Checks vs. Fixes

Trevor Vaughan tvaughan at onyxpoint.com
Sun Oct 6 01:24:31 UTC 2013


+1

EVERYONE wants to modify at least one rule. It needs to be easy to do so
and run your own checks else people will just start writing other tools.

Trevor


On Sat, Oct 5, 2013 at 7:57 AM, Brian Millett <bmillett at gmail.com> wrote:

> On Fri, 04 Oct 2013 08:50:23 -0400
> fcaviggi at redhat.com wrote:
>
> > I was thinking this trough last night - I was wondering if we can use
> > checksums (sha256+) to determine if someone is using the "stock"
> > configuration and replace it with a fully STIGed version - I'm thinking
> this
> > would be best applicable to new installations of RHEL. I understand the
> need
> > for  atomic fixes for pre-existing systems, where the SA has modified the
> > defaults, but I can guarantee you that most people just want a STIG'ed
> box
> > out of the gate on install. I'm just trying to think in terms of long
> term
> > and short term goals - the quicker we can satisfy the majority of the
> users
> > (the ones that want something STIG'ed out of the box) the better
> acceptance
> > the product will have, the long term should be to modify things for the
> > people that mucked with their configurations, which I'm arguing is a
> > minority.
>
> Well, not really.  I've set up ssg for several clients and not a single one
> wants to use it as is, they have all different requirements.  Some need a
> different banner, some different password parameters, some different ssh,
> etc.  All I'm saying is my experience is that most want to modify.
>
> --
> Brian Millett
> "The guerrillas, whose ancestors migrated to Mars from Earth over the past
>  hundred years, have demanded independence for the Mars Colony or, and I
>  quote, 'The sand will run red with Earther blood.'"
>    -- [ Derek Mobotabwe, ISN News, "A Voice in the Wilderness I"]
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131005/d296fc07/attachment-0001.html>


More information about the scap-security-guide mailing list