[PATCH 0001-0003] - various ssh and gconf fixes

Gabe Alford redhatrises at gmail.com
Mon Jul 7 17:29:37 UTC 2014


Hello,

     Just wondering if this is in the queue to be looked at. :)

Thanks,

Gabe


On Mon, Jun 30, 2014 at 8:29 AM, Gabe Alford <redhatrises at gmail.com> wrote:

> Hello,
>
> These patches should address a few sshd false positives [Patch 0001] and
> add support for %gconf-tree.xml [Patch 0002] as well as a recommendation to
> change remediation for the GDM login banner from a gdm user default to a
> gconf mandatory setting [Patch 0003].
>
> [Patch 0001]:
>
>       When initially running the scan, some sshd settings such as
> PermitRootLogin were showing that they were set correcly. This patch should
> fix those as well as hopefully address
> https://fedorahosted.org/scap-security-guide/ticket/434
>
>
> [Patch 0002]:
>
>       Adds support to check %gconf-tree.xml. If %gconf-tree.xml exists
> (such as being deployed through Satellite), it takes precedence over any
> directory containing a %gconf.xml file under
> /etc/gconf/gconf.xml.mandatory. Plus having a single configuration file to
> create/change/modify is always a plus. Could potentially help address
> https://fedorahosted.org/scap-security-guide/ticket/282
>
>
> [Patch 0003]:
>
>       This is a recommendation to move setting the gdm banner and login
> settings from /var/lib/gdm to /etc/gconf/gconf.xml.mandatory. Reason for
> this is that the /etc/gconf directory is the location for administrators to
> set mandatory system policies over user set policies. Plus due to the gconf
> order of processing/precedance, it would be recommended to set under /etc
> rather than /var as anything set as a mandatory policy would be the default
> no matter what was in /var/lib/gdm. If approved, would potentially address
> https://fedorahosted.org/scap-security-guide/ticket/319
>
> Thanks,
>
> Gabe
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140707/500c9f2b/attachment-0001.html>


More information about the scap-security-guide mailing list