[PATCH] Updated Smart Card XCCDF to reflect SSH+CAC docs

Shawn Wells shawn at redhat.com
Mon Aug 11 20:23:04 UTC 2014


On 8/11/14, 6:43 AM, Trevor Vaughan wrote:
> Hmm....for a public guide, shouldn't the solution be public as well?

It's public to anyone who has a subscription to the operating system for 
which the guide is written ;)

Your point is well taken though. Reading a doc that sends you to another 
doc is beyond a slight annoyance. When authoring the patch, there were 
really two reasons I had for sending to access.redhat.com:

1) As any underlying components and processes change, that URL will stay 
constant, and big RHT will maintain currency. I'm not sure if anyone 
within SSG will be monitoring CAC enablement that closely which is why 
my own initial reaction was to post to a known authoritative and known 
current document;

2) I rarely hear of CAC enablement going as straightforward as the docs 
say, and SSG shouldn't be a helpdesk for those seeking CAC 
configurations. I'd rather have big RHT handle that, and by giving the 
URL to access.redhat.com, users are put into a help forum where they can 
post comments, tell big RHT that CAC is broke, etc.


Shawn

>
>
> On Thu, Aug 7, 2014 at 12:44 AM, Shawn Wells <shawn at redhat.com 
> <mailto:shawn at redhat.com>> wrote:
>
>     Updated XCCDF to reflect location of vendor docs on integrating
>     SSH+CAC cards
>
>     Signed-off-by: Shawn Wells <shawn at redhat.com
>     <mailto:shawn at redhat.com>>
>     ---
>      RHEL/6/input/system/accounts/physical.xml |    4 ++++
>      1 files changed, 4 insertions(+), 0 deletions(-)
>
>     diff --git a/RHEL/6/input/system/accounts/physical.xml
>     b/RHEL/6/input/system/accounts/physical.xml
>     index c9d1958..db5fb66 100644
>     --- a/RHEL/6/input/system/accounts/physical.xml
>     +++ b/RHEL/6/input/system/accounts/physical.xml
>     @@ -403,6 +403,10 @@ To enable smart card authentication, consult
>     the documentation at:
>      <ul>
>      <li>https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html</li>
>      </ul>
>     +For guidance on enabling SSH to authenticate against CAC cards,
>     consult documentation at:
>     +<ul>
>     +<li>https://access.redhat.com/solutions/82273</li>
>     +</ul>
>      </description>
>      <ocil clause="non-exempt accounts are not using CAC authentication">
>      Interview the SA to determine if all accounts not exempted by
>     policy are
>     --
>     1.7.1
>
>     --
>     SCAP Security Guide mailing list
>     scap-security-guide at lists.fedorahosted.org
>     <mailto:scap-security-guide at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>     https://github.com/OpenSCAP/scap-security-guide/
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140811/d8f0fdce/attachment.html>


More information about the scap-security-guide mailing list