But the logic does extend out to the services. Checks already exist to determine whether
or not most of the services are installed. Toss some AND's in there and you can
reduce profiles to just being security control based rather than application profiles for
each control set. Except for a few contentious items there really would not be a lot of
overlap
-Kevin
On May 21, 2012, at 5:37 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil> wrote:
This is all dependent on what Profile you want to evaluate against,
which depends on the network role of the system.
The specific inquiry from Joe relates to LDAP client support, which may
be expected in a general purpose system (but is not required).
On 05/21/2012 05:33 PM, Kevin Spargur wrote:
> That's definitely a better way to go, but down that road what purpose
> does a http or FTP profile serve?
>
> -Kevin
>
>
>
>
>
> On May 21, 2012, at 5:23 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil>
> wrote:
>
>> When conducting this kind of check, the application should be
>> installed/active (or the system should be configured to use the
>> service) -- and the test should pass if it's not.
>>
>> We do not want to make changes to files to satisfy tests that would
>> be, in context, bogus.
>>
>> As examples, see some check against services (such as
>> service_cupsd_disabled.xml) which pass if the package is not even
>> installed. These make use of extend_definition to call another,
>> existing definition which checks to see if a package is installed
>> first. (In general, these other definitions exists because there a
>> check exists against the installation of this package, on its own).
>> (That said, I'd prefer not to create a definition unless it's also
>> usable on its own, or has 2 referrers.)
>>
>> In general, I'd just make use of "and"-ing criteria to pass checks
>> if the check is irrelevant in context.
>>
>>
>>
>> On 05/20/2012 03:11 PM, Joe Nall wrote:
>>> There are a number of checks like ldap_client_tls_checkpeer that
>>> look for a string or value in a file that are not sensitive to
>>> whether the relevant application is installed. What is the
>>> preferred way to deal with this problem? I would prefer not to
>>> create unused config files just to make a bogus test happy.
>>>
>>> Is there a good example in the code of how to test for
>>> installation then configuration?
>>>
>>> I know I can profile my way around this, but down that path is
>>> failures to identify issues when a package is added to a system
>>> under management.
>>>
>>> joe
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide(a)lists.fedorahosted.org
>>>
https://fedorahosted.org/mailman/listinfo/scap-security-guide
>> _______________________________________________ scap-security-guide
>> mailing list scap-security-guide(a)lists.fedorahosted.org
>>
https://fedorahosted.org/mailman/listinfo/scap-security-guide
>
> _______________________________________________ scap-security-guide
> mailing list scap-security-guide(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide