[PATCH 5/6] Finished USGCB profile

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Feb 4 17:48:04 UTC 2013


> The crontab files themselves are user generated, they would not be
> picked up with RPM verification. There is a section on this within the
> SSG, however it's been commented out. Over the next few weeks I'll
> revisit this.

Ah, gotcha, I was thinking of the systemwide ones in /etc/cron*. User
crontabs with incorrect permissions sounds like a contrived concern to
me, but I'll be happy to discuss.


>> Hmmm, do we have a transform that creates a table in line with what's
>> called for in NIST SP 800-70 Appendix E, for proper submission, sans
>> perhaps the "Impact" column (which lacks a corresponding XCCDF element).
> Not yet....  and you have such amazing xslt skills.... hmm... ;)

Sigh, perhaps.  Gary and Brian aren't too shabby either :)

When I have a few cycles to spare, I first want to simplify some of the
existing transforms (now that oscap xccdf resolve works) and document
the overall build process better on the Wiki.

Thanks again for the updated USGCB profile!


More information about the scap-security-guide mailing list