Here are two potential profiles for manual actions on SCAP content.
They separately address manual audits and manual remediation (with overlap).
They are included in one patch, as they provide a solution to SCAP's
lack of coverage for audit and remediation.
I understand if these profiles are not adopted, but just to give an idea
of the scope of this (and as requested), I thought a patch would be
appreciated.
Feel free to provide input, as I'm sure there's something I missed.
---
RHEL6/input/profiles/manual_audits.xml | 40 +++++++++++++++++++++++++++
RHEL6/input/profiles/manual_remediation.xml | 32 +++++++++++++++++++++
2 files changed, 72 insertions(+), 0 deletions(-)
create mode 100755 RHEL6/input/profiles/manual_audits.xml
create mode 100755 RHEL6/input/profiles/manual_remediation.xml
diff --git a/RHEL6/input/profiles/manual_audits.xml
b/RHEL6/input/profiles/manual_audits.xml
new file mode 100755
index 0000000..005bcd9
--- /dev/null
+++ b/RHEL6/input/profiles/manual_audits.xml
@@ -0,0 +1,40 @@
+<Profile id="manual_audits"
xmlns="http://checklists.nist.gov/xccdf/1.1" >
+<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
+<description>This profile contains items that require user interaction during
audit.</description>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_uidzero_except_root" selected="true"/>
+<select idref="postfix_create_cert" selected="true"/>
+<select idref="postfix_install_ssl_cert" selected="true"/>
+<select idref="network_ssl_create_ca" selected="true" />
+<select idref="network_ssl_create_ssl_certs" selected="true"
/>
+<select idref="network_ssl_create_ssl_certs" selected="true"
/>
+<select idref="network_ssl_enable_client_support"
selected="true"/>
+<select idref="network_ssl_add_ca_firefox" selected="true"/>
+<select idref="network_ssl_add_ca_thunderbird"
selected="true"/>
+<select idref="network_ssl_add_ca_evolution" selected="true"/>
+<select idref="network_ssl_remove_certs" selected="true"/>
+<select idref="network_ipv6_static_address" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="enable_gdm_login_banner" selected="true"/>
+<select idref="aide_build_database" selected="true"/>
+<select idref="wireless_disable_in_bios" selected="true"/>
+<select idref="deactivate_wireless_interfaces"
selected="true"/>
+<select idref="iptables_log_and_drop_suspicious"
selected="true"/>
+<select idref="network_ipv6_default_gateway" selected="true"/>
+<select idref="no_files_unowned_by_user" selected="true"/>
+<select idref="no_files_unowned_by_group" selected="true"/>
+<select idref="world_writable_files_system_ownership"
selected="true"/>
+<select idref="aide_verify_integrity-manually"
selected="true"/>
+<select idref="ldap_server_config_olcsuffix" selected="true"/>
+<select idref="ldap_server_config_olcrootpw" selected="true"/>
+<select idref="ldap_server_config_olcaccess" selected="true"/>
+<select idref="iptables_ldap_enabled" selected="true"/>
+<select idref="ldap_server_config_certificate_files"
selected="true"/>
+<select idref="ldap_server_config_directory_domain"
selected="true"/>
+<select idref="ldap_server_config_directory_users_groups"
selected="true"/>
+<select idref="ldap_server_config_directory_accounts"
selected="true"/>
+<select idref="ldap_server_config_directory_groups"
selected="true"/>
+<select idref="ldap_server_config_directory_admin_group"
selected="true"/>
+</Profile>
diff --git a/RHEL6/input/profiles/manual_remediation.xml
b/RHEL6/input/profiles/manual_remediation.xml
new file mode 100755
index 0000000..84a8fe7
--- /dev/null
+++ b/RHEL6/input/profiles/manual_remediation.xml
@@ -0,0 +1,32 @@
+<Profile id="manual_audits"
xmlns="http://checklists.nist.gov/xccdf/1.1" >
+<title>Profile for Attended/Manual portion of DCID6/3 remediation</title>
+<description>This profile contains items that require user interaction during
audit.</description>
+<select idref="install_aide" selected="true"/>
+<select idref="install_vsftpd" selected="true"/>
+<select idref="install_openswan" selected="true"/>
+<select idref="install_vlock_package" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="bootloader_password" selected="true"/>
+<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
+<select idref="disable_dhcp_client" selected="true"/>
+<select idref="enable_gdm_login_banner" selected="true"/>
+<select idref="set_gdm_login_banner_text" selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_uidzero_except_root" selected="true"/>
+<select idref="postfix_create_cert" selected="true"/>
+<select idref="postfix_install_ssl_cert" selected="true"/>
+<select idref="postfix_seperate_internal_external"
selected="true"/>
+<select idref="network_ipv6_static_address" selected="true"/>
+<select idref="bios_disable_usb_boot" selected="true"/>
+<select idref="enable_gdm_login_banner" selected="true"/>
+<select idref="aide_build_database" selected="true"/>
+<select idref="wireless_disable_in_bios" selected="true"/>
+<select idref="deactivate_wireless_interfaces"
selected="true"/>
+<select idref="iptables_log_and_drop_suspicious"
selected="true"/>
+<select idref="network_ipv6_default_gateway" selected="true"/>
+<select idref="no_files_unowned_by_user" selected="true"/>
+<select idref="no_files_unowned_by_group" selected="true"/>
+<select idref="world_writable_files_system_ownership"
selected="true"/>
+<select idref="aide_verify_integrity-manually"
selected="true"/>
+<select idref="iptables_ldap_enabled" selected="true"/>
+</Profile>
--
1.7.1