Draft RHEL6 STIG Released!

Vincent Passaro vince.passaro at fotisnetworks.com
Fri Feb 15 21:51:23 UTC 2013


On 2/15/13 4:28 PM, "Jeffrey Blank" <blank at eclipse.ncsc.mil> wrote:

>
>> If a password exists for a service account its declared a finding and
>> passwd -l <account name> should be done, but passwd -l only puts !! In
>> front of the hash to lock the account and does not remove the hash.  I'm
>> assuming this is going to cause some false positives in scanning.  So
>> maybe some extra wording saying that if a has exists and !! Comes before
>> it, then its not a finding?
>
>A patch would force the issue / be most helpful.
>Thanks for the feedback!

Happy to help, let me know if this is how you would like the feedback
moving forward.
>
>> I'm keeping track of everything as I develop the STIG content, so will
>> report back as I mow through everything.
>
>"Content" remains a confusingly overloaded word.  If it's not too much
>to ask, I'd request that everyone use it only to describe SCAP-formatted
>content, such as the STIG itself or the other SCAP content on
>scap-security-guide.

Sorry, that¹s the Aqueduct side of me talking.  By content I mean
remediation content.
>
>> P.S.  From the RHEL5 Beta STIG to the RHEL5 Final no change log or
>> revision tracking was done, which makes updating content a
>> nightmare--especially if there are dups of like checks.  Maybe we can
>>ping
>> DISA to try and implement that?
>
>Yes -- we need to sync shortly.  Ideally all changes would go through
>SSG, and then the git log will provide a complete and transparent record
>of all changes.  I do not believe DISA's system includes version control
>(but I'm open to correction).

Agreed, there is an upcoming internal Aqueduct call happening next week in
regards to Jboss STIG remediation content.  Hopefully yourself and/or
Shawn can attend.
>_______________________________________________
>scap-security-guide mailing list
>scap-security-guide at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide




More information about the scap-security-guide mailing list