This is fine -- please push. The more profiles, the better.
Two issues (that should not delay your push):
1)
Some of the Rules you're referencing should be completely reworked as
they were never meant to say a very specific thing and were instead a
translation of some prose guidance. But this helps shed light on that
fact. Some of them should simply be Groups (such as the SSL sections)
since they are not meaningful as compliance checks.
2)
I believe some of Rules could yet be automated, such as:
world_writable_files_system_ownership,
no_uidzero_except_root,
enable_gdm_login_banner
and many of the ldap server configuration items, once that section is
completely reworked in the style of compliance checking (surrounding by
helpful guidance/info) versus howto style.
On 08/14/2012 04:48 PM, Michael Palmiotto wrote:
Here are two potential profiles for manual actions on SCAP content.
They separately address manual audits and manual remediation (with overlap).
They are included in one patch, as they provide a solution to SCAP's
lack of coverage for audit and remediation.
I understand if these profiles are not adopted, but just to give an idea
of the scope of this (and as requested), I thought a patch would be
appreciated.
Feel free to provide input, as I'm sure there's something I missed.
---
RHEL6/input/profiles/manual_audits.xml | 40 +++++++++++++++++++++++++++
RHEL6/input/profiles/manual_remediation.xml | 32 +++++++++++++++++++++
2 files changed, 72 insertions(+), 0 deletions(-)
create mode 100755 RHEL6/input/profiles/manual_audits.xml
create mode 100755 RHEL6/input/profiles/manual_remediation.xml
diff --git a/RHEL6/input/profiles/manual_audits.xml
b/RHEL6/input/profiles/manual_audits.xml
new file mode 100755
index 0000000..005bcd9
--- /dev/null
+++ b/RHEL6/input/profiles/manual_audits.xml
@@ -0,0 +1,40 @@
+<Profile id="manual_audits"
xmlns="http://checklists.nist.gov/xccdf/1.1" >
+<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
+<description>This profile contains items that require user interaction during
audit.</description>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_uidzero_except_root" selected="true"/>
+<select idref="postfix_create_cert" selected="true"/>
+<select idref="postfix_install_ssl_cert" selected="true"/>
+<select idref="network_ssl_create_ca" selected="true" />
+<select idref="network_ssl_create_ssl_certs" selected="true"
/>
+<select idref="network_ssl_create_ssl_certs" selected="true"
/>
+<select idref="network_ssl_enable_client_support"
selected="true"/>
+<select idref="network_ssl_add_ca_firefox" selected="true"/>
+<select idref="network_ssl_add_ca_thunderbird"
selected="true"/>
+<select idref="network_ssl_add_ca_evolution"
selected="true"/>
+<select idref="network_ssl_remove_certs" selected="true"/>
+<select idref="network_ipv6_static_address" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="enable_gdm_login_banner" selected="true"/>
+<select idref="aide_build_database" selected="true"/>
+<select idref="wireless_disable_in_bios" selected="true"/>
+<select idref="deactivate_wireless_interfaces"
selected="true"/>
+<select idref="iptables_log_and_drop_suspicious"
selected="true"/>
+<select idref="network_ipv6_default_gateway"
selected="true"/>
+<select idref="no_files_unowned_by_user" selected="true"/>
+<select idref="no_files_unowned_by_group" selected="true"/>
+<select idref="world_writable_files_system_ownership"
selected="true"/>
+<select idref="aide_verify_integrity-manually"
selected="true"/>
+<select idref="ldap_server_config_olcsuffix"
selected="true"/>
+<select idref="ldap_server_config_olcrootpw"
selected="true"/>
+<select idref="ldap_server_config_olcaccess"
selected="true"/>
+<select idref="iptables_ldap_enabled" selected="true"/>
+<select idref="ldap_server_config_certificate_files"
selected="true"/>
+<select idref="ldap_server_config_directory_domain"
selected="true"/>
+<select idref="ldap_server_config_directory_users_groups"
selected="true"/>
+<select idref="ldap_server_config_directory_accounts"
selected="true"/>
+<select idref="ldap_server_config_directory_groups"
selected="true"/>
+<select idref="ldap_server_config_directory_admin_group"
selected="true"/>
+</Profile>
diff --git a/RHEL6/input/profiles/manual_remediation.xml
b/RHEL6/input/profiles/manual_remediation.xml
new file mode 100755
index 0000000..84a8fe7
--- /dev/null
+++ b/RHEL6/input/profiles/manual_remediation.xml
@@ -0,0 +1,32 @@
+<Profile id="manual_audits"
xmlns="http://checklists.nist.gov/xccdf/1.1" >
+<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
+<description>This profile contains items that require user interaction during
audit.</description>
+<select idref="install_aide" selected="true"/>
+<select idref="install_vsftpd" selected="true"/>
+<select idref="install_openswan" selected="true"/>
+<select idref="install_vlock_package" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="bootloader_password" selected="true"/>
+<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
+<select idref="disable_dhcp_client" selected="true"/>
+<select idref="enable_gdm_login_banner" selected="true"/>
+<select idref="set_gdm_login_banner_text" selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_uidzero_except_root" selected="true"/>
+<select idref="postfix_create_cert" selected="true"/>
+<select idref="postfix_install_ssl_cert" selected="true"/>
+<select idref="postfix_seperate_internal_external"
selected="true"/>
+<select idref="network_ipv6_static_address" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="enable_gdm_login_banner" selected="true"/>
+<select idref="aide_build_database" selected="true"/>
+<select idref="wireless_disable_in_bios" selected="true"/>
+<select idref="deactivate_wireless_interfaces"
selected="true"/>
+<select idref="iptables_log_and_drop_suspicious"
selected="true"/>
+<select idref="network_ipv6_default_gateway"
selected="true"/>
+<select idref="no_files_unowned_by_user" selected="true"/>
+<select idref="no_files_unowned_by_group" selected="true"/>
+<select idref="world_writable_files_system_ownership"
selected="true"/>
+<select idref="aide_verify_integrity-manually"
selected="true"/>
+<select idref="iptables_ldap_enabled" selected="true"/>
+</Profile>