The following is a new meeting request:
Subject: SSG Kickoff: RHEL7 Content Organizer: "Shawn Wells" swells@redhat.com
Location: 1-800-451-8679,,,147-852-369-00# Time: Friday, December 13, 2013, 10:30:00 AM - 11:30:00 AM GMT -05:00 US/Canada Eastern
Required: blank@eclipse.ncsc.mil; davsmith.work@gmail.com; leland.j.steinke.ctr@mail.mil Optional: scap-security-guide@lists.fedorahosted.org
*~*~*~*~*~*~*~*~*~*
U.S. Bridge: 1-800-451-8679 Passcode: 147-852-360-00
Full international bridge numbers: https://fedorahosted.org/scap-security-guide/wiki/conferenceline -----------
RHEL7 beta has been released, time to start on SSG content!
Goals of this call: - Quickly overview Red Hat's RHEL7 STIG intent - Identify required steps to port SSG from RHEL6 -> RHEL7 - Form initial work breakdown structure, assign "task leads" - What OVAL standards will be needed? e.g. systemctl vs init, firewalld, etc - RHEL6 STIG community feedback: What worked? What should be dropped?
Historically this kickoff call was held only with RH/NSA/DISA FSO stakeholders. In air of transparency, and part science project, we'll have this as an open call. Community members are VERY welcome to join; either to chirp up & give productive feedback on areas of improvement, volunteer to own a piece of the work (e.g. handling the PAM, filesystem, or some other subcomponent), or perhaps silently listen in on the process.
~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ NOTE: As many community members may join the call, and to avoid the inevitable background noises, ALL LINES WILL DEFAULT TO MUTED. To unmute your line, you will NEED to hit *6.
We'll also idle on #ssg-rhel7 on freenode. ~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
On Thursday, December 12, 2013 04:27:15 PM Shawn Wells wrote:
RHEL7 beta has been released, time to start on SSG content!
Goals of this call:
- Quickly overview Red Hat's RHEL7 STIG intent
- Identify required steps to port SSG from RHEL6 -> RHEL7
- Form initial work breakdown structure, assign "task leads"
- What OVAL standards will be needed? e.g. systemctl vs init, firewalld, etc
- RHEL6 STIG community feedback: What worked? What should be dropped?
Everyone please note...some standards work will be required to get final RHEL7 content. This is because the move to systemd will make runlevel_test obsolete. These tests can be commented out until OVAL 5.11 is final.
-Steve
Hi Shawn, Can we also add to the agenda Remediation? I think this a good time to reflect on some of remediation content and capabilities with SSG moving forward.
Thanks.
-ln
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Steve Grubb Sent: Thursday, December 12, 2013 4:45 PM To: scap-security-guide@lists.fedorahosted.org Cc: Shawn Wells Subject: Re: SSG Kickoff: RHEL7 Content
On Thursday, December 12, 2013 04:27:15 PM Shawn Wells wrote:
RHEL7 beta has been released, time to start on SSG content!
Goals of this call:
- Quickly overview Red Hat's RHEL7 STIG intent
- Identify required steps to port SSG from RHEL6 -> RHEL7
- Form initial work breakdown structure, assign "task leads"
- What OVAL standards will be needed? e.g. systemctl vs init, firewalld, etc
- RHEL6 STIG community feedback: What worked? What should be dropped?
Everyone please note...some standards work will be required to get final RHEL7 content. This is because the move to systemd will make runlevel_test obsolete. These tests can be commented out until OVAL 5.11 is final.
-Steve _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
What is SSG doing for script based remediation that Aqueduct isn't?
Leam
On Fri, Dec 13, 2013 at 7:27 AM, Nunez, Luis K lnunez@mitre.org wrote:
Hi Shawn, Can we also add to the agenda Remediation? I think this a good time to reflect on some of remediation content and capabilities with SSG moving forward.
Thanks.
-ln
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto: scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Steve Grubb Sent: Thursday, December 12, 2013 4:45 PM To: scap-security-guide@lists.fedorahosted.org Cc: Shawn Wells Subject: Re: SSG Kickoff: RHEL7 Content
On Thursday, December 12, 2013 04:27:15 PM Shawn Wells wrote:
RHEL7 beta has been released, time to start on SSG content!
Goals of this call:
- Quickly overview Red Hat's RHEL7 STIG intent
- Identify required steps to port SSG from RHEL6 -> RHEL7
- Form initial work breakdown structure, assign "task leads"
- What OVAL standards will be needed? e.g. systemctl vs init, firewalld,
etc
- RHEL6 STIG community feedback: What worked? What should be dropped?
Everyone please note...some standards work will be required to get final RHEL7 content. This is because the move to systemd will make runlevel_test obsolete. These tests can be commented out until OVAL 5.11 is final.
-Steve _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Hi Leam,
That’s a good question. Something I would also like to know. I am not as familiar with the Aqueduct project and certainly open to leveraging any and all remediation capabilities it offers. My take on the SSG content as it relates to remediation is to hold the authoritative desired state. Meaning XCCDF contains values for a fix tool for remediation. The way I see it bash scripting is one way of doing this. I’d like to see other methods such as puppet and alike to be able to use XCCDF as a source for fix values.
It would be great to build on bash scripting and expand on to other methods.
Thanks.
-ln
From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of leam hall Sent: Friday, December 13, 2013 8:10 AM To: scap-security-guide@lists.fedorahosted.org Subject: Re: SSG Kickoff: RHEL7 Content
What is SSG doing for script based remediation that Aqueduct isn't?
Leam
On Fri, Dec 13, 2013 at 7:27 AM, Nunez, Luis K lnunez@mitre.org wrote:
Hi Shawn, Can we also add to the agenda Remediation? I think this a good time to reflect on some of remediation content and capabilities with SSG moving forward.
Thanks.
-ln
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Steve Grubb Sent: Thursday, December 12, 2013 4:45 PM To: scap-security-guide@lists.fedorahosted.org Cc: Shawn Wells Subject: Re: SSG Kickoff: RHEL7 Content
On Thursday, December 12, 2013 04:27:15 PM Shawn Wells wrote:
RHEL7 beta has been released, time to start on SSG content!
Goals of this call:
- Quickly overview Red Hat's RHEL7 STIG intent
- Identify required steps to port SSG from RHEL6 -> RHEL7
- Form initial work breakdown structure, assign "task leads"
- What OVAL standards will be needed? e.g. systemctl vs init, firewalld, etc
- RHEL6 STIG community feedback: What worked? What should be dropped?
Everyone please note...some standards work will be required to get final RHEL7 content. This is because the move to systemd will make runlevel_test obsolete. These tests can be commented out until OVAL 5.11 is final.
-Steve _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Hey Luis, good morning!
I believe Aqueduct has scripted most all CAT I and CAT II findings based on actual STIG content. We've run the SSG on boxes and I try to report where the SSG does not follow the STIG.
https://git.fedorahosted.org/cgit/aqueduct.git/
Leam
On Fri, Dec 13, 2013 at 8:50 AM, Nunez, Luis K lnunez@mitre.org wrote:
Hi Leam,
That’s a good question. Something I would also like to know. I am not as familiar with the Aqueduct project and certainly open to leveraging any and all remediation capabilities it offers. My take on the SSG content as it relates to remediation is to hold the authoritative desired state. Meaning XCCDF contains values for a fix tool for remediation. The way I see it bash scripting is one way of doing this. I’d like to see other methods such as puppet and alike to be able to use XCCDF as a source for fix values.
It would be great to build on bash scripting and expand on to other methods.
Thanks.
-ln
*From:* scap-security-guide-bounces@lists.fedorahosted.org [mailto: scap-security-guide-bounces@lists.fedorahosted.org] *On Behalf Of *leam hall *Sent:* Friday, December 13, 2013 8:10 AM *To:* scap-security-guide@lists.fedorahosted.org
*Subject:* Re: SSG Kickoff: RHEL7 Content
What is SSG doing for script based remediation that Aqueduct isn't?
Leam
On Fri, Dec 13, 2013 at 7:27 AM, Nunez, Luis K lnunez@mitre.org wrote:
Hi Shawn, Can we also add to the agenda Remediation? I think this a good time to reflect on some of remediation content and capabilities with SSG moving forward.
Thanks.
-ln
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto: scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Steve Grubb Sent: Thursday, December 12, 2013 4:45 PM To: scap-security-guide@lists.fedorahosted.org Cc: Shawn Wells Subject: Re: SSG Kickoff: RHEL7 Content
On Thursday, December 12, 2013 04:27:15 PM Shawn Wells wrote:
RHEL7 beta has been released, time to start on SSG content!
Goals of this call:
- Quickly overview Red Hat's RHEL7 STIG intent
- Identify required steps to port SSG from RHEL6 -> RHEL7
- Form initial work breakdown structure, assign "task leads"
- What OVAL standards will be needed? e.g. systemctl vs init, firewalld,
etc
- RHEL6 STIG community feedback: What worked? What should be dropped?
Everyone please note...some standards work will be required to get final RHEL7 content. This is because the move to systemd will make runlevel_test obsolete. These tests can be commented out until OVAL 5.11 is final.
-Steve _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Mind on a Mission http://leamhall.blogspot.com/
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Hey Steve!
We put Aqueduct scripts in our Kickstart with the other localizations. Makes it easier to bring new people in who are not Red Hat centric and get them trained up quickly on the process and how to improve it. That's a big plus for larger datacenters.
Leam
On Fri, Dec 13, 2013 at 9:01 AM, Steve Grubb sgrubb@redhat.com wrote:
On Friday, December 13, 2013 08:09:53 AM leam hall wrote:
What is SSG doing for script based remediation that Aqueduct isn't?
One major thing is that its "fixes" get into the content which can then be used by anaconda during system install.
-Steve
I had trouble dialing into meeting with the passcode.
This meeting code worked for me: 147-852-369
-ln
From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of leam hall Sent: Friday, December 13, 2013 9:21 AM To: scap-security-guide@lists.fedorahosted.org Subject: Re: SSG Kickoff: RHEL7 Content
Hey Steve! We put Aqueduct scripts in our Kickstart with the other localizations. Makes it easier to bring new people in who are not Red Hat centric and get them trained up quickly on the process and how to improve it. That's a big plus for larger datacenters. Leam
On Fri, Dec 13, 2013 at 9:01 AM, Steve Grubb <sgrubb@redhat.commailto:sgrubb@redhat.com> wrote: On Friday, December 13, 2013 08:09:53 AM leam hall wrote:
What is SSG doing for script based remediation that Aqueduct isn't?
One major thing is that its "fixes" get into the content which can then be used by anaconda during system install.
-Steve
-- Mind on a Missionhttp://leamhall.blogspot.com/
On 12/13/2013 03:01 PM, Steve Grubb wrote:
On Friday, December 13, 2013 08:09:53 AM leam hall wrote:
What is SSG doing for script based remediation that Aqueduct isn't?
One major thing is that its "fixes" get into the content which can then be used by anaconda during system install.
Yes!
Anaconda integration is tighter than just scripts in kickstart!
Anaconda integration ensures the proper password length. Or proper partitioning!
https://fedorahosted.org/oscap-anaconda-addon/wiki/FixElementsDocumentation
Best regards,
Shawn says -- sorry for mixup and try this instead:
Location: 1-800-451-8679 Code: 443-534-0130
He's driving...
On 12/12/2013 04:27 PM, Shawn Wells wrote:
The following is a new meeting request:
Subject: SSG Kickoff: RHEL7 Content Organizer: "Shawn Wells" swells@redhat.com
Location: 1-800-451-8679,,,147-852-369-00# Time: Friday, December 13, 2013, 10:30:00 AM - 11:30:00 AM GMT -05:00 US/Canada Eastern
Required: blank@eclipse.ncsc.mil; davsmith.work@gmail.com; leland.j.steinke.ctr@mail.mil Optional: scap-security-guide@lists.fedorahosted.org
*~*~*~*~*~*~*~*~*~*
U.S. Bridge: 1-800-451-8679 Passcode: 147-852-360-00
Full international bridge numbers: https://fedorahosted.org/scap-security-guide/wiki/conferenceline
RHEL7 beta has been released, time to start on SSG content!
Goals of this call:
- Quickly overview Red Hat's RHEL7 STIG intent
- Identify required steps to port SSG from RHEL6 -> RHEL7
- Form initial work breakdown structure, assign "task leads"
- What OVAL standards will be needed? e.g. systemctl vs init, firewalld, etc
- RHEL6 STIG community feedback: What worked? What should be dropped?
Historically this kickoff call was held only with RH/NSA/DISA FSO stakeholders. In air of transparency, and part science project, we'll have this as an open call. Community members are VERY welcome to join; either to chirp up & give productive feedback on areas of improvement, volunteer to own a piece of the work (e.g. handling the PAM, filesystem, or some other subcomponent), or perhaps silently listen in on the process.
~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ NOTE: As many community members may join the call, and to avoid the inevitable background noises, ALL LINES WILL DEFAULT TO MUTED. To unmute your line, you will NEED to hit *6.
We'll also idle on #ssg-rhel7 on freenode. ~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
scap-security-guide@lists.fedorahosted.org