<div dir="ltr"><div><div><div><div><div><div>Well, in many cases it goes like this:<br><br></div>1) Read SCAP Guide<br></div>2) Do SCAP Guide<br></div>3) OMG, I need &lt;link-foo&gt;<br></div>4) Let&#39;s find the one guy in the area that has an account and can look this up for us!<br>
<br></div>The idea that everyone can login to the RH site is OK so long as *everyone* at the organization can actually log into the RH site ;-).<br><br></div>Trevor<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Mon, Aug 11, 2014 at 4:23 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><div class="">
    <br>
    <div>On 8/11/14, 6:43 AM, Trevor Vaughan
      wrote:<br>
    </div>
    <blockquote type="cite">
      <div dir="ltr">Hmm....for a public guide, shouldn&#39;t the solution
        be public as well?</div>
    </blockquote>
    <br></div>
    It&#39;s public to anyone who has a subscription to the operating system
    for which the guide is written ;) <br>
    <br>
    Your point is well taken though. Reading a doc that sends you to
    another doc is beyond a slight annoyance. When authoring the patch,
    there were really two reasons I had for sending to
    <a href="http://access.redhat.com" target="_blank">access.redhat.com</a>:<br>
    <br>
    1) As any underlying components and processes change, that URL will
    stay constant, and big RHT will maintain currency. I&#39;m not sure if
    anyone within SSG will be monitoring CAC enablement that closely
    which is why my own initial reaction was to post to a known
    authoritative and known current document;<br>
    <br>
    2) I rarely hear of CAC enablement going as straightforward as the
    docs say, and SSG shouldn&#39;t be a helpdesk for those seeking CAC
    configurations. I&#39;d rather have big RHT handle that, and by giving
    the URL to <a href="http://access.redhat.com" target="_blank">access.redhat.com</a>, users are put into a help forum where
    they can post comments, tell big RHT that CAC is broke, etc.<span class="HOEnZb"><font color="#888888"><br>
    <br>
    <br>
    Shawn</font></span><div><div class="h5"><br>
    <br>
    <blockquote type="cite">
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Thu, Aug 7, 2014 at 12:44 AM, Shawn
          Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Updated
            XCCDF to reflect location of vendor docs on integrating
            SSH+CAC cards<br>
            <br>
            Signed-off-by: Shawn Wells &lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;<br>
            ---<br>
             RHEL/6/input/system/accounts/physical.xml |    4 ++++<br>
             1 files changed, 4 insertions(+), 0 deletions(-)<br>
            <br>
            diff --git a/RHEL/6/input/system/accounts/physical.xml
            b/RHEL/6/input/system/accounts/physical.xml<br>
            index c9d1958..db5fb66 100644<br>
            --- a/RHEL/6/input/system/accounts/physical.xml<br>
            +++ b/RHEL/6/input/system/accounts/physical.xml<br>
            @@ -403,6 +403,10 @@ To enable smart card authentication,
            consult the documentation at:<br>
             &lt;ul&gt;<br>
             &lt;li&gt;<a href="https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html" target="_blank">https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html</a>&lt;/li&gt;<br>

             &lt;/ul&gt;<br>
            +For guidance on enabling SSH to authenticate against CAC
            cards, consult documentation at:<br>
            +&lt;ul&gt;<br>
            +&lt;li&gt;<a href="https://access.redhat.com/solutions/82273" target="_blank">https://access.redhat.com/solutions/82273</a>&lt;/li&gt;<br>
            +&lt;/ul&gt;<br>
             &lt;/description&gt;<br>
             &lt;ocil clause=&quot;non-exempt accounts are not using CAC
            authentication&quot;&gt;<br>
             Interview the SA to determine if all accounts not exempted
            by policy are<br>
            <span><font color="#888888">--<br>
                1.7.1<br>
                <br>
                --<br>
                SCAP Security Guide mailing list<br>
                <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
                <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
                <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></font></span></blockquote>
        </div>
        <br>
      </div>
    </blockquote>
    <br>
  </div></div></div>

<br>--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br></blockquote></div><br><br clear="all"><br>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>
(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>