Typo fixed.
Comprehensive remediation is scary, but it's easy for some items.
Thanks for the link; this is a simple and clever approach to those items.
I did not have concrete plans for including automated remediation
actions directly in scap-security-guide. There was also interest from
others in tying failed checks to other remediation capabilities (such as
Puppet modules).
The short term priorities are to create XCCDF and OVAL that can produce
a prose guide and tables with policy references, as well as provide a
few useful profiles that can be evaluated. (This is a nice reminder to
adjust the roadmap "deadlines".)
That said, having <fix> would require only minor modifications to the
existing XSLT transforms to preserve the currently desired outputs. So
this is doable if there's interest.
On 03/13/2012 03:54 PM, David Egts wrote:
Hi all,
I'm trying out SSG. Great work!
I think I noticed a typo. Search for "veal" here and I think it
should be "eval"...
https://fedorahosted.org/scap-security-guide/
And now on to the question... :-)
Does SSG generate (or plan to generate) remediation content? Check
the very bottom of this page for an example...
http://dev.gentoo.org/~swift/docs/genoval.xml
I tried "generate fix" with the SSG content, but the resulting script
was empty. I guess I'm not sure if I'm doing something wrong, or if
more needs to be added to SSG to provide remediation capabilities.
Thanks!
Dave