On 12/17/2013 05:33 AM, Jan Lieskovsky wrote:
  in relation with applying sshd remediations, wondering if
the fix should enforce restart of sshd (include command ensuring it).

Yes, if the service must be restarted to assert the desired posture. One reason for this is that the compliance check may not (typically does not) compare the creation time of the service process(es) with the modification time of the service configuration(s) to ensure that the desired configuration has been adopted. This applies to "services" other than daemons. In general, if a configuration is changed, the system should be instructed to adopt the altered configuration (but not necessarily during the application of the remediation).

No, if it does not require restart (e.g., firewalld).

While the subject question implies a change, idempotency of remediations has not much been discussed. Perhaps it should be discussed, including whether a remediation procedure that finds no remediation is required (because the system already has the desired posture) does not perturb the system. Such idempotency would of course potentially be at odds with XCCDF <fix> attribute assertions.

Regards,

Gary