[PATCH 5/6] Finished USGCB profile
Shawn Wells
shawn at redhat.com
Tue Feb 5 03:06:15 UTC 2013
On 2/4/13 12:48 PM, Jeffrey Blank wrote:
>> >The crontab files themselves are user generated, they would not be
>> >picked up with RPM verification. There is a section on this within the
>> >SSG, however it's been commented out. Over the next few weeks I'll
>> >revisit this.
> Ah, gotcha, I was thinking of the systemwide ones in /etc/cron*. User
> crontabs with incorrect permissions sounds like a contrived concern to
> me, but I'll be happy to discuss.
They've been dropped from the RHEL6 STIG candidate, hopefully the
argument will win they should be dropped from USGCB as well. Opened a
ticket to remind us of the conversation when the time is right (e.g.
when conversations begin between RHT Corporate and NIST).
>>> >>Hmmm, do we have a transform that creates a table in line with what's
>>> >>called for in NIST SP 800-70 Appendix E, for proper submission, sans
>>> >>perhaps the "Impact" column (which lacks a corresponding XCCDF element).
>> >Not yet.... and you have such amazing xslt skills.... hmm... ;)
> Sigh, perhaps. Gary and Brian aren't too shabby either :)
>
> When I have a few cycles to spare, I first want to simplify some of the
> existing transforms (now that oscap xccdf resolve works) and document
> the overall build process better on the Wiki.
>
> Thanks again for the updated USGCB profile!
It's a starting point.
FWIW, over the next two weeks I hope to extend the rhel6-stig-server
into "RHSS2-stig" (e.g., Red Hat Storage aka Gluster).
More information about the scap-security-guide
mailing list