Should the remediation enforce the restart of serviceconfiguration of which it's changing?

Nunez, Luis K lnunez at mitre.org
Tue Dec 17 15:32:53 UTC 2013


The reboot and the disruption attributes may help to provide indicators to a 
management system.  The term reboot may not be accurate for this scenario but 
certainly conveys the intent.  The disruption attribute may also help in 
gauging impact of a restart.  Although far from accurately expressing this 
scenario it does provide some level of information for decision makers.

-ln

-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org 
[mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of 
Robert Sanders
Sent: Tuesday, December 17, 2013 10:24 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: RE: Should the remediation enforce the restart of service 
configuration of which it's changing?

As you expand from must the local machine to an Enterprise environment, this 
can be even more important.  Suppose an over-eager admin decides to remediate 
(via SCAP or some other process) an entire Enterprise installation.  If boxes 
are rebooted automagically after the remediation you can unintentionally take 
out the entire installation.  Factor in cases where there is a required start 
order (which I bet we've all seen), and you've got the makings of a first 
class mess, with really upset users/higher-ups.  I'd submit that having the 
option of a reboot is worthwhile, but it needs to be wrapped in a couple 
layers of 'mother-may-I'.
-Rob

________________________________________
From: scap-security-guide-bounces at lists.fedorahosted.org 
[scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Steve Grubb 
[sgrubb at redhat.com]
Sent: Tuesday, December 17, 2013 9:51 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: Should the remediation enforce the restart of service 
configuration of which it's changing?

On Tuesday, December 17, 2013 05:33:29 AM Jan Lieskovsky wrote:
>   in relation with applying sshd remediations, wondering if
> the fix should enforce restart of sshd (include command ensuring it).

No. The update itself takes care of what is sane to do. If you force a
restart, you can kill rsync or an admin session at a really bad point in time.

There can be a check that shows unrestarted daemons if that is desirable. The
sectool content used to do that. So, its possible to script. But I'd leave the
decision about when to restart to the local admins.

-Steve
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7057 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131217/308d2110/attachment-0001.p7s>


More information about the scap-security-guide mailing list