Checks vs. Fixes

Shawn Wells shawn at redhat.com
Fri Oct 4 01:42:53 UTC 2013


On 10/3/13 3:11 PM, fcaviggi at redhat.com wrote:
> All,
>
> As a starting point for writing remediation fixes in the SSG - so, I 
> did the following:
>
>     $ ls ~/scap-security-guide/RHEL6/input/checks/*.xml | awk '{ print 
> $1 }' | sed s/\.[^\.]*$// > ~/checks
>     $ ls ~/scap-security-guide/RHEL6/input/fixes/*.sh | awk '{ print 
> $1 }' | sed s/\.[^\.]*$// > ~/fixes
>     $ sdiff ~/fixes ~/checks | less
>
> There's fair a bit of work to be done for the fix remediations...
>
> Since I'm new to the project, I was wondering if there was any ideas 
> or standards to how the SSG should distribute some of these fixes - 
> for example - a wholesale replacement of the audit.rules and 
> auditd.conf might be preferable than doing piecemeal sed's.

It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules 
/etc/audit.rules`, and that likely is the right choice during an initial 
provisioning process. But then SysAdmins tailor audit rules, the system 
evolves, and we need to evaluate the audit.rules file against specific 
auditing guidance items after the pristine audit.rules template is 
manipulated.

So, if a single rule must be remediated, we can't blow away the whole 
audit.rules file. Super fun sed scripts it is =/


> I also think the first script that needs to be run is to tar the 
> current existing configurations (as a backup) before applying any fix 
> just in case we do something that jacks the users modifications to the 
> system.

A prevailing thought has been to address backups once the remediations 
are finished, as we'll have a better handle for which files will need 
addressing.

Forcing the backup (through XCCDF/OVAL) is tricky. One thought has been 
to create an OVAL check -- which is listed first in the profile -- which 
will *always* fail. The remediation for said OVAL would be to perform 
the backups. Anyone have a better idea? =/

> Anyway, just trying to get an idea of how to proceed set some goals 
> for my contributions.

These are /really/ good questions. Thanks for starting the conversation!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131003/670ee201/attachment.html>


More information about the scap-security-guide mailing list