On 03/16/2012 10:49 AM, Michael Palmiotto wrote:
From: scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on>behalf of Kevin Spargur [kspargur@redhat.com] Sent: Thursday, March 15, 2012 10:01 AM To: scap-security-guide@lists.fedorahosted.org Subject: SSG M1 Objectives
Hey all,
I've done a quick review of the SSG as far as were we stand in comparison milestone 1 objectives. We are missing roughly 195/634 or about 31% of the line items needed to meet milestone 1. The exact line items missing are specified in the attached. I've opened tickets for each piece up on the SSG site (https://fedorahosted.org/scap-security-guide/report/2). If your working on a section it would be great if you took the ticket so we can try and avoid duplication of effort where possible.
Thanks,
Kevin Spargur
I'm working on some of the Incomplete Guidance tickets (#40, #23, 26), and I just wanted to verify that I've got a handle on what needs to be done. Correct me if there's something I'm missing.
It looks like if we want to achieve the "prose guide, with desktop and server profiles and content" milestones, content needs to be added to a couple of places:
- The prose and rationale need to be added to rhel6/src/input/services or
rhel6/src/input/system, depending upon what's being addressed.
Yes, this meets the M1.1 objective to have a "human-readable prose guide, with level of completeness and quality similar to the NSA SNAC RHEL 5 guide" as well as the M1.3 objective to have rationale for all rules in the desktop and server profiles.
- A check xml needs to be added to rhel6/src/input/checks, with the id matching
the file name.
Per the M1.2 objective we need associated SCAP content (selected by XCCDF profiles, and fully automated with OVAL) for server and desktop profiles. This raises the question of what specifically should be in those profiles. In my mind, they should at least have all the system setting rules as well as obsolete and base services. From there we can add as appropriate, such as X for desktop, but I think that would provide a strong base.
- The proper idref needs to be added to an xml in rhel6/src/input/profiles
When does a new xml file need to be added to rhel6/src/input/profiles/ (as was done with ftp)?
This ties back into the M1.2 requirement where we need profiles for server and desktop. Adding the ftp profile is actually beyond the scope of what is needed for the first milestone. There was discussion about releasing an alpha when we hit that milestone and the ftp profile springs from those talks. The alpha release would be significantly more useful if a few common deployments had profiles available. The suggestion was made that including ftp and httpd profiles would help to get more people involved.
-Kevin
--Mike