SSG Audit + Aqueduct Remediation Linking

Steve Grubb sgrubb at redhat.com
Fri Sep 7 14:06:48 UTC 2012


On Thursday, September 06, 2012 10:25:48 PM Francisco Slavin wrote:
> We are planning to continue using the <fix> tag with a custom system
> attribute string to indicate that the <fix> tag contains BASH remediation
> content.  We are currently considering JSON notation as the leading
> candidate for writing the <fix> content because it is both easy to write
> and easy to parse.  The information we want to make sure we cover for
> running a remediation script is:

One of the fundamental items that show up over and over is the kickstart 
script for system installation. If you want to spin up a VM, kickstart can be 
used. If you want to make a liveCD, kickstart again. If you want to install a 
bare-metal system...you guessed it.

The open scap tool can take the XCCDF docs and turn it into a remediation 
script. You then add boiler plate at the top for partitioning, language, time 
zone, etc...and you have a kickstart file.

I'd really like to keep things so that moving between XCCDF and kickstart is 
simple.

-Steve


More information about the scap-security-guide mailing list