Various False Positives?

Shawn Wells shawn at redhat.com
Tue Sep 3 16:34:01 UTC 2013


On 9/2/13 10:45 PM, Jeffrey Blank wrote:
> This is not quite a practical strategy for us.  We will recommend (and
> even write some Rules for removal of) some software which presents an
> attack surface such as network services, but scope explodes if we
> seriously attempt to configure all potentially installed software.
>
> On Wed, Aug 28, 2013 at 12:57 PM, Hopkins, Robert J CTR BXPP, BXPP
> <robert.j.hopkins1.ctr at navy.mil>  wrote:
>> >I'm not sure about the OSCAP results but if X is installed then you should secure it.  Someone could accidentally set run level 5 or just do a startx and fire it up means any vulnerabilities and/or weaknesses would then be exposed.  If X is not installed, you can probably mark it N/A.
>> >

This loops back to "should servers have desktops installed?" questions. 
For current content, the answer is no... however if someone cares enough 
about X/GNOME/Desktop content and is willing to create & maintain the 
XCCDF and OVAL, patches welcome


More information about the scap-security-guide mailing list