[PATCH 04/13] New remediation

Trevor Vaughan tvaughan at onyxpoint.com
Wed Sep 11 09:36:19 UTC 2013


Heh, I knew that was coming.

I'll put it on my list of patches I'm supposed to work on for the coming
weekend, but unfortunately no promises at this point.

Trevor


On Tue, Sep 10, 2013 at 10:42 AM, Shawn Wells <shawn at redhat.com> wrote:

> On 9/10/13 7:47 AM, Trevor Vaughan wrote:
>
>> I need to look through the SCAP code but, since the order of ciphers is
>> unimportant on the daemon side, wouldn't you want the check side of this to
>> be a regex such that people can use the same cipher setting for both
>> ssh_config and sshd_config?
>>
>> I would modify the order of the remediation statement in this patch to
>> match the strong -> weak order as well as a hint to the local admin.
>>
>> I tend to list from strongest to weakest for ssh_config and just re-use
>> the string in sshd_config for consistency.
>>
>> There should be a check (I apologize if there is and I just didn't check
>> enough) for the Ciphers setting in ssh_config as well to order the ciphers
>> from strongest to weakest since order matters in the client file.
>>
>> Yes, I know that the client file can be overridden by the user but, since
>> most users don't do that, it's a good idea to set it appropriately.
>>
>
> These are really good ideas. I've created a Trac ticket [1] to ensure this
> doesn't get stuck in mailing list limbo. Would you be willing to whip up a
> regex patch?
>
> [1] https://fedorahosted.org/scap-**security-guide/ticket/413<https://fedorahosted.org/scap-security-guide/ticket/413>
>
> ______________________________**_________________
> scap-security-guide mailing list
> scap-security-guide at lists.**fedorahosted.org<scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide<https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide>
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130911/9ab22ad5/attachment.html>


More information about the scap-security-guide mailing list