Seeking Input: Required packages

Steve Grubb sgrubb at redhat.com
Thu Apr 26 11:36:50 UTC 2012


On Wednesday, April 25, 2012 11:50:09 PM Shawn Wells wrote:
> A number of the CCI's state the system shall "support the capability
> to...", such as "shall have the capability to centralize audit records"
> in CCI-000154.
> 
> To ensure we support this capability we need to ensure a certain amount
> of packages are installed (in this case, audit). I'd like to generate a
> set of required/recommended packages for a base installation that SSG
> needs. For example, iptables and audit would be on the top of the list.
> 
> We've tap danced around the idea of creating a recommended minimum
> packages before, however now there seems to be a pressing requirement to
> do so. What are everyone's thoughts on this? I've long been for it.
> 
> Note we shouldn't say "install *_only_* these packages," but rather
> "you'll need MINIMALLY these packages to secure your system"

I personally made sure that @core is secure. The definition of our minimal 
install is that all dependencies are resolved, the system is capable of rotating 
logs so we don't fill up, it has expected security protections, and is capable of 
updating itself. The audit daemon needs to be added to the baseline because not 
everyone wants it. If you want remote logging then you also have to add the 
plugins package.

%packages --nobase
@core

-Steve


More information about the scap-security-guide mailing list