[PATCH 20/25] Mapped CCI-00197 to requirement_unclear.
Shawn Wells
shawn at redhat.com
Wed Jun 27 22:27:32 UTC 2012
On 6/27/12 6:18 PM, Willy Santos wrote:
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 6167107..5e295dc 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
> <description>
> It is unclear how to satisfy this requirement.
> </description>
> -<ref disa="20,31,218,219,224,386,1092" />
> +<ref disa="20,31,218,219,224,386,1092,1097" />
> </Group> <!-- end unmet_impractical_product -->
>
> <Group id="new_rule_needed">
SRG-OS-000074 CCI-000197 The operating system must enforce password
encryption for transmission. Passwords need to be protected at all
times and encryption is the standard method for protecting passwords
during transmission to ensure unauthorized users/processes do not gain
access to them.
Configure OpenSSH Server if Necessary If the system needs to act as an
SSH server, then certain changes should be made to the OpenSSH daemon
configuration file|/etc/ssh/sshd_config|. The following recommendations
can be applied to this file. See the|sshd_config(5)|man page for more
detailed information.
I'm interpreting that as we must enforce password encryption for
/operating system/ passwords, which the use of SSH would do for us.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120627/1968bf0d/attachment.html>
More information about the scap-security-guide
mailing list