Draft RHEL6 STIG Released! (UNCLASSIFIED)

Shawn Wells shawn at redhat.com
Thu Feb 21 18:25:03 UTC 2013


On 2/21/13 9:34 AM, Shaw, Ray V CTR (US) wrote:
> [We also have an interesting issue where there is an inspection coming up, and we're not sure whether they're going to use the RHEL5 or RHEL6 draft STIG to evaluate RHEL6 systems.  This is a problem, because there are a bunch of rules in them that conflict, e.g. /bin/true vs /bin/false or always,exit vs exit,always; explainable as equivalent and false positives, but makes scans for one or the other look awful.  Hopefully the team will let us know shortly.]

On 2/21/13 10:11 AM, Brian Peake wrote:
> I am seeing the exact same things you have listed when comparing using SSG content w/ SCC3.1 versus OpenScap 0.9.3.  I was under the impression most of the issues were OVAL related... Regardless, watching closely to see how this comes together. I prefer OpenScap tbh, but I know inspectors will use SCC.

<i_work_for_the_vendor>RHT has an army of technical architects whose day 
job is to deal with these situations. I'd be happy to make introductions 
to whoever your agencies Red Hat architect is.... they may have some 
agency-specific insight into how this has been tackled in the past. In 
my day job, I'm one of the Architects for Intelligence programs. Feel 
free to reach out to me off-list if you fall under that 
bucket.</i_work_for_the_vendor>


More information about the scap-security-guide mailing list