Issue with PASS_MIN_DAYS validation

Shawn Wells shawn at redhat.com
Fri Oct 25 00:47:34 UTC 2013


On 10/24/13, 2:12 PM, wm-lists wrote:
> Shawn, Happy to contribute.  As I get it together, I'll provide what I 
> have.  I have a PCI-DSS QSA onsite for the foreseeable future to 
> validate what I'm doing against the PCI-DSS 2.0 standards (3.0 will be 
> out soon enough)..

If you're willing, as you create your profile, check which OVAL checks 
you're using have been signed off. The signed off ones will have a line 
similar to the following, somewhere in the <metadata> tags:
> <reference source="DS" ref_id="20130928" ref_url="test_attestation" />

Give the list a shout if/as you find things without signoff. It'll help 
prioritize OVAL unit testing, especially since we'll know which ones are 
used within your PCI profile.

> I use openscap in conjunction with Red Hat Satellite for reporting 
> purposes to validate in scope systems
How do you manage distributing the SCAP RPMs to the clients? There's 
been a few writeups about custom RHN channels, dropping the XCCDF into 
configuration channels, etc.... very interested to see how things are 
being done in field deployments!


More information about the scap-security-guide mailing list