SSG M1 Objectives

Kevin Spargur kspargur at redhat.com
Tue Mar 20 20:18:34 UTC 2012


On 03/20/2012 03:40 PM, Michael Palmiotto wrote:
>>> It looks like if we want to achieve the "prose guide, with desktop and server profiles
>>> and content" milestones, content needs to be added to a couple of places:
>>>
>>> 1) The prose and rationale need to be added to rhel6/src/input/services or
>>> rhel6/src/input/system, depending upon what's being addressed.
>> Yes, this meets the M1.1 objective to have a "human-readable prose
>> guide, with level of completeness and quality similar to the NSA SNAC
>> RHEL 5 guide" as well as the M1.3 objective to have rationale for all
>> rules in the desktop and server profiles.
> Just for clarification:
> If a service Group has a Rule with system settings  (ie Group: "Configure Squid"
> and Rule: "Configure iptables to Allow Access to the Proxy Server") should the Group
> be added to both rhel6/src/input/service and system?
>
> Or would the Rule just be added to service?  It seems like we'd want some way of
> relating system settings prose back to the service that necessitates it.
I'd only add the group and rule to the service.  We definitely want to 
avoid duplication of rules in different sections.  Remember that the 
files in the service and and system directories are all merged together 
into a single xccdf via make at the end state.  The breakdown into 
various folders and files is really just a means to facilitate 
collaboration.

-Kevin

>
> --Mike
>
>> -Kevin
>>> --Mike



More information about the scap-security-guide mailing list