ldap_client_tls_checkpeer question

Jeffrey Blank blank at eclipse.ncsc.mil
Mon May 21 21:36:46 UTC 2012


This is all dependent on what Profile you want to evaluate against,
which depends on the network role of the system.

The specific inquiry from Joe relates to LDAP client support, which may
be expected in a general purpose system (but is not required).



On 05/21/2012 05:33 PM, Kevin Spargur wrote:
> That's definitely a better way to go, but down that road what purpose
> does a http or FTP profile serve?
> 
> -Kevin
> 
> 
> 
> 
> 
> On May 21, 2012, at 5:23 PM, Jeffrey Blank <blank at eclipse.ncsc.mil>
> wrote:
> 
>> When conducting this kind of check, the application should be 
>> installed/active (or the system should be configured to use the
>> service) -- and the test should pass if it's not.
>> 
>> We do not want to make changes to files to satisfy tests that would
>> be, in context, bogus.
>> 
>> As examples, see some check against services (such as 
>> service_cupsd_disabled.xml) which pass if the package is not even 
>> installed.  These make use of extend_definition to call another, 
>> existing definition which checks to see if a package is installed
>> first. (In general, these other definitions exists because there a
>> check exists against the installation of this package, on its own).
>> (That said, I'd prefer not to create a definition unless it's also
>> usable on its own, or has 2 referrers.)
>> 
>> In general, I'd just make use of "and"-ing criteria to pass checks
>> if the check is irrelevant in context.
>> 
>> 
>> 
>> On 05/20/2012 03:11 PM, Joe Nall wrote:
>>> There are a number of checks like ldap_client_tls_checkpeer that
>>> look for a string or value in a file that are not sensitive to
>>> whether the relevant application is installed. What is the
>>> preferred way to deal with this problem? I would prefer not to
>>> create unused config files just to make a bogus test happy.
>>> 
>>> Is there a good example in the code of how to test for
>>> installation then configuration?
>>> 
>>> I know I can profile my way around this, but down that path is 
>>> failures to identify issues when a package is added to a system
>>> under management.
>>> 
>>> joe
>>> 
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org 
>>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
>> _______________________________________________ scap-security-guide
>> mailing list scap-security-guide at lists.fedorahosted.org 
>> https://fedorahosted.org/mailman/listinfo/scap-security-guide
> 
> _______________________________________________ scap-security-guide
> mailing list scap-security-guide at lists.fedorahosted.org 
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list