Scap for Centos

Andrew Gilmore agilmore2 at
Thu May 22 22:14:31 UTC 2014

I don't get it. Reading this line from the FAQ
"No, CentOS releases will follow shortly after the release of Red Hat
Enterprise Linux source. "
leads me to believe that CentOS will be largely usable as it has been, as a
free, completely compatible version of RHEL. Yes, with challenges in errata
availability, but that's the use case.

Suggesting that CentOS is going to be *upstream* of RHEL suggests several
other valuable, but completely different, uses. I'm not sure this is a
great move, as I see bigger challenges coming from the free and polished
desktop side (*cough* Ubuntu).

RHEL 7 should be very interesting.

On Thu, May 22, 2014 at 4:05 PM, Mike Johnson <mikerjohnson at>wrote:

> The VA has adopted the DISA STIG and CentOS has been approved for
> development servers.  I think there are enclave requirements, nevertheless,
> it can be used.
> Mike
>> Date: Thu, 22 May 2014 17:06:32 -0400
>> From: Shawn Wells <shawn at>
>> To: SCAP Security Guide <scap-security-guide at>
>> Subject: Re: Scap for Centos
>> Message-ID: <537E66D8.9040604 at>
>> Content-Type: text/plain; charset=UTF-8; format=flowed
>> On 5/22/14, 3:43 PM, Derek Warner wrote:
>> > Any chance anyone is working on getting SCAP to work on CENTOS? I
>> > would love to use the scap security guide and secstate to validate
>> > CENTOS 6.5. Right now its a manual process going line by line in the
>> > RHEL 5 STIG. I would really love to find out if anyone has anything
>> > automated that works on CENTOS.
>> Given that CentOS isn't allowed on DoD networks, there is no STIG, no
>> common criteria, no support, and doesn't meet any of the mandatory
>> regulatory requirements, what's driving the need?
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the scap-security-guide mailing list