/input/system, depending upon what's being addressed.
Yes, this meets
the M1.1 objective to have a "human-readable prose
guide, with level of completeness and quality similar to the NSA SNAC
RHEL 5 guide" as well as the M1.3 objective to have rationale for all
rules in the desktop and server profiles.
2) A check xml needs to be added to rhel6/src/input/checks, with the id matching
the file name.
Per the M1.2 objective we need associated SCAP content (selected by
XCCDF profiles, and fully automated with OVAL) for server and desktop
profiles. This raises the question of what specifically should be in
those profiles. In my mind, they should at least have all the system
setting rules as well as obsolete and base services. From there we can
add as appropriate, such as X for desktop, but I think that would
provide a strong base.
3) The proper idref needs to be added to an xml in rhel6/src/input/profiles
When does a new xml file need to be added to rhel6/src/input/profiles/ (as was
done with ftp)?
This ties back into the M1.2 requirement where we need profiles for
server and desktop. Adding the ftp profile is actually beyond the scope
of what is needed for the first milestone. There was discussion about
releasing an alpha when we hit that milestone and the ftp profile
springs from those talks. The alpha release would be significantly more
useful if a few common deployments had profiles available. The
suggestion was made that including ftp and httpd profiles would help to
get more people involved.
-Kevin
--Mike