scap-security-guide November 2018

scap-security-guide@lists.fedorahosted.org

12 participants
8 discussions

Cron, at, and sudo rules pointless? (and some other goodies)
by Trevor Vaughan 06 Dec '18

06 Dec '18

Hi All, In my never ending quest to find new and annoying ways to do everything, I figured that I'd throw out the new list of fun. 1. Using pkexec makes sudo relatively pointless. Sure, it logs things, but we now effectively have two sudo subsystems and one can't really have the rules audited per my last discussion with Steve because JavaScript as a configuration language is amazing. Not sure what to do about this one but people should really be watching for it and I don't see any mention of it in the rules anywhere. 2. Systemd timers can be run in user mode and effectively make all the restrictions around cron and at pointless from what I can tell. So far, I can't figure out how to disable user space timers or 'systemctl --user' calls without completely removing 'pam_systemd' from the stack. No idea what this would break but it's probably the only solution right now (or maybe having a group-based jump stack in PAM). 3. There should probably be some sort of check to make sure that 'enable-linger' has not been set for users. In summary, the SSG simply does not cover any of the new EL7+ capabilities very well, particularly those that replace traditional services that are already expected to be controlled. As systemd becomes more of an operating system and less of service manager, this will only get worse. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

3 7

Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
by Trevor Vaughan 02 Dec '18

02 Dec '18

Heh, no offense taken. I just needed to turn the little lights green with a .ckl file...and I did :-D On Wed, Nov 28, 2018 at 11:37 AM Brent Kimberley <Brent.Kimberley(a)durham.ca> wrote: > No disrespect intended. That’s exactly what I would do under the > circumstances. > > > > *From:* Brent Kimberley > *Sent:* Wednesday, November 28, 2018 11:36 AM > *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org> > *Subject:* RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 > is EOL in January 2019? > > > > That speaks volumes. > > > > http://www.crosstalkonline.org/back-issues/ > > > > *From:* Trevor Vaughan [mailto:tvaughan@onyxpoint.com > <tvaughan(a)onyxpoint.com>] > *Sent:* Wednesday, November 28, 2018 11:31 AM > *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org> > *Subject:* Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 > is EOL in January 2019? > > > > Brent, that may be the funniest message I've ever read. > > > > There isn't one, I just reverse engineered it from the pseudo-XML that it > outputs. > > > > On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca> > wrote: > > Where can I find the controlled schema / ICD / metadata for the checklist > file format? > > > > *From:* Trevor Vaughan [mailto:tvaughan@onyxpoint.com] > *Sent:* Wednesday, November 28, 2018 9:02 AM > *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org> > *Subject:* Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 > is EOL in January 2019? > > > > Yep, this is the one. > > > > That said, if you dig through the archives of this mailing list, I figured > out how to create the bare minimum .ckl file that you need for reporting so > that should give people a head start. > > > > On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com> wrote: > > The .ckl issue is the answer to why use. I know not everyone works for > gov't entities, but they typically require it, with very little options for > other products. Management likes graphs and charts. > > > > On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com > wrote: > > On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote: > > > > > > On 11/27/18 2:06 PM, James Ralston wrote: > > > I apologize if this is a little off-topic for this list, but a > > > question: what are others who use STIG Viewer planning to do once > > > Oracle JDK 8 / JavaFX go EOL in January 2019? > > > > [...] > > > Ideally, I'd like to find a Linux replacement for STIG > > > Viewer—something that can read, annotate, and write STIG Viewer > > > checklist (*.ckl) files. But although SCAP Workbench can load and > > > check STIGs, unless I'm missing something, it has no support for STIG > > > Viewer checklist files. > > > > Not being snide, should this come across wrongly.... genuine question: > > Why use STIG Viewer in the first place? > > > > The STIG Viewer produces *.ckl checklist files, which some auditors and > many security departments want. > > V/r, > James Cassell > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > > > -- > > Trevor Vaughan > Vice President, Onyx Point, Inc > > (410) 541-6699 x788 > > > -- This account not approved for unencrypted proprietary information -- > > THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY > CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR > EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to > any privilege have been waived. If you are not the intended recipient, you > are hereby notified that any review, re-transmission, dissemination, > distribution, copying, conversion to hard copy, taking of action in > reliance on or other use of this communication is strictly prohibited. If > you are not the intended recipient and have received this message in error, > please notify me by return e-mail and delete or destroy all copies of this > message. > > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > > > -- > > Trevor Vaughan > Vice President, Onyx Point, Inc > > (410) 541-6699 x788 > > > -- This account not approved for unencrypted proprietary information -- > THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY > CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR > EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to > any privilege have been waived. If you are not the intended recipient, you > are hereby notified that any review, re-transmission, dissemination, > distribution, copying, conversion to hard copy, taking of action in > reliance on or other use of this communication is strictly prohibited. If > you are not the intended recipient and have received this message in error, > please notify me by return e-mail and delete or destroy all copies of this > message. > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

7 14

RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
by Brent Kimberley 28 Nov '18

28 Nov '18

Lt Col Tom summed it up as follows: https://turing.cs.hbg.psu.edu/comp413/cimm.pdf From: Brent Kimberley Sent: Wednesday, November 28, 2018 11:38 AM To: 'SCAP Security Guide' <scap-security-guide(a)lists.fedorahosted.org> Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? No disrespect intended. That’s exactly what I would do under the circumstances. From: Brent Kimberley Sent: Wednesday, November 28, 2018 11:36 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? That speaks volumes. http://www.crosstalkonline.org/back-issues/ From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com] Sent: Wednesday, November 28, 2018 11:31 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? Brent, that may be the funniest message I've ever read. There isn't one, I just reverse engineered it from the pseudo-XML that it outputs. On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca<mailto:Brent.Kimberley@durham.ca>> wrote: Where can I find the controlled schema / ICD / metadata for the checklist file format? From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com<mailto:tvaughan@onyxpoint.com>] Sent: Wednesday, November 28, 2018 9:02 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? Yep, this is the one. That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start. On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com<mailto:simontek@gmail.com>> wrote: The .ckl issue is the answer to why use. I know not everyone works for gov't entities, but they typically require it, with very little options for other products. Management likes graphs and charts. On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com<mailto:fedoraproject@cyberpear.com> wrote: On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote: > > > On 11/27/18 2:06 PM, James Ralston wrote: > > I apologize if this is a little off-topic for this list, but a > > question: what are others who use STIG Viewer planning to do once > > Oracle JDK 8 / JavaFX go EOL in January 2019? > > [...] > > Ideally, I'd like to find a Linux replacement for STIG > > Viewer—something that can read, annotate, and write STIG Viewer > > checklist (*.ckl) files. But although SCAP Workbench can load and > > check STIGs, unless I'm missing something, it has no support for STIG > > Viewer checklist files. > > Not being snide, should this come across wrongly.... genuine question: > Why use STIG Viewer in the first place? > The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want. V/r, James Cassell _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information -- THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message. _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information -- THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.

1 0

RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
by Brent Kimberley 28 Nov '18

28 Nov '18

Major Tom summed it up as follows: https://turing.cs.hbg.psu.edu/comp413/cimm.pdf From: Brent Kimberley Sent: Wednesday, November 28, 2018 11:38 AM To: 'SCAP Security Guide' <scap-security-guide(a)lists.fedorahosted.org> Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? No disrespect intended. That’s exactly what I would do under the circumstances. From: Brent Kimberley Sent: Wednesday, November 28, 2018 11:36 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? That speaks volumes. http://www.crosstalkonline.org/back-issues/ From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com] Sent: Wednesday, November 28, 2018 11:31 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? Brent, that may be the funniest message I've ever read. There isn't one, I just reverse engineered it from the pseudo-XML that it outputs. On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca<mailto:Brent.Kimberley@durham.ca>> wrote: Where can I find the controlled schema / ICD / metadata for the checklist file format? From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com<mailto:tvaughan@onyxpoint.com>] Sent: Wednesday, November 28, 2018 9:02 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? Yep, this is the one. That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start. On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com<mailto:simontek@gmail.com>> wrote: The .ckl issue is the answer to why use. I know not everyone works for gov't entities, but they typically require it, with very little options for other products. Management likes graphs and charts. On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com<mailto:fedoraproject@cyberpear.com> wrote: On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote: > > > On 11/27/18 2:06 PM, James Ralston wrote: > > I apologize if this is a little off-topic for this list, but a > > question: what are others who use STIG Viewer planning to do once > > Oracle JDK 8 / JavaFX go EOL in January 2019? > > [...] > > Ideally, I'd like to find a Linux replacement for STIG > > Viewer—something that can read, annotate, and write STIG Viewer > > checklist (*.ckl) files. But although SCAP Workbench can load and > > check STIGs, unless I'm missing something, it has no support for STIG > > Viewer checklist files. > > Not being snide, should this come across wrongly.... genuine question: > Why use STIG Viewer in the first place? > The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want. V/r, James Cassell _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information -- THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message. _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information -- THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.

1 0

RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
by Brent Kimberley 28 Nov '18

28 Nov '18

No disrespect intended. That’s exactly what I would do under the circumstances. From: Brent Kimberley Sent: Wednesday, November 28, 2018 11:36 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org> Subject: RE: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? That speaks volumes. http://www.crosstalkonline.org/back-issues/ From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com] Sent: Wednesday, November 28, 2018 11:31 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? Brent, that may be the funniest message I've ever read. There isn't one, I just reverse engineered it from the pseudo-XML that it outputs. On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca<mailto:Brent.Kimberley@durham.ca>> wrote: Where can I find the controlled schema / ICD / metadata for the checklist file format? From: Trevor Vaughan [mailto:tvaughan@onyxpoint.com<mailto:tvaughan@onyxpoint.com>] Sent: Wednesday, November 28, 2018 9:02 AM To: SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> Subject: Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? Yep, this is the one. That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start. On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com<mailto:simontek@gmail.com>> wrote: The .ckl issue is the answer to why use. I know not everyone works for gov't entities, but they typically require it, with very little options for other products. Management likes graphs and charts. On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com<mailto:fedoraproject@cyberpear.com> wrote: On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote: > > > On 11/27/18 2:06 PM, James Ralston wrote: > > I apologize if this is a little off-topic for this list, but a > > question: what are others who use STIG Viewer planning to do once > > Oracle JDK 8 / JavaFX go EOL in January 2019? > > [...] > > Ideally, I'd like to find a Linux replacement for STIG > > Viewer—something that can read, annotate, and write STIG Viewer > > checklist (*.ckl) files. But although SCAP Workbench can load and > > check STIGs, unless I'm missing something, it has no support for STIG > > Viewer checklist files. > > Not being snide, should this come across wrongly.... genuine question: > Why use STIG Viewer in the first place? > The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want. V/r, James Cassell _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information -- THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message. _______________________________________________ scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org<mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information -- THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.

1 0

Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
by Trevor Vaughan 28 Nov '18

28 Nov '18

Brent, that may be the funniest message I've ever read. There isn't one, I just reverse engineered it from the pseudo-XML that it outputs. On Wed, Nov 28, 2018 at 9:42 AM Brent Kimberley <Brent.Kimberley(a)durham.ca> wrote: > Where can I find the controlled schema / ICD / metadata for the checklist > file format? > > > > *From:* Trevor Vaughan [mailto:tvaughan@onyxpoint.com] > *Sent:* Wednesday, November 28, 2018 9:02 AM > *To:* SCAP Security Guide <scap-security-guide(a)lists.fedorahosted.org> > *Subject:* Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 > is EOL in January 2019? > > > > Yep, this is the one. > > > > That said, if you dig through the archives of this mailing list, I figured > out how to create the bare minimum .ckl file that you need for reporting so > that should give people a head start. > > > > On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com> wrote: > > The .ckl issue is the answer to why use. I know not everyone works for > gov't entities, but they typically require it, with very little options for > other products. Management likes graphs and charts. > > > > On Tue, Nov 27, 2018, 8:22 PM James Cassell <fedoraproject(a)cyberpear.com > wrote: > > On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote: > > > > > > On 11/27/18 2:06 PM, James Ralston wrote: > > > I apologize if this is a little off-topic for this list, but a > > > question: what are others who use STIG Viewer planning to do once > > > Oracle JDK 8 / JavaFX go EOL in January 2019? > > > > [...] > > > Ideally, I'd like to find a Linux replacement for STIG > > > Viewer—something that can read, annotate, and write STIG Viewer > > > checklist (*.ckl) files. But although SCAP Workbench can load and > > > check STIGs, unless I'm missing something, it has no support for STIG > > > Viewer checklist files. > > > > Not being snide, should this come across wrongly.... genuine question: > > Why use STIG Viewer in the first place? > > > > The STIG Viewer produces *.ckl checklist files, which some auditors and > many security departments want. > > V/r, > James Cassell > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > > > > -- > > Trevor Vaughan > Vice President, Onyx Point, Inc > > (410) 541-6699 x788 > > > -- This account not approved for unencrypted proprietary information -- > THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY > CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR > EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to > any privilege have been waived. If you are not the intended recipient, you > are hereby notified that any review, re-transmission, dissemination, > distribution, copying, conversion to hard copy, taking of action in > reliance on or other use of this communication is strictly prohibited. If > you are not the intended recipient and have received this message in error, > please notify me by return e-mail and delete or destroy all copies of this > message. > _______________________________________________ > scap-security-guide mailing list -- > scap-security-guide(a)lists.fedorahosted.org > To unsubscribe send an email to > scap-security-guide-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedo… > -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

2 1

alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?
by James Ralston 28 Nov '18

28 Nov '18

I apologize if this is a little off-topic for this list, but a question: what are others who use STIG Viewer planning to do once Oracle JDK 8 / JavaFX go EOL in January 2019? Any Oracle Java 8 security updates released after January 2019 will require a commercial support license from Oracle: https://developers.redhat.com/blog/2018/11/05/migrating-from-oracle-jdk-to-… STIG Viewer requires Oracle JDK 8 and JavaFX 8 in order to function. Oracle JDK 11 is the next LTS (long term support) version of Java. (Java 9 and Java 10 are not LTS releases, and are already EOL.) But in Java 11, Oracle removed JavaFX: https://www.infoworld.com/article/3305073/java/removed-from-jdk-11-javafx-1… The OpenJFX project provides a JavaFX 11 implementation that works with OpenJDK 11: https://openjfx.io/ But: I tested the latest STIG Viewer (version 2.8) with OpenJDK 11 / OpenJFX 11, and it does not work; it simply crashes at startup. This will shortly place all STIG Viewer users in the situation where they must purchase a commercial support contract from Oracle in order to run STIG Viewer, because STIG Viewer requires outdated / EOL technology. I asked DISA/IASE what their intentions were with STIG Viewer in light of this. As of 2018-11-27, this was their response: > There are currently no plans on creating a non-Oracle java version > of STIG Viewer at this time. We also have no information regarding > how DoD will be addressing the licensing requirement for Oracle java > going forward. So. Ideally, I'd like to find a Linux replacement for STIG Viewer—something that can read, annotate, and write STIG Viewer checklist (*.ckl) files. But although SCAP Workbench can load and check STIGs, unless I'm missing something, it has no support for STIG Viewer checklist files. I can't be the only person in this boat. What are others doing?

8 8

Audit 3.0 and SCAP rule "Encrypt Audit Records Sent With audispd Plugin"
by Jan Cerny 27 Nov '18

27 Nov '18

Hi, We have a rule 'Encrypt Audit Records Sent With audispd Plugin' [1]. It checks that enable_krb5 = yes is set in /etc/audisp/audisp-remote.conf. We have found that it doesn't work anymore on Fedora 29 and RHEL 8. I have found that the audisp-remote.conf has moved to /etc/audit and that "enable_krb5 = yes" option has been superseded by "transport = KRB5". I have created a patch [2] that fixes the rule, OVAL, etc. However, it turned out that 'transport' option can be set also in /etc/audit/auditd.conf. It's not clear to me if we should check /etc/audisp/audisp-remote.conf or /etc/audit/auditd.conf or both. Which of the 2 configuration files is correct to configure authentication and encryption for remote logging? Does each of the files mean a different thing? Thank you. Regards [1] https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/syst… [2] https://github.com/ComplianceAsCode/content/pull/3619 Jan Černý Security Technologies | Red Hat, Inc.

4 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2018