On 10/3/13 3:11 PM, fcaviggi(a)redhat.com wrote:
All,
As a starting point for writing remediation fixes in the SSG - so, I
did the following:
$ ls ~/scap-security-guide/RHEL6/input/checks/*.xml | awk '{ print
$1 }' | sed s/\.[^\.]*$// > ~/checks
$ ls ~/scap-security-guide/RHEL6/input/fixes/*.sh | awk '{ print
$1 }' | sed s/\.[^\.]*$// > ~/fixes
$ sdiff ~/fixes ~/checks | less
There's fair a bit of work to be done for the fix remediations...
Since I'm new to the project, I was wondering if there was any ideas
or standards to how the SSG should distribute some of these fixes -
for example - a wholesale replacement of the audit.rules and
auditd.conf might be preferable than doing piecemeal sed's.
It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules
/etc/audit.rules`, and that likely is the right choice during an initial
provisioning process. But then SysAdmins tailor audit rules, the system
evolves, and we need to evaluate the audit.rules file against specific
auditing guidance items after the pristine audit.rules template is
manipulated.
So, if a single rule must be remediated, we can't blow away the whole
audit.rules file. Super fun sed scripts it is =/
I also think the first script that needs to be run is to tar the
current existing configurations (as a backup) before applying any fix
just in case we do something that jacks the users modifications to the
system.
A prevailing thought has been to address backups once the remediations
are finished, as we'll have a better handle for which files will need
addressing.
Forcing the backup (through XCCDF/OVAL) is tricky. One thought has been
to create an OVAL check -- which is listed first in the profile -- which
will *always* fail. The remediation for said OVAL would be to perform
the backups. Anyone have a better idea? =/
Anyway, just trying to get an idea of how to proceed set some goals
for my contributions.
These are /really/ good questions. Thanks for starting the conversation!