On Wednesday, April 25, 2012 11:50:09 PM Shawn Wells wrote:
A number of the CCI's state the system shall "support the
capability
to...", such as "shall have the capability to centralize audit records"
in CCI-000154.
To ensure we support this capability we need to ensure a certain amount
of packages are installed (in this case, audit). I'd like to generate a
set of required/recommended packages for a base installation that SSG
needs. For example, iptables and audit would be on the top of the list.
We've tap danced around the idea of creating a recommended minimum
packages before, however now there seems to be a pressing requirement to
do so. What are everyone's thoughts on this? I've long been for it.
Note we shouldn't say "install *_only_* these packages," but rather
"you'll need MINIMALLY these packages to secure your system"
I personally made sure that @core is secure. The definition of our minimal
install is that all dependencies are resolved, the system is capable of rotating
logs so we don't fill up, it has expected security protections, and is capable of
updating itself. The audit daemon needs to be added to the baseline because not
everyone wants it. If you want remote logging then you also have to add the
plugins package.
%packages --nobase
@core
-Steve