Seeking Input: Required packages
Steve Grubb
sgrubb at redhat.com
Thu Apr 26 11:36:50 UTC 2012
On Wednesday, April 25, 2012 11:50:09 PM Shawn Wells wrote:
> A number of the CCI's state the system shall "support the capability
> to...", such as "shall have the capability to centralize audit records"
> in CCI-000154.
>
> To ensure we support this capability we need to ensure a certain amount
> of packages are installed (in this case, audit). I'd like to generate a
> set of required/recommended packages for a base installation that SSG
> needs. For example, iptables and audit would be on the top of the list.
>
> We've tap danced around the idea of creating a recommended minimum
> packages before, however now there seems to be a pressing requirement to
> do so. What are everyone's thoughts on this? I've long been for it.
>
> Note we shouldn't say "install *_only_* these packages," but rather
> "you'll need MINIMALLY these packages to secure your system"
I personally made sure that @core is secure. The definition of our minimal
install is that all dependencies are resolved, the system is capable of rotating
logs so we don't fill up, it has expected security protections, and is capable of
updating itself. The audit daemon needs to be added to the baseline because not
everyone wants it. If you want remote logging then you also have to add the
plugins package.
%packages --nobase
@core
-Steve
More information about the scap-security-guide
mailing list