NTP encryption guidance

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Jul 19 23:02:26 UTC 2012


For now, some basic high-level discussion about the different encryption
options might be fine.  Rules could wait until later.

I might check out what the RHEL 5 STIG requires:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel5-table-stig-manual.html

... and make sure we're including those as available Rules.  Some of
them might not make it through the consensus process as part of a
general-purpose STIG profile (e.g. time sources local to the enclave,
requiring two time sources), but they should be part of the discussion.
 And they are things that certainly make sense for some scenarios (for
which we would like to have a Profile available).





On 07/18/2012 12:05 PM, ctrueman at redhat.com wrote:
> On 07/17/2012 06:25 PM, Jeffrey Blank wrote:
>> This is a reasonable start on where we'd like to go (having a discussion
>> about authentication/security options), but let's try to flesh this out
>> a bit more.
>>
>> Our goal is not to repeat the documentation here:
>> http://support.ntp.org/bin/view/Support/ConfiguringAutokey
>> or here:
>> http://support.ntp.org/bin/view/Support/AccessRestrictions#Section_6.5.3.1.
>>
>>
>> ...but to provide a few XCCDF Rules and OVAL checks that would:
>> 1) provide (basic) info to admins on what they'd need to configure to
>> get some security benefit (while referencing the authoritative docs)
>> 2) allow for an enterprise admin to run checks to determine if system
>> are configured a certain way.
>>
>> For ntp, it's looking complicated.
>>
>>
>> I also updated the wiki to try to show how we've been using
>> git-send-email (in an attempt to lure other developers):
>> https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper
>>
>>
>>
>>
>>
>> On 07/16/2012 03:30 PM, ctrueman at redhat.com wrote:
>>> Not sure doing an actual push, so I figured I'd throw this out there on
>>> the list first.
>>>
>>>
>>>
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
> Well I'm going to do a bit more research on what a really secure NTP
> server looks, because if it's more than just looking at the checksum,
> you're right - it's going to be complicated.
> 


More information about the scap-security-guide mailing list