A number of the CCI's state the system shall "support the capability
to...", such as "shall have the capability to centralize audit records"
in CCI-000154.
To ensure we support this capability we need to ensure a certain amount
of packages are installed (in this case, audit). I'd like to generate a
set of required/recommended packages for a base installation that SSG
needs. For example, iptables and audit would be on the top of the list.
We've tap danced around the idea of creating a recommended minimum
packages before, however now there seems to be a pressing requirement to
do so. What are everyone's thoughts on this? I've long been for it.
Note we shouldn't say "install *_only_* these packages," but rather
"you'll need MINIMALLY these packages to secure your system"