Checks vs. Fixes

Josh Kayse Joshua.Kayse at gtri.gatech.edu
Fri Oct 4 12:06:43 UTC 2013


On 10/04/2013 07:40 AM, Trevor Vaughan wrote:
> Is Augeas an option?
>
> This seems like the perfect opportunity to solidify the Augeas lenses
> regarding security settings while making life easier for everyone.
>
> Trevor
>
>
> On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells <shawn at redhat.com
> <mailto:shawn at redhat.com>> wrote:
>
>     On 10/3/13 3:11 PM, fcaviggi at redhat.com <mailto:fcaviggi at redhat.com>
>     wrote:
>>     All,
>>
>>     As a starting point for writing remediation fixes in the SSG - so,
>>     I did the following:
>>
>>         $ ls ~//scap-security-guide/RHEL6/input/checks//*.xml | awk '{
>>     print $1 }' | sed s/\.[^\.]*$// > ~/checks
>>         $ ls ~//scap-security-guide/RHEL6/input/fixes//*.sh | awk '{
>>     print $1 }' | sed s/\.[^\.]*$// > ~/fixes
>>         $ sdiff ~/fixes ~/checks | less
>>
>>     There's fair a bit of work to be done for the fix remediations...
>>
>>     Since I'm new to the project, I was wondering if there was any
>>     ideas or standards to how the SSG should distribute some of these
>>     fixes - for example - a wholesale replacement of the audit.rules
>>     and auditd.conf might be preferable than doing piecemeal sed's.
>
>     It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.rules
>     /etc/audit.rules`, and that likely is the right choice during an
>     initial provisioning process. But then SysAdmins tailor audit rules,
>     the system evolves, and we need to evaluate the audit.rules file
>     against specific auditing guidance items after the pristine
>     audit.rules template is manipulated.
>
>     So, if a single rule must be remediated, we can't blow away the
>     whole audit.rules file. Super fun sed scripts it is =/
>
> <snip>

I think that augeas is a good idea.  We need to be careful that rules 
that are inserted in to audit.rules happen before any '-e 2' line (if 
one exists).  Otherwise they will fail to be inserted because the audit 
rules become locked.

-josh

-- 
404.407.6630

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5059 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131004/cc461f7a/attachment.p7s>


More information about the scap-security-guide mailing list