Welcome! I'm very eager to look at CMITS, but am no longer working for federal government. Do you have plans to make any or all of it available outside of forge.mil?

I left the government to work on a Knight Foundation funded project to create accreditation-ready virtual machines for civic innovators. Our current focus is on developing a toolkit to make OpenSCAP and FISMA easier for civic innovators (people who haven't started the learning curve yet). CMITS sounds in excellent alignment.

Can you share with the list portions of the README that describe the extent to which you lock things down?


Greg Elin
http://govready.org - Making FISMA compliance easier for innovators

email: gregelin@gitmachines.com
phone: 917-304-3488

On Wed, Jul 23, 2014 at 2:52 PM, JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI <jared.jennings.ctr@us.af.mil> wrote:
Hi, I'm Jared Jennings. I work under contract as an admin at the US Air Force SEEK EAGLE Office (AFSEO). Engineers here deal with the problem of aircraft-store compatibility, where "store" means "something you put on the aircraft," like a missile, bomb or fuel tank. There's lots of modelling and simulation going on here, on Windows, Linux and Mac workstations, and Linux HPC clusters. I make the Linux and Mac stuff compliant with STIGs, and document the compliance.

So I've built CMITS (Configuration Management for IT Systems), out of Puppet, LaTeX and Python. Folks with DoD certificates can check it out from <https://software.forge.mil/svn/repos/dodpuppet/cmits-release>. Besides configuring RHEL5, RHEL6 and Snow Leopard hosts, it builds documentation that answers the questions, "Do we have everything covered? How are we complying with requirement X? Why are we not complying with requirement Y? Requirement Z says something should be written down; where is it?"

Now, RHEL7 is out. Dave and Gunnar have been going on about it for months <http://dgshow.org/>. I want to run it. But I need a STIG to comply with. And here is a community where I can help build such a thing. Hello, community!

 -- Jared Jennings, RHCE, Network Administrator, SURVICE Engineering Co.

SCAP Security Guide mailing list