Hello,
These patches should address a few sshd false positives [Patch 0001] and
add support for %gconf-tree.xml [Patch 0002] as well as a recommendation to
change remediation for the GDM login banner from a gdm user default to a
gconf mandatory setting [Patch 0003].
[Patch 0001]:
When initially running the scan, some sshd settings such as
PermitRootLogin were showing that they were set correcly. This patch should
fix those as well as hopefully address
https://fedorahosted.org/scap-security-guide/ticket/434
[Patch 0002]:
Adds support to check %gconf-tree.xml. If %gconf-tree.xml exists
(such as being deployed through Satellite), it takes precedence over any
directory containing a %gconf.xml file under
/etc/gconf/gconf.xml.mandatory. Plus having a single configuration file to
create/change/modify is always a plus. Could potentially help address
https://fedorahosted.org/scap-security-guide/ticket/282
[Patch 0003]:
This is a recommendation to move setting the gdm banner and login
settings from /var/lib/gdm to /etc/gconf/gconf.xml.mandatory. Reason for
this is that the /etc/gconf directory is the location for administrators to
set mandatory system policies over user set policies. Plus due to the gconf
order of processing/precedance, it would be recommended to set under /etc
rather than /var as anything set as a mandatory policy would be the default
no matter what was in /var/lib/gdm. If approved, would potentially address
https://fedorahosted.org/scap-security-guide/ticket/319
Thanks,
Gabe