ldap_client_tls_checkpeer question
Kevin Spargur
kspargur at redhat.com
Mon May 21 21:33:23 UTC 2012
That's definitely a better way to go, but down that road what purpose does a http or FTP profile serve?
-Kevin
On May 21, 2012, at 5:23 PM, Jeffrey Blank <blank at eclipse.ncsc.mil> wrote:
> When conducting this kind of check, the application should be
> installed/active (or the system should be configured to use the service)
> -- and the test should pass if it's not.
>
> We do not want to make changes to files to satisfy tests that would be,
> in context, bogus.
>
> As examples, see some check against services (such as
> service_cupsd_disabled.xml) which pass if the package is not even
> installed. These make use of extend_definition to call another,
> existing definition which checks to see if a package is installed first.
> (In general, these other definitions exists because there a check exists
> against the installation of this package, on its own). (That said, I'd
> prefer not to create a definition unless it's also usable on its own, or
> has 2 referrers.)
>
> In general, I'd just make use of "and"-ing criteria to pass checks if
> the check is irrelevant in context.
>
>
>
> On 05/20/2012 03:11 PM, Joe Nall wrote:
>> There are a number of checks like ldap_client_tls_checkpeer that look
>> for a string or value in a file that are not sensitive to whether the
>> relevant application is installed. What is the preferred way to deal
>> with this problem? I would prefer not to create unused config files
>> just to make a bogus test happy.
>>
>> Is there a good example in the code of how to test for installation
>> then configuration?
>>
>> I know I can profile my way around this, but down that path is
>> failures to identify issues when a package is added to a system under
>> management.
>>
>> joe
>>
>> _______________________________________________ scap-security-guide
>> mailing list scap-security-guide at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list