scap-security-guide September 2014

scap-security-guide@lists.fedorahosted.org

23 participants
27 discussions

Confirming install requirements to build scap-security-guide
by Greg Elin 11 Sep '14

11 Sep '14

It was a fair amount of web searching and a couple of hours of trying to work this out. It seemed a odd that the information was so scarce and I'd need install and enable EPEL and so much in order to make. I guess if this is the case, I would have just expected more warning from SSG docs. So I want to make sure I am actually doing this right and have a little discussion before creating a pull request. https://github.com/OpenSCAP/scap-security-guide/issues/206 Greg Elin http://govready.org - Making FISMA compliance easier for innovators email: gregelin(a)gitmachines.com phone: 917-304-3488

4 5

RE: New report and guide in openscap 1.1.0
by Chen, Wei (Contractor)(CFPB) 09 Sep '14

09 Sep '14

Couple comments on the report layout. • Rules result breakdown - while the color bar breakdown is nice, it doesn't present precise information at first glance. The user will see 86 passed, 131 failed, and left guessing what that remaining 6 rules are. It'll be nice to see the total number of rules as well. • Failed rules by severity breakdown – similar to rules results, the severity description got cut off even though it’s easy to assume that the two failed rules refer to High severity. • Score – it’ll be nice to have a brief explanation or reference to how the scoring is done for those not familiar with the scoring system. • Section heading – I think the number of “not checked” should also be included in the section heading along with fail and unknown. For example, I could’ve easily missed “Ensure Software Patches Installed” since it was collapsed within Updating Software section. Regards, Wei ----- Original Message ----- > From: "Martin Preisler" <mpreisle(a)redhat.com<mailto:mpreisle@redhat.com>> > To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> > Sent: Thursday, August 28, 2014 7:49:23 PM > Subject: New report and guide in openscap 1.1.0 > > Hi, > > as you may know I have been working on a complete rewrite of HTML > report and guide for the upcoming openscap 1.1.0 release. It's a > feature that will touch almost every user of openscap. I would like to > gather feedback from the scap-security-guide community so that we can > make sure there aren't any blocker issues in the release. It is > natural that there will be small issues that we will iron out in minor > releases. Basically we would just like to make sure the new report and > guide aren't missing anything crucial that would prevent adoption. > > See https://mpreisle.fedorapeople.org/openscap/1.1.0_xslt/ for sample > HTML report and guide from SSG for RHEL6. > > Looking forward to feedback. > > -- > Martin Preisler > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/

2 3

Remediation advice for RHEL 5 and 6
by Philip Shuman 09 Sep '14

09 Sep '14

Are the Aqueduct remediation scripts still the best available place to start for implementing requested changes from the DISA STIG findings for RHEL5 and RHEL6? Thanks, Philip

9 18

Systemd enabled OpenSCAP for RHEL7
by Šimon Lukašík 07 Sep '14

07 Sep '14

Hey guys, For the purpose of policy authoring (specially writing systemd content for RHEL7), I have create build of the latest openscap at http://koji.fedoraproject.org/koji/taskinfo?taskID=7537277 These packages are compatible with Red Hat Enterprise Linux 7. Once this scratch build expires the packages will remain available at: https://isimluk.fedorapeople.org/openscap/1.1.0-0.1.test.el7/ I have started playing with systemd content at https://github.com/isimluk/scap-security-guide/compare/rhel7_systemd But that still needs some love. Thanks Shawn for introducing check/templates to me! -- Simon Lukasik Security Technologies, Red Hat, Inc.

2 1

GitHub Contributing Wiki Page
by Gabe Alford 07 Sep '14

07 Sep '14

Hello, I have added a wiki page for contributing on GitHub for our project here <https://github.com/OpenSCAP/scap-security-guide/wiki/Contributing>. Please let me know what you think and what needs to be added/deleted. If the fedorahosted wiki is what needs to be updated and used for a wiki instead of GitHub, I can do that as well. Thanks, Gabe

2 1

Auditd Fail
by Margaret M Sanders 05 Sep '14

05 Sep '14

Hello....I've been lurking around trying to pick up tidbits for Linux. I actually have RHEL 5---but need some help w/ a problem regarding the auditing. I used SECSCN to modify my audit.rules, following their instructions. My auditd will not start. When I look at the messages, it tells me that permissions are denied. The permissions for my auditd.conf and audit.rules are rwx--r--r. When I go to services and try to stop---stop is successful. But when I try to start, start fails. My run levels are 1-5 on. What else am I missing? The auditd.conf is exactly the same as my auditd.conf for my CentOS 6.2 which is right next to the RHEL 5. It works fine. I'd appreciate either some help in the form of troubleshooting--or a link to the "right" forum for this question. Thank you, M. Sanders ISSO, SwRI 210-522-6862

3 2

Implementing GitHub Milestones
by Gabe Alford 04 Sep '14

04 Sep '14

Hello list, I was thinking/pondering about this today, and was wondering if our project should implement milestones on GitHub. This way we can see the pull requests by milestone (historical) and set loose expectations about future milestones. (I say loose because priorities change, no one may be currently working on an issue, etc.) Milestones could match the existing versioning with scap-security-guide releases. (0.19, 0.20, etc.) Any pull request that is merged without an existing issue would be added to the existing milestone. Any issue that is not fixed in time for the monthly release will be moved to the next milestone. An example would be here: https://github.com/Netflix/Hystrix/milestones It may be beneficial, or might just be added process/work without a lot of beneficial use. Thoughts? Thanks, Gabe

3 13

git pull requests final review
by Gabe Alford 04 Sep '14

04 Sep '14

Hello, I have the following git pull requests below that need final review. I can merge if ack'ed - https://github.com/OpenSCAP/scap-security-guide/pull/38 - https://github.com/OpenSCAP/scap-security-guide/pull/33 - https://github.com/OpenSCAP/scap-security-guide/pull/30 Thanks, Gabe

2 2

Continuing the Project Management thread... Kanban boards
by Shawn Wells 04 Sep '14

04 Sep '14

In prep for formal sprints (e.g. RHEL 7 STIG), I was checking out HuBoard, which is a "Kanban meets GitHub" system: https://huboard.com/?controller=features#features Or: https://huboard.com/OpenSCAP/scap-security-guide/ It queries GH for open tickets/pull requests and sets up the standard agile/sprint boards. We can drag/drop items between different stages to easily see where things are. Perhaps could be used to create tickets for the various RHEL 7 STIG requirements, people can signup to take one, move to done (which sets off workload for a peer review/ack/merge). Useful? Any known alternatives?

2 1

Best ways to say this system is not compliant
by Greg Elin 04 Sep '14

04 Sep '14

Several participants in the thread "Re: New report and guide in openscap 1.1.0" raised concerned over a language "The system is not compliant!" in the report. I agree. "not compliant" ideally should only be done against a policy established by an organization for that system. The assessment and passing of any set of controls != compliance, it is a step toward compliance. Public profiles are, generally speaking, against *baselines*. It would be great if the use of OpenSCAP and SSG inspired/encouraged Departments and Agencies to develop and manage their own profiles that build on top of the baseline profiles. For example, if a test is run against a default profile, feedback should emphasize the profile is a default profile and encourage organization to maintain their own organizational profiles. Imagine if by default OpenSCAP tried to find to an agency's default repository of profiles. If no agency-defined repository existed, OpenSCAP would communicate it "No agency-specific profiles available. To create agency specific profiles blah, blah...OpenSCAP using default SCAP-Security-Guide baseline profile blah, blah, blah." This would constantly remind users they should be managing their own set of profiles. Of course, managing drift among agency specific profiles vs the baselines becomes another issue -- but that is something further for OpenSCAP and SSG to assist. Greg Elin http://govready.org - Making FISMA compliance easier for innovators email: gregelin(a)gitmachines.com phone: 917-304-3488

4 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2014