On 10/4/13 8:50 AM, fcaviggi@redhat.com wrote:

I was thinking this trough last night - I was wondering if we can use checksums (sha256+) to determine if someone is using the "stock" configuration and replace it with a fully STIGed version - I'm thinking this would be best applicable to new installations of RHEL. I understand the need for  atomic fixes for pre-existing systems, where the SA has modified the defaults, but I can guarantee you that most people just want a STIG'ed box out of the gate on install. I'm just trying to think in terms of long term and short term goals - the quicker we can satisfy the majority of the users (the ones that want something STIG'ed out of the box) the better acceptance the product will have, the long term should be to modify things for the people that mucked with their configurations, which I'm arguing is a minority.
 
I go back to Star Trek II: Wrath of Khan with Spock, "It is logical. The needs of the many outweigh...the needs of the few...or the one."  We need to get the ship out of danger, and then worry about the needs of the few.

What do you think of my solution?

Something like this?

if rpm -V audit
    cp /usr/share/doc/audit-*/stig.rules /etc/audit.rules
else
    if audit rule misconfigured
        sed fix
    else
        echo audit_rule >> /etc/audit.rules
    fi
fi

I'm not particularly opposed. We'll want to ensure that the /usr/share/doc/audit-*/stig.rules file meets the STIG/SSG needs (and if not, submit RFEs). It'd be great if we could template these somehow.