On 7/21/17 2:06 PM, Chuck Atkins wrote:
Hi Shawn,

Wow, so this whole thread really took on a life of it's own, far outside the scope of my original intent.  So to try to bring it back...

But it's a good thread!

(and very representative of open source conversations, which is awesome)

 
The profile split started when ...

Thanks for the background info, it helps to understand why things are the way they are.


If having DISA release updated content is important to you ...

Not specifically, that just makes it easier since the auditors know the DISA STIG and that what they ask about.  So long as I have a good profile with sound security practices that I can justify to my ODAA auditor then I'm satisfied.  The OSPP profile should fit that purpose well and if I explain it to auditors, I'm 70-80% confident I can get them on board with it.

SSG content contains metadata that maps every configuration check to corresponding policy. Maybe sharing those policy mapping tables will help boost confidence?

Here's one for NIST 800-171 (Controlled Unclassified):
http://people.redhat.com/swells/scap-security-guide/tables/table-rhel7-cuirefs.html

And another mapping checks back to DISA OS SRG (aka their STIG stuff):
http://people.redhat.com/swells/scap-security-guide/tables/table-rhel7-srgmap.html

And another back to NIST 800-53:
http://people.redhat.com/swells/scap-security-guide/tables/table-rhel7-nistrefs-ospp-rhel7.html

The reports can also be sorted by the policy mappings. Here's a sample report from the 800-171 profile:
http://people.redhat.com/swells/cui-sample-report.html

Under the "Rule Overview" you'll see a drop down called "Group Rules by". Select the NIST 800-53 drop down and you'll see the report re-styled like this:




My main point was that having distinctly separate Workstation and Server profiles was very helpful, so I was a bit worried when they went away.  If I understand you correctly, the OSPP / USGCB profile for EL7 is out-of-the-box intended for a desktop configuration? 
That's a fair statement. The profile is intended for attesting bare metal/virtual/containers, desktop or server. The configuration checks, such as those for GNOME, will only run if GNOME is actually installed.

Here are the dconf/GNOME control selections in case you're curious:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/7/input/profiles/ospp-rhel7.xml#L488#L515

Aside from removing X, is there any difference between the OSPP profile and where a "server" profile would start from?  Obviously, you'd want to go through and enable the services that the server is to host and their respective configurations.  Is that all or are there other core settings that should change?
Skimming quickly through the profile, I think the "must remove X11" rule was dropped. Instead, it's more of "if X11 or GNOME is installed, we verify the following settings."

Most system settings check if they're applicable before attesting them. AKA the SSH checks won't run unless SSH is installed (lookin' at you, Trevor Vaughan).