Checks vs. Fixes
Shawn Wells
shawn at redhat.com
Sat Oct 5 03:08:30 UTC 2013
On 10/4/13 8:50 AM, fcaviggi at redhat.com wrote:
>
> I was thinking this trough last night - I was wondering if we can use
> checksums (sha256+) to determine if someone is using the "stock"
> configuration and replace it with a fully STIGed version - I'm
> thinking this would be best applicable to new installations of RHEL. I
> understand the need for atomic fixes for pre-existing systems, where
> the SA has modified the defaults, but I can guarantee you that most
> people just want a STIG'ed box out of the gate on install. I'm just
> trying to think in terms of long term and short term goals - the
> quicker we can satisfy the majority of the users (the ones that want
> something STIG'ed out of the box) the better acceptance the product
> will have, the long term should be to modify things for the people
> that mucked with their configurations, which I'm arguing is a minority.
>
> I go back to Star Trek II: Wrath of Khan with Spock, "It is logical.
> The needs of the many
> outweigh<http://www.imdb.com/name/nm0000638/?ref_=tt_trv_qu>...the
> needs of the
> few<http://www.imdb.com/name/nm0000559/?ref_=tt_trv_qu>...or the
> one." We need to get the ship out of danger, and then worry about the
> needs of the few.
>
> What do you think of my solution?
Something like this?
if rpm -V audit
cp /usr/share/doc/audit-*/stig.rules /etc/audit.rules
else
if audit rule misconfigured
sed fix
else
echo audit_rule >> /etc/audit.rules
fi
fi
I'm not particularly opposed. We'll want to ensure that the
/usr/share/doc/audit-*/stig.rules file meets the STIG/SSG needs (and if
not, submit RFEs). It'd be great if we could template these somehow.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131004/1f2d602f/attachment.html>
More information about the scap-security-guide
mailing list