On 2/4/13 12:48 PM, Jeffrey Blank wrote:
> >The crontab files themselves are user generated, they would
not be
> >picked up with RPM verification. There is a section on this within the
> >SSG, however it's been commented out. Over the next few weeks I'll
> >revisit this.
Ah, gotcha, I was thinking of the systemwide ones in /etc/cron*. User
crontabs with incorrect permissions sounds like a contrived concern to
me, but I'll be happy to discuss.
They've been dropped from the RHEL6 STIG candidate, hopefully the
argument will win they should be dropped from USGCB as well. Opened a
ticket to remind us of the conversation when the time is right (e.g.
when conversations begin between RHT Corporate and NIST).
>> >>Hmmm, do we have a transform that creates a table in
line with what's
>> >>called for in NIST SP 800-70 Appendix E, for proper submission, sans
>> >>perhaps the "Impact" column (which lacks a corresponding XCCDF
element).
> >Not yet.... and you have such amazing xslt skills.... hmm... ;)
Sigh, perhaps. Gary and Brian aren't too shabby either :)
When I have a few cycles to spare, I first want to simplify some of the
existing transforms (now that oscap xccdf resolve works) and document
the overall build process better on the Wiki.
Thanks again for the updated USGCB profile!
It's a starting point.
FWIW, over the next two weeks I hope to extend the rhel6-stig-server
into "RHSS2-stig" (e.g., Red Hat Storage aka Gluster).