coming soon: consistency checking scripts
Shawn Wells
shawn at redhat.com
Wed Mar 14 01:52:16 UTC 2012
On 3/13/12 9:44 PM, Steve Grubb wrote:
> On Tuesday, March 13, 2012 07:37:07 PM Jeffrey Blank wrote:
>> > A nicely loaded question.
>> >
>> > As you've noticed, we don't have any<fix> tags.
>> > Such commands, when available, are just in the<description> or possibly
>> > <rationale>, and marked up with xhtml.
>> >
>> > I also might expect there to be plenty of<Rule>s which simply won't
>> > have<fix> tags (such as edits to configuration files like
>> > pam.d/system-auth or sshd_config, or disk partitioning instructions).
>> > On the plus side, it would obviously be a cheap/easy way to annotate
>> > remediation instructions. On the minus side, I see it as leading to
>> > sed/awk in some of our output documents, and think this will make them
>> > less approachable/comprehensible. (I'm certainly fine with it being
>> > there, and hidden.)
>> >
>> > Is there a project/effort/output which would benefit from<fix> tags?
> Yes. openscap can generate shell scripts from<fix> tags. The gentoo demo shows
> this. The aqueduct project is creating remediation scripts in shell. So, it
> sounds like we ought to work towards one document with guidance, check, and fix
> so that we can make remediation easy.
FWIW, a big +1 to this.
> There are some fixes that are hard. I'd like to say we should incorprate the easy
> ones and identify the hard ones. Whene we have several of these, then we can
> start looking for how to solve the hard problems.
I'm not to concerned about the hard fixes, largely as they've already
been addressed through CLIP and/or Aqueduct. For example, DoDIIS open
sourced their baseline (accredited to PL3) and we can pull a good bit
from that.
More information about the scap-security-guide
mailing list