On 10/4/13 8:50 AM, fcaviggi(a)redhat.com wrote:
I was thinking this trough last night - I was wondering if we can use
checksums (sha256+) to determine if someone is using the "stock"
configuration and replace it with a fully STIGed version - I'm
thinking this would be best applicable to new installations of RHEL. I
understand the need for atomic fixes for pre-existing systems, where
the SA has modified the defaults, but I can guarantee you that most
people just want a STIG'ed box out of the gate on install. I'm just
trying to think in terms of long term and short term goals - the
quicker we can satisfy the majority of the users (the ones that want
something STIG'ed out of the box) the better acceptance the product
will have, the long term should be to modify things for the people
that mucked with their configurations, which I'm arguing is a minority.
I go back to Star Trek II: Wrath of Khan with Spock, "It is logical.
The needs of the many
outweigh<http://www.imdb.com/name/nm0000638/?ref_=tt_trv_qu>...the
needs of the
few<http://www.imdb.com/name/nm0000559/?ref_=tt_trv_qu>...or the
one." We need to get the ship out of danger, and then worry about the
needs of the few.
What do you think of my solution?
Something like this?
if rpm -V audit
cp /usr/share/doc/audit-*/stig.rules /etc/audit.rules
else
if audit rule misconfigured
sed fix
else
echo audit_rule >> /etc/audit.rules
fi
fi
I'm not particularly opposed. We'll want to ensure that the
/usr/share/doc/audit-*/stig.rules file meets the STIG/SSG needs (and if
not, submit RFEs). It'd be great if we could template these somehow.