On 06/27/2012 06:27 PM, Shawn Wells wrote:
On 6/27/12 6:18 PM, Willy Santos wrote:
Signed-off-by: Willy Santos <wsantos@redhat.com>
 rhel6/src/input/auxiliary/srg_support.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
index 6167107..5e295dc 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
 It is unclear how to satisfy this requirement.
-<ref disa="20,31,218,219,224,386,1092" />
+<ref disa="20,31,218,219,224,386,1092,1097" />
 </Group> <!-- end unmet_impractical_product -->
 <Group id="new_rule_needed">

SRG-OS-000074 CCI-000197 The operating system must enforce password encryption for transmission. Passwords need to be protected at all times and encryption is the standard method for protecting passwords during transmission to ensure unauthorized users/processes do not gain access to them.
Configure OpenSSH Server if Necessary If the system needs to act as an SSH server, then certain changes should be made to the OpenSSH daemon configuration file /etc/ssh/sshd_config. The following recommendations can be applied to this file. See the sshd_config(5) man page for more detailed information.

I'm interpreting that as we must enforce password encryption for operating system passwords, which the use of SSH would do for us.

scap-security-guide mailing list

That is the way I'm looking at it. I can always add SSL/TLS to address webapp logins.