[PATCH 04/13] New remediation

Trevor Vaughan tvaughan at onyxpoint.com
Tue Sep 10 11:47:24 UTC 2013


I need to look through the SCAP code but, since the order of ciphers is
unimportant on the daemon side, wouldn't you want the check side of this to
be a regex such that people can use the same cipher setting for both
ssh_config and sshd_config?

I would modify the order of the remediation statement in this patch to
match the strong -> weak order as well as a hint to the local admin.

I tend to list from strongest to weakest for ssh_config and just re-use the
string in sshd_config for consistency.

There should be a check (I apologize if there is and I just didn't check
enough) for the Ciphers setting in ssh_config as well to order the ciphers
from strongest to weakest since order matters in the client file.

Yes, I know that the client file can be overridden by the user but, since
most users don't do that, it's a good idea to set it appropriately.

Thanks,

Trevor


On Mon, Sep 9, 2013 at 8:47 AM, Jeffrey Blank <blank at eclipse.ncsc.mil>wrote:

> In the glorious future, we might want to rewrite the check and the
> guidance to indicate which cipher modes and key lengths we like, and
> then only flag things if others are included.  But this looks fine for
> now.
>
> How these are "approved" is quite a mystery as well, but no biggie, we
> can work in refs later.
>
> On Sat, Sep 7, 2013 at 3:22 PM, Shawn Wells <shawn.d.wells at gmail.com>
> wrote:
> >
> >
> > _______________________________________________
> > scap-security-guide mailing list
> > scap-security-guide at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130910/8721ed4e/attachment.html>


More information about the scap-security-guide mailing list