No objections, please go for it.
The "How to make XCCDF/OVAL" wiki pages are a bit out of date; the OVAL,
in particular, does not mention the templates/ directory which is used
to make a lot of the checks. Adding in expectations is also a great
idea. (We generally expect soundness but not necessarily completeness,
which is itself difficult to define.)
If there's concern about the level of completeness of research about
security-relevant settings for a particular service (and it be
sound-but-not-necessarily-complete), making another ticket for further
research is always a good idea.
On 03/16/2012 11:00 PM, Kevin Spargur wrote:
These are some great points. Any objection to modifying the wiki to
incorporate them?
-Kevin
On 03/16/2012 04:27 PM, Jeffrey Blank wrote:
> Wow, that's a great list. However, I am (slightly) worried about high
> speed copy-paste from the RHEL 5 SNAC guide into the project.
>
> A few quick notes:
>
> 1)
> If a section seems to have been completed previously (by me) but
> something is oddly missing, ask. There may be reasons some things were
> not moved.
>
> 2)
> If there is a section in the SNAC guide that is instructive but which
> cannot possibly have an OVAL check (such as for BIOS settings), just
> put the information into an XCCDF Group. Later, we can create OCIL
> content to handle things that will absolutely require manual
> inspection (or relate to policy/procedures).
>
> Similarly, if a section has discussed doing something that is
> necessary/relevant but on its own is really a configuration action
> (and not a security setting), such as installing some network service,
> this should be in an XCCDF Group and not a Rule. Rules are only for
> compliance checking. For example, I don't think we need to verify that
> httpd is installed, even if a system is being evaluated against a web
> server profile (and please let's save the "value of checking for
> packaged vs unpackaged software" discussion for another time).
>
> 3)
> In general, please try to perform a positive and negative test for
> each item. I'd really appreciate one round of QA prior to a commit/push.
>
> 4)
> Feel free to reorganize if you can improve on the original logical
> structure (but ask the list if it's significant).
>
> And of course, everything's negotiable. But these were some of my
> personal guidelines when committing content earlier, and I think they
> will serve us well.
>
> Jeff
>
>
>
> On 03/15/2012 10:01 AM, Kevin Spargur wrote:
>> Hey all,
>>
>> I've done a quick review of the SSG as far as were we stand in
>> comparison milestone 1 objectives. We are missing roughly 195/634 or
>> about 31% of the line items needed to meet milestone 1. The exact line
>> items missing are specified in the attached. I've opened tickets for
>> each piece up on the SSG site
>> (
https://fedorahosted.org/scap-security-guide/report/2). If your working
>> on a section it would be great if you took the ticket so we can try and
>> avoid duplication of effort where possible.
>>
>> Thanks,
>>
>> Kevin Spargur
>>
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide(a)lists.fedorahosted.org
>>
https://fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide
--
___________________________
Jeffrey Blank
410-854-8675
Global Mitigations
NSA Information Assurance