Checks vs. Fixes

Shawn Wells shawn at redhat.com
Sat Oct 5 03:08:30 UTC 2013


On 10/4/13 8:50 AM, fcaviggi at redhat.com wrote:
>
> I was thinking this trough last night - I was wondering if we can use 
> checksums (sha256+) to determine if someone is using the "stock" 
> configuration and replace it with a fully STIGed version - I'm 
> thinking this would be best applicable to new installations of RHEL. I 
> understand the need for  atomic fixes for pre-existing systems, where 
> the SA has modified the defaults, but I can guarantee you that most 
> people just want a STIG'ed box out of the gate on install. I'm just 
> trying to think in terms of long term and short term goals - the 
> quicker we can satisfy the majority of the users (the ones that want 
> something STIG'ed out of the box) the better acceptance the product 
> will have, the long term should be to modify things for the people 
> that mucked with their configurations, which I'm arguing is a minority.
>
> I go back to Star Trek II: Wrath of Khan with Spock, "It is logical. 
> The needs of the many 
> outweigh<http://www.imdb.com/name/nm0000638/?ref_=tt_trv_qu>...the 
> needs of the 
> few<http://www.imdb.com/name/nm0000559/?ref_=tt_trv_qu>...or the 
> one."  We need to get the ship out of danger, and then worry about the 
> needs of the few.
>
> What do you think of my solution?

Something like this?

if rpm -V audit
     cp /usr/share/doc/audit-*/stig.rules /etc/audit.rules
else
     if audit rule misconfigured
         sed fix
     else
         echo audit_rule >> /etc/audit.rules
     fi
fi

I'm not particularly opposed. We'll want to ensure that the 
/usr/share/doc/audit-*/stig.rules file meets the STIG/SSG needs (and if 
not, submit RFEs). It'd be great if we could template these somehow.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131004/1f2d602f/attachment.html>


More information about the scap-security-guide mailing list