Checks vs. Fixes

Trevor Vaughan tvaughan at onyxpoint.com
Sun Oct 6 01:26:10 UTC 2013


Ok, so how do we make it happen?

Trevor


On Fri, Oct 4, 2013 at 11:05 PM, Shawn Wells <shawn at redhat.com> wrote:

> On 10/4/13 8:06 AM, Josh Kayse wrote:
>
>> On 10/04/2013 07:40 AM, Trevor Vaughan wrote:
>>
>>> Is Augeas an option?
>>>
>>> This seems like the perfect opportunity to solidify the Augeas lenses
>>> regarding security settings while making life easier for everyone.
>>>
>>> Trevor
>>>
>>>
>>> On Thu, Oct 3, 2013 at 9:42 PM, Shawn Wells <shawn at redhat.com
>>> <mailto:shawn at redhat.com>> wrote:
>>>
>>>     On 10/3/13 3:11 PM, fcaviggi at redhat.com <mailto:fcaviggi at redhat.com>
>>>     wrote:
>>>
>>>>     All,
>>>>
>>>>     As a starting point for writing remediation fixes in the SSG - so,
>>>>     I did the following:
>>>>
>>>>         $ ls ~//scap-security-guide/RHEL6/**input/checks//*.xml | awk
>>>> '{
>>>>     print $1 }' | sed s/\.[^\.]*$// > ~/checks
>>>>         $ ls ~//scap-security-guide/RHEL6/**input/fixes//*.sh | awk '{
>>>>     print $1 }' | sed s/\.[^\.]*$// > ~/fixes
>>>>         $ sdiff ~/fixes ~/checks | less
>>>>
>>>>     There's fair a bit of work to be done for the fix remediations...
>>>>
>>>>     Since I'm new to the project, I was wondering if there was any
>>>>     ideas or standards to how the SSG should distribute some of these
>>>>     fixes - for example - a wholesale replacement of the audit.rules
>>>>     and auditd.conf might be preferable than doing piecemeal sed's.
>>>>
>>>
>>>     It'd be omgz easier to `cp /usr/share/doc/audit-*/stig.**rules
>>>     /etc/audit.rules`, and that likely is the right choice during an
>>>     initial provisioning process. But then SysAdmins tailor audit rules,
>>>     the system evolves, and we need to evaluate the audit.rules file
>>>     against specific auditing guidance items after the pristine
>>>     audit.rules template is manipulated.
>>>
>>>     So, if a single rule must be remediated, we can't blow away the
>>>     whole audit.rules file. Super fun sed scripts it is =/
>>>
>>> <snip>
>>>
>>
>> I think that augeas is a good idea.  We need to be careful that rules
>> that are inserted in to audit.rules happen before any '-e 2' line (if one
>> exists).  Otherwise they will fail to be inserted because the audit rules
>> become locked.
>>
>> -josh
>>
>
> Augeas and puppet would be great, their downside is they don't ship
> natively with RHEL :( Part of the goal is to enable the remediation with
> native tooling first. IMO, Augeas scripts would be *fantastic* for Aqueduct!
>
> ______________________________**_________________
> scap-security-guide mailing list
> scap-security-guide at lists.**fedorahosted.org<scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131005/f8d5a895/attachment.html>


More information about the scap-security-guide mailing list