On Thu, Sep 17, 2015 at 10:33:27 -0400,
Jan Lieskovsky <jlieskov(a)redhat.com> wrote:
Hello Bruno,
thank you for reaching out and checking with us!
Thanks for responding.
This is where further feedback from the Fedora users community (via downstream
bugs or via upstream tickets would be appreciated). For example would we
know there are a lot of tickets requesting support for httpd service scans,
we could prioritize that service before others in that release, etc.
Where this question comes from is at work a number of us use linux desktops
with a mix of Fedora, OpenSUSE and other distros. We also run RHEL on a lot
of severs. The security office would like audits of these machines, mostly
to make sure they are "patched". Though we think config checking would
be more useful as we all are good about keeping our machines up to date.
Their proposal is to provide them with credentials (elevated access rights
may or may not be requested) to allow more detailed scans than they now do.
We aren't too comfortable with opening up machines this way, especially root
access.
I knew about SCAP and did some digging and it seemed like it could be used
to do a better job (than nexpose) for our RHEL boxes. We have plently of
workstation licenses and could standardize on RHEL 7 based workstations and do
centralized scap reporting. However it would be nice to be able to continue
to run Fedora. The SCAP support there doesn't currently check for being up
to date, even without CVE checks. Plus the config checking has a lot less
stuff available. Update checking in Fedora also has problems that RHEL
doesn't, as soname bumps can block some updates, particularly when running
rawhide, branched or updates-testing.
I'll eventually look at using SCAP at home, but for now my main interest
is for work.
Doing CVE checks (vulnerability assessment) and security hardening
are
two different things. In order to perform reliable "CVE checks" we would
need to have authorized and updates source of CVE OVAL definitions for
Fedora.
I expected this to be hard. It is a nice feature of RHEL, but Red Hat
has income from RHEL to pay for people to do that. Getting people to
reliably do that work in Fedora would be hard unless it could be automated
using bohdi and bugzilla data somehow.