On 2/21/13 9:34 AM, Shaw, Ray V CTR (US) wrote:
[We also have an interesting issue where there is an inspection
coming up, and we're not sure whether they're going to use the RHEL5 or RHEL6
draft STIG to evaluate RHEL6 systems. This is a problem, because there are a bunch of
rules in them that conflict, e.g. /bin/true vs /bin/false or always,exit vs exit,always;
explainable as equivalent and false positives, but makes scans for one or the other look
awful. Hopefully the team will let us know shortly.]
On 2/21/13 10:11 AM, Brian Peake wrote:
I am seeing the exact same things you have listed when comparing
using SSG content w/ SCC3.1 versus OpenScap 0.9.3. I was under the impression most of the
issues were OVAL related... Regardless, watching closely to see how this comes together. I
prefer OpenScap tbh, but I know inspectors will use SCC.
<i_work_for_the_vendor>RHT has an army of technical architects whose day
job is to deal with these situations. I'd be happy to make introductions
to whoever your agencies Red Hat architect is.... they may have some
agency-specific insight into how this has been tackled in the past. In
my day job, I'm one of the Architects for Intelligence programs. Feel
free to reach out to me off-list if you fall under that
bucket.</i_work_for_the_vendor>