ldap_client_tls_checkpeer question

Kevin Spargur kspargur at redhat.com
Mon May 21 21:33:23 UTC 2012


That's definitely a better way to go, but down that road what purpose does a http or FTP profile serve?

-Kevin





On May 21, 2012, at 5:23 PM, Jeffrey Blank <blank at eclipse.ncsc.mil> wrote:

> When conducting this kind of check, the application should be
> installed/active (or the system should be configured to use the service)
> -- and the test should pass if it's not.
> 
> We do not want to make changes to files to satisfy tests that would be,
> in context, bogus.
> 
> As examples, see some check against services (such as
> service_cupsd_disabled.xml) which pass if the package is not even
> installed.  These make use of extend_definition to call another,
> existing definition which checks to see if a package is installed first.
> (In general, these other definitions exists because there a check exists
> against the installation of this package, on its own).  (That said, I'd
> prefer not to create a definition unless it's also usable on its own, or
> has 2 referrers.)
> 
> In general, I'd just make use of "and"-ing criteria to pass checks if
> the check is irrelevant in context.
> 
> 
> 
> On 05/20/2012 03:11 PM, Joe Nall wrote:
>> There are a number of checks like ldap_client_tls_checkpeer that look
>> for a string or value in a file that are not sensitive to whether the
>> relevant application is installed. What is the preferred way to deal
>> with this problem? I would prefer not to create unused config files
>> just to make a bogus test happy.
>> 
>> Is there a good example in the code of how to test for installation
>> then configuration?
>> 
>> I know I can profile my way around this, but down that path is
>> failures to identify issues when a package is added to a system under
>> management.
>> 
>> joe
>> 
>> _______________________________________________ scap-security-guide
>> mailing list scap-security-guide at lists.fedorahosted.org 
>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list