<div dir="ltr"><div>Jess,<br><br></div>Far as I can tell, it don't work. And that assumes you consider HBSS able to "work"...<br><br>Leam<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 24, 2013 at 3:50 PM, Jess Sightler <span dir="ltr"><<a href="mailto:jsightle@redhat.com" target="_blank">jsightle@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Shawn,<br>
<br>
The RHEL5 verbiage implies that SELinux is unnecessary if HBSS is installed. I do not believe that this is correct.<br>
<br>
The RHEL6 documentation seems to clearly indicate that HBSS is an intrusion detection tool, and SELinux is an intrusion prevention system.<br>
<br>
To me the RHEL6 version is superior.<br>
<br>
Thanks,<br>
Jess<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
----- Original Message -----<br>
> From: "Shawn Wells" <<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>><br>
> To: <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> Sent: Tuesday, September 24, 2013 3:21:10 PM<br>
> Subject: RHEL5 vs RHEL6 language on HBSS<br>
><br>
> I received the following note from a colleague today, outlining the<br>
> wording changes between RHEL5 and RHEL6 regarding HBSS. I searched the<br>
> mailing archives, and can't figure out *why* the language was changed.<br>
><br>
> - Anyone remember why?<br>
> - Objections to reverting to the RHEL5 language?<br>
><br>
> EMail:<br>
> > from the RHEL 6 STIG:<br>
> ><br>
> > ============================<br>
> > Group ID (Vulid): V-38667<br>
> > Group Title: SRG-OS-000196<br>
> > Rule ID: SV-50468r1_rule<br>
> > Severity: CAT II<br>
> > Rule Version (STIG-ID): RHEL-06-000285<br>
> > Rule Title: The system must have a host-based intrusion detection tool<br>
> > installed.<br>
> ><br>
> > Vulnerability Discussion: Adding host-based intrusion detection tools can<br>
> > provide the capability to automatically take actions in response to<br>
> > malicious behavior, which can provide additional agility in reacting to<br>
> > network threats. These tools also often include a reporting capability to<br>
> > provide network awareness of system, which may not otherwise exist in an<br>
> > organization's systems management regime.<br>
> ><br>
> > Check Content:<br>
> > Inspect the system to determine if intrusion detection software has been<br>
> > installed. Verify the intrusion detection software is active.<br>
> > If no host-based intrusion detection tools are installed, this is a<br>
> > finding.<br>
> ><br>
> > Fix Text: The base Red Hat platform already includes a sophisticated<br>
> > auditing system that can detect intruder activity, as well as SELinux,<br>
> > which provides host-based intrusion prevention capabilities by confining<br>
> > privileged programs and user sessions which may become compromised.<br>
> ><br>
> > Install an additional intrusion detection tool to provide complementary or<br>
> > duplicative monitoring, reporting, and reaction capabilities to those of<br>
> > the base platform. For DoD systems, the McAfee Host-based Security System<br>
> > is provided to fulfill this role.<br>
> > ========================<br>
> ><br>
> ><br>
> > to look more like this from the RHEL 5 STIG:<br>
> ><br>
> > =========================<br>
> > Group ID (Vulid): V-782<br>
> > Group Title: GEN006480<br>
> > Rule ID: SV-37746r2_rule<br>
> > Severity: CAT II<br>
> > Rule Version (STIG-ID): GEN006480<br>
> > Rule Title: The system must have a host-based intrusion detection tool<br>
> > installed.<br>
> ><br>
> > Vulnerability Discussion: Without a host-based intrusion detection tool,<br>
> > there is no system-level defense when an intruder gains access to a system<br>
> > or network. Additionally, a host-based intrusion detection tool can<br>
> > provide methods to immediately lock out detected intrusion attempts.<br>
> ><br>
> > Responsibility: System Administrator<br>
> > IAControls: ECID-1<br>
> ><br>
> > Check Content:<br>
> > Ask the SA or IAO if a host-based intrusion detection application is loaded<br>
> > on the system. The preferred intrusion detection system is McAfee HBSS<br>
> > available through Cybercom. If another host-based intrusion detection<br>
> > application, such as SELinux, is used on the system, this is not a<br>
> > finding.<br>
> > =========================<br>
> ><br>
> > People are getting confused and SElinux and HBSS are getting installed with<br>
> > SElinux being disabled to make things work.<br>
><br>
><br>
><br>
> _______________________________________________<br>
> scap-security-guide mailing list<br>
> <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
><br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div><a href="http://leamhall.blogspot.com/" target="_blank">Mind on a Mission</a></div>
</div>