On 6/27/12 6:18 PM, Willy Santos wrote:
> Signed-off-by: Willy Santos<wsantos(a)redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml
b/rhel6/src/input/auxiliary/srg_support.xml
> index 6167107..5e295dc 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
> <description>
> It is unclear how to satisfy this requirement.
> </description>
> -<ref disa="20,31,218,219,224,386,1092" />
> +<ref disa="20,31,218,219,224,386,1092,1097" />
> </Group> <!-- end unmet_impractical_product -->
>
> <Group id="new_rule_needed">
SRG-OS-000074 CCI-000197 The operating system must enforce password
encryption for transmission. Passwords need to be protected at all
times and encryption is the standard method for protecting passwords
during transmission to ensure unauthorized users/processes do not gain
access to them.
Configure OpenSSH Server if Necessary If the system needs to act as
an SSH server, then certain changes should be made to the OpenSSH
daemon configuration file|/etc/ssh/sshd_config|. The following
recommendations can be applied to this file. See
the|sshd_config(5)|man page for more detailed information.
I'm interpreting that as we must enforce password encryption for
/operating system/ passwords, which the use of SSH would do for us.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide
That is the way I'm looking at it. I can always add SSL/TLS to address
webapp logins.
-Willy