<div dir="ltr"><div>Hmm, I remember being lambasted about not having NTP auth syncing enabled and chronyd doesn&#39;t appear to support this.<br><br></div>Thoughts?<br><br>Trevor<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 6, 2014 at 12:09 PM, Jan Lieskovsky <span dir="ltr">&lt;<a href="mailto:jlieskov@redhat.com" target="_blank">jlieskov@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">----- Original Message -----<br>
&gt; From: &quot;Gabe Alford&quot; &lt;<a href="mailto:redhatrises@gmail.com">redhatrises@gmail.com</a>&gt;<br>
&gt; To: &quot;SCAP Security Guide&quot; &lt;<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;<br>
&gt; Sent: Saturday, October 4, 2014 6:43:24 PM<br>
&gt; Subject: Re: RHEL 7 Direction<br>
&gt;<br>
&gt;<br>
</span><span class="">&gt; On Fri, Oct 3, 2014 at 5:08 PM, Shawn Wells &lt; <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> &gt; wrote:<br>
&gt;<br>
&gt;<br>
&gt; On 10/3/14, 3:31 PM, Crawford, Nicholas P CTR USARMY CERDEC (US) wrote:<br>
&gt; &gt;<br>
&gt; &gt; Greetings,<br>
&gt; &gt;<br>
&gt; &gt;<br>
&gt; &gt;<br>
&gt; &gt; I had a couple of questions about the direction the RHEL 7 SSG will be<br>
&gt; &gt; going;<br>
&gt; &gt;<br>
&gt; &gt;<br>
&gt; &gt;<br>
&gt; &gt; Particularly with the below new subsystems in 7;<br>
&gt; &gt;<br>
&gt; &gt; gconf vs dconf (GNOME 2 vs GNOME 3)<br>
&gt;<br>
&gt; Some applications do use gconf still, but I believe gnome requires dconf in<br>
&gt; RHEL7 since it is GNOME3. There is an existing pull request for converting<br>
&gt; most of the gconf settings to dconf.<br>
&gt;<br>
&gt;<br>
&gt; &gt; Has there been a decision on how to check and remediate with dconf?<br>
&gt; &gt; iptables vs firewalld<br>
&gt;<br>
&gt; iptables and firewalld conflict each other so one or the other (preferably<br>
&gt; firewalld).<br>
<br>
</span>+1 for firewalld due to ability to apply changes runtime (without disrupting<br>
existing connections) + due to concept of zones:<br>
  <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Migration_Planning_Guide/sect-Red_Hat_Enterprise_Linux-Migration_Planning_Guide-Security_and_Access_Control.html" target="_blank">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Migration_Planning_Guide/sect-Red_Hat_Enterprise_Linux-Migration_Planning_Guide-Security_and_Access_Control.html</a><br>
<span class=""><br>
&gt;<br>
&gt;<br>
&gt; &gt; Has there been a decision on which method will go forward for<br>
&gt; &gt; check / remediation?<br>
&gt; &gt; chrony vs ntpd<br>
&gt;<br>
&gt; No decision has been made on this as I am aware.<br>
<br>
</span>Comparison why chronyd might be preferred before ntpd:<br>
  <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html#sect-differences_between_ntpd_and_chronyd" target="_blank">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html#sect-differences_between_ntpd_and_chronyd</a><br>
<span class=""><br>
&gt;<br>
&gt;<br>
&gt; &gt; Has there been a decision on which to use and which will go<br>
&gt; &gt; forward for check / remediation?<br>
&gt; &gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; Actually, there hasn&#39;t been much conversation on this. Thanks for<br>
&gt; starting the conversation!<br>
&gt;<br>
&gt; IMO, we should start with system defaults as first/primary goal, then<br>
&gt; enable secondary configs in future passes. aka, address firewalld first<br>
&gt; then iptables.<br>
&gt;<br>
&gt; If we&#39;re able to get both done at the same time, then great -- but focus<br>
&gt; should be on system default first.<br>
&gt;<br>
&gt; What does everyone think of such an approach?<br>
&gt;<br>
&gt; +1<br>
<br>
</span>Commented on this in previous post.<br>
<span class="im HOEnZb"><br>
Thank you &amp;&amp; Regards, Jan.<br>
--<br>
Jan iankko Lieskovsky / Red Hat Security Technologies Team<br>
</span><div class="HOEnZb"><div class="h5">--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br><br clear="all"><br>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>