Hello all, Just in time for the holidays, I figured I'd ask an end-of-the-year naïve question. What are people doing if older RHEL4 based systems are in production and need to be locked-down? Use the SRR (even though retired), the RHEL5 guidelines (understanding that 'things work different'), hope and pray?
-Rob
The methodology I have seen is that current standards are applied to older or EOL installations, so the RHEL 5 STIG would be used to manually to verify compliance. This is definitely not a standard from DISA, as test plans are dictated by the individual CA / DAA on a case by case basis.
Vince
________________________________________ From: scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on behalf of Robert Sanders [rsanders@TrustedCS.com] Sent: Wednesday, December 19, 2012 6:51 AM To: scap-security-guide@lists.fedorahosted.org Subject: Legacy RHEL systems and SRR/SCAP
Hello all, Just in time for the holidays, I figured I'd ask an end-of-the-year naïve question. What are people doing if older RHEL4 based systems are in production and need to be locked-down? Use the SRR (even though retired), the RHEL5 guidelines (understanding that 'things work different'), hope and pray?
-Rob _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 12/19/12 9:51 AM, Robert Sanders wrote:
Hello all, Just in time for the holidays, I figured I'd ask an end-of-the-year naïve question. What are people doing if older RHEL4 based systems are in production and need to be locked-down? Use the SRR (even though retired), the RHEL5 guidelines (understanding that 'things work different'), hope and pray?
Attached is a (now incredibly old) kickstart for RHEL4 that you might have luck pulling from. I haven't used it in years..... "Last Modified" on my system at 2-NOV-2007! In general people seemed to write security scripts directly against the DCID 6/3 settings their C&A folks told them to meet, which was the approach we took when creating the attached kickstart.
scap-security-guide@lists.fedorahosted.org
-
Robert Sanders -
Shawn Wells -
Vincent Passaro