Checks vs. Fixes

Trevor Vaughan tvaughan at onyxpoint.com
Fri Oct 4 11:40:26 UTC 2013


Is Augeas an option?

This seems like the perfect opportunity to solidify the Augeas lenses
regarding security settings while making life easier for everyone.

Trevor


On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells <shawn at redhat.com> wrote:

>  On 10/3/13 3:11 PM, fcaviggi at redhat.com wrote:
>
> All,
>
> As a starting point for writing remediation fixes in the SSG - so, I did
> the following:
>
>     $ ls ~*/scap-security-guide/RHEL6/input/checks/**.xml | awk '{ print
> $1 }' | sed s/\.[^\.]*$// > ~/checks
>     $ ls ~*/scap-security-guide/RHEL6/input/fixes/**.sh | awk '{ print $1
> }' | sed s/\.[^\.]*$// > ~/fixes
>     $ sdiff ~/fixes ~/checks | less
>
> There's fair a bit of work to be done for the fix remediations...
>
> Since I'm new to the project, I was wondering if there was any ideas or
> standards to how the SSG should distribute some of these fixes - for
> example - a wholesale replacement of the audit.rules and auditd.conf might
> be preferable than doing piecemeal sed's.
>
>
> It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules
> /etc/audit.rules`, and that likely is the right choice during an initial
> provisioning process. But then SysAdmins tailor audit rules, the system
> evolves, and we need to evaluate the audit.rules file against specific
> auditing guidance items after the pristine audit.rules template is
> manipulated.
>
> So, if a single rule must be remediated, we can't blow away the whole
> audit.rules file. Super fun sed scripts it is =/
>
>
>
>  I also think the first script that needs to be run is to tar the current
> existing configurations (as a backup) before applying any fix just in case
> we do something that jacks the users modifications to the system.
>
>
> A prevailing thought has been to address backups once the remediations are
> finished, as we'll have a better handle for which files will need
> addressing.
>
> Forcing the backup (through XCCDF/OVAL) is tricky. One thought has been to
> create an OVAL check -- which is listed first in the profile -- which will
> *always* fail. The remediation for said OVAL would be to perform the
> backups. Anyone have a better idea? =/
>
>
>  Anyway, just trying to get an idea of how to proceed set some goals for
> my contributions.
>
>
> These are *really* good questions. Thanks for starting the conversation!
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>


-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131004/53bbfb71/attachment.html>


More information about the scap-security-guide mailing list