Is Augeas an option?
This seems like the perfect opportunity to solidify the Augeas lenses
regarding security settings while making life easier for everyone.
Trevor
On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 10/3/13 3:11 PM, fcaviggi(a)redhat.com wrote:
All,
As a starting point for writing remediation fixes in the SSG - so, I did
the following:
$ ls ~*/scap-security-guide/RHEL6/input/checks/**.xml | awk '{ print
$1 }' | sed s/\.[^\.]*$// > ~/checks
$ ls ~*/scap-security-guide/RHEL6/input/fixes/**.sh | awk '{ print $1
}' | sed s/\.[^\.]*$// > ~/fixes
$ sdiff ~/fixes ~/checks | less
There's fair a bit of work to be done for the fix remediations...
Since I'm new to the project, I was wondering if there was any ideas or
standards to how the SSG should distribute some of these fixes - for
example - a wholesale replacement of the audit.rules and auditd.conf might
be preferable than doing piecemeal sed's.
It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules
/etc/audit.rules`, and that likely is the right choice during an initial
provisioning process. But then SysAdmins tailor audit rules, the system
evolves, and we need to evaluate the audit.rules file against specific
auditing guidance items after the pristine audit.rules template is
manipulated.
So, if a single rule must be remediated, we can't blow away the whole
audit.rules file. Super fun sed scripts it is =/
I also think the first script that needs to be run is to tar the current
existing configurations (as a backup) before applying any fix just in case
we do something that jacks the users modifications to the system.
A prevailing thought has been to address backups once the remediations are
finished, as we'll have a better handle for which files will need
addressing.
Forcing the backup (through XCCDF/OVAL) is tricky. One thought has been to
create an OVAL check -- which is listed first in the profile -- which will
*always* fail. The remediation for said OVAL would be to perform the
backups. Anyone have a better idea? =/
Anyway, just trying to get an idea of how to proceed set some goals for
my contributions.
These are *really* good questions. Thanks for starting the conversation!
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --