Should the remediation enforce the restart of service configuration of which it's changing?

Steve Grubb sgrubb at redhat.com
Tue Dec 17 14:51:29 UTC 2013


On Tuesday, December 17, 2013 05:33:29 AM Jan Lieskovsky wrote:
>   in relation with applying sshd remediations, wondering if
> the fix should enforce restart of sshd (include command ensuring it).

No. The update itself takes care of what is sane to do. If you force a 
restart, you can kill rsync or an admin session at a really bad point in time.

There can be a check that shows unrestarted daemons if that is desirable. The 
sectool content used to do that. So, its possible to script. But I'd leave the 
decision about when to restart to the local admins.

-Steve


More information about the scap-security-guide mailing list