<div dir="ltr"><div><div><div><div><div><div>Well, in many cases it goes like this:<br><br></div>1) Read SCAP Guide<br></div>2) Do SCAP Guide<br></div>3) OMG, I need <link-foo><br></div>4) Let's find the one guy in the area that has an account and can look this up for us!<br>
<br></div>The idea that everyone can login to the RH site is OK so long as *everyone* at the organization can actually log into the RH site ;-).<br><br></div>Trevor<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Mon, Aug 11, 2014 at 4:23 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div class="">
<br>
<div>On 8/11/14, 6:43 AM, Trevor Vaughan
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Hmm....for a public guide, shouldn't the solution
be public as well?</div>
</blockquote>
<br></div>
It's public to anyone who has a subscription to the operating system
for which the guide is written ;) <br>
<br>
Your point is well taken though. Reading a doc that sends you to
another doc is beyond a slight annoyance. When authoring the patch,
there were really two reasons I had for sending to
<a href="http://access.redhat.com" target="_blank">access.redhat.com</a>:<br>
<br>
1) As any underlying components and processes change, that URL will
stay constant, and big RHT will maintain currency. I'm not sure if
anyone within SSG will be monitoring CAC enablement that closely
which is why my own initial reaction was to post to a known
authoritative and known current document;<br>
<br>
2) I rarely hear of CAC enablement going as straightforward as the
docs say, and SSG shouldn't be a helpdesk for those seeking CAC
configurations. I'd rather have big RHT handle that, and by giving
the URL to <a href="http://access.redhat.com" target="_blank">access.redhat.com</a>, users are put into a help forum where
they can post comments, tell big RHT that CAC is broke, etc.<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
Shawn</font></span><div><div class="h5"><br>
<br>
<blockquote type="cite">
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Aug 7, 2014 at 12:44 AM, Shawn
Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Updated
XCCDF to reflect location of vendor docs on integrating
SSH+CAC cards<br>
<br>
Signed-off-by: Shawn Wells <<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>><br>
---<br>
RHEL/6/input/system/accounts/physical.xml | 4 ++++<br>
1 files changed, 4 insertions(+), 0 deletions(-)<br>
<br>
diff --git a/RHEL/6/input/system/accounts/physical.xml
b/RHEL/6/input/system/accounts/physical.xml<br>
index c9d1958..db5fb66 100644<br>
--- a/RHEL/6/input/system/accounts/physical.xml<br>
+++ b/RHEL/6/input/system/accounts/physical.xml<br>
@@ -403,6 +403,10 @@ To enable smart card authentication,
consult the documentation at:<br>
<ul><br>
<li><a href="https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html" target="_blank">https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html</a></li><br>
</ul><br>
+For guidance on enabling SSH to authenticate against CAC
cards, consult documentation at:<br>
+<ul><br>
+<li><a href="https://access.redhat.com/solutions/82273" target="_blank">https://access.redhat.com/solutions/82273</a></li><br>
+</ul><br>
</description><br>
<ocil clause="non-exempt accounts are not using CAC
authentication"><br>
Interview the SA to determine if all accounts not exempted
by policy are<br>
<span><font color="#888888">--<br>
1.7.1<br>
<br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></font></span></blockquote>
</div>
<br>
</div>
</blockquote>
<br>
</div></div></div>
<br>--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br></blockquote></div><br><br clear="all"><br>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>
(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>