On 9/2/13 10:45 PM, Jeffrey Blank wrote:
This is not quite a practical strategy for us. We will recommend
(and
even write some Rules for removal of) some software which presents an
attack surface such as network services, but scope explodes if we
seriously attempt to configure all potentially installed software.
On Wed, Aug 28, 2013 at 12:57 PM, Hopkins, Robert J CTR BXPP, BXPP
<robert.j.hopkins1.ctr(a)navy.mil> wrote:
> >I'm not sure about the OSCAP results but if X is installed then you should
secure it. Someone could accidentally set run level 5 or just do a startx and fire it up
means any vulnerabilities and/or weaknesses would then be exposed. If X is not installed,
you can probably mark it N/A.
> >
This loops back to "should servers have desktops installed?" questions.
For current content, the answer is no... however if someone cares enough
about X/GNOME/Desktop content and is willing to create & maintain the
XCCDF and OVAL, patches welcome