[PATCH 5/6] Finished USGCB profile

Shawn Wells shawn at redhat.com
Tue Feb 5 03:06:15 UTC 2013


On 2/4/13 12:48 PM, Jeffrey Blank wrote:
>> >The crontab files themselves are user generated, they would not be
>> >picked up with RPM verification. There is a section on this within the
>> >SSG, however it's been commented out. Over the next few weeks I'll
>> >revisit this.
> Ah, gotcha, I was thinking of the systemwide ones in /etc/cron*. User
> crontabs with incorrect permissions sounds like a contrived concern to
> me, but I'll be happy to discuss.

They've been dropped from the RHEL6 STIG candidate, hopefully the 
argument will win they should be dropped from USGCB as well. Opened a 
ticket to remind us of the conversation when the time is right (e.g. 
when conversations begin between RHT Corporate and NIST).


>>> >>Hmmm, do we have a transform that creates a table in line with what's
>>> >>called for in NIST SP 800-70 Appendix E, for proper submission, sans
>>> >>perhaps the "Impact" column (which lacks a corresponding XCCDF element).
>> >Not yet....  and you have such amazing xslt skills.... hmm... ;)
> Sigh, perhaps.  Gary and Brian aren't too shabby either :)
>
> When I have a few cycles to spare, I first want to simplify some of the
> existing transforms (now that oscap xccdf resolve works) and document
> the overall build process better on the Wiki.
>
> Thanks again for the updated USGCB profile!
It's a starting point.

FWIW, over the next two weeks I hope to extend the rhel6-stig-server 
into "RHSS2-stig" (e.g., Red Hat Storage aka Gluster).


More information about the scap-security-guide mailing list