<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 9/3/14, 12:09 AM, Vincent Passaro
wrote:<br>
</div>
<blockquote
cite="mid:5DABCB42-6CA9-48FE-A735-9CBF1F45E421@buddhalabs.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Phillip,
<div><br>
</div>
<div>Aqueduct definitely has the most options (Ansible / Puppet /
Bash) for DISA STIG remediation. </div>
<div><br>
</div>
<div>Cheers,<br>
<div>
<div apple-content-edited="true"><br>
<meta http-equiv="Content-Type" content="text/html;
charset=UTF-8">
<meta name="format-detection" content="telephone=no">
</div>
<div apple-content-edited="true"><font size="3">Vince</font></div>
<br>
<div>
<div>On Sep 2, 2014, at 9:03 PM, Philip Shuman <<a
moz-do-not-send="true"
href="mailto:philip.shuman@sri.com">philip.shuman@sri.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">Are the Aqueduct remediation scripts
still the best available place to start for implementing
requested changes from the DISA STIG findings for RHEL5
and RHEL6?</blockquote>
</div>
</div>
</div>
</blockquote>
<br>
<br>
Aqueduct is pretty much the only location with RHEL5 scripts. And
like Vince pointed out, Aqueduct also has Puppet and Ansible. IIRC,
the Puppet scripts were contributed by Maura Dailey earlier this
summer, and represented NSA open sourcing their baseline. Everything
Aqueduct has is reputable and very tested.<br>
<br>
A benefit of SSG is that scanning/remediation is tightly integrated
through human-readable prose guides, scanning/evaluation, and
remediation. A single change within SSG (say, to tailor password
lengths) will automatically trickle to prose guides (XCCDF),
evaluation (OVAL), and remediation (bash scripts). SSG also benefits
from a vibrant community, and further, will be shipping natively in
RHEL 6.6+.<br>
<br>
A third option would be to evaluate the STIG kickstart builder Red
Hat Gov released to GitHub:<br>
<a class="moz-txt-link-freetext" href="https://github.com/RedHatGov/stig-fix-el6-kickstart">https://github.com/RedHatGov/stig-fix-el6-kickstart</a><br>
<br>
It wraps SSG + stig-fix scripts + banners into a customized
installation DVD/ISO. Many of the remediation scripts were
originally sourced from Aqueduct.<br>
<br>
<br>
<br>
</body>
</html>