Why is Fedora xccdf missing so much compared to RHEL?

Bruno Wolff III bruno at wolff.to
Thu Sep 17 19:22:44 UTC 2015


On Thu, Sep 17, 2015 at 10:33:27 -0400,
  Jan Lieskovsky <jlieskov at redhat.com> wrote:
>
> Hello Bruno,
>
>  thank you for reaching out and checking with us!

Thanks for responding.

>
>This is where further feedback from the Fedora users community (via downstream
>bugs or via upstream tickets would be appreciated). For example would we
>know there are a lot of tickets requesting support for httpd service scans,
>we could prioritize that service before others in that release, etc.

Where this question comes from is at work a number of us use linux desktops 
with a mix of Fedora, OpenSUSE and other distros. We also run RHEL on a lot 
of severs. The security office would like audits of these machines, mostly 
to make sure they are "patched". Though we think config checking would 
be more useful as we all are good about keeping our machines up to date. 
Their proposal is to provide them with credentials (elevated access rights 
may or may not be requested) to allow more detailed scans than they now do. 
We aren't too comfortable with opening up machines this way, especially root 
access.

I knew about SCAP and did some digging and it seemed like it could be used 
to do a better job (than nexpose) for our RHEL boxes. We have plently of 
workstation licenses and could standardize on RHEL 7 based workstations and do 
centralized scap reporting. However it would be nice to be able to continue 
to run Fedora. The SCAP support there doesn't currently check for being up 
to date, even without CVE checks. Plus the config checking has a lot less 
stuff available. Update checking in Fedora also has problems that RHEL 
doesn't, as soname bumps can block some updates, particularly when running 
rawhide, branched or updates-testing.

I'll eventually look at using SCAP at home, but for now my main interest 
is for work.

>Doing CVE checks (vulnerability assessment) and security hardening are
>two different things. In order to perform reliable "CVE checks" we would
>need to have authorized and updates source of CVE OVAL definitions for
>Fedora. 

I expected this to be hard. It is a nice feature of RHEL, but Red Hat 
has income from RHEL to pay for people to do that. Getting people to 
reliably do that work in Fedora would be hard unless it could be automated 
using bohdi and bugzilla data somehow.


More information about the scap-security-guide mailing list