I was thinking this trough last night - I was wondering if we can
use checksums (sha256+) to determine if someone is using the
"stock" configuration and replace it with a fully STIGed version -
I'm thinking this would be best applicable to new installations of
RHEL. I understand the need for atomic fixes for pre-existing
systems, where the SA has modified the defaults, but I can
guarantee you that most people just want a STIG'ed box out of the
gate on install. I'm just trying to think in terms of long term
and short term goals - the quicker we can satisfy the majority of
the users (the ones that want something STIG'ed out of the box)
the better acceptance the product will have, the long term should
be to modify things for the people that mucked with their
configurations, which I'm arguing is a minority.
I go back to Star Trek II: Wrath of Khan with Spock, "It is
logical. The needs of the many outweigh...the needs of the few...or the one." We need to get
the ship out of danger, and then worry about the needs of the few.
What do you think of my solution?
Something like this?
if rpm -V audit
cp /usr/share/doc/audit-*/stig.rules /etc/audit.rules
else
if audit rule misconfigured
sed fix
else
echo audit_rule >> /etc/audit.rules
fi
fi
I'm not particularly opposed. We'll want to ensure that the
/usr/share/doc/audit-*/stig.rules file meets the STIG/SSG needs (and
if not, submit RFEs). It'd be great if we could template these
somehow.