Re: FIPS vs STIG

[Reese, Brian J CTR (USA)]

Having the CBC mode ciphers enabled will trigger Nessus Plugin ID 70658:

https://www.tenable.com/plugins/nessus/70658

This was likely a factor in DISA's decision to remove them from the STIG. Older versions of the STIG (at least the RHEL 6 STIG) had the CBC modes enabled, but they were taken out at some point for reasons unrelated to FIPS 140-2.

On Wed, Mar 11, 2020, at 11:36 AM, Matěj Týč wrote:
> One of RHEL7 bugzillas [1] shows an interesting discrepancy between our 
> content and STIG:
> We feature [2] a rule "Use Only FIPS 140-2 Validated Ciphers"
> STIG has its own [3] "A FIPS 140-2 approved cryptographic algorithm
>
> must be used for SSH communications."
> There is a discrepancy between the two - while we claim that the 
> following ciphers are FIPS 140-2 certified on Red Hat Enterprise Linux 
> 7, only three of them are recognized as such by the STIG:
> aes128-ctr(STIG)
> aes192-ctr(STIG)
> aes256-ctr(STIG)
> aes128-cb
> aes192-cbc
> aes256-cbc
> 3des-cbc
> [e-mail]
>
> I have confirmed correctness of our description with our FIPS SME Tomas 
> Mraz (in CC), so this issue looks as a bug in STIG - either the 
> requirement is too strict, so it is incorrect, or it is supposed to be 
> strict, and it should therefore be reworded, and we need to create a 
> new rule in our content.

Indeed, the STIG allows fewer ciphers than FIPS allows; the STIG currently says "If any ciphers other than "aes128-ctr", "aes192-ctr", or "aes256-ctr" are listed, the "Ciphers" keyword is missing, or the returned line is commented out, this is a finding." [4]

Similarly, for the MACs allowed, "If any ciphers other than "hmac-sha2-256" or "hmac-sha2-512" are listed or the returned line is commented out, this is a finding." [5]

More are permitted by FIPS than by SSH, but the STIG is FIPS compliant as-is, using a subset of the FIPS ciphers. From the Security Policy document for the certification [6],

Only the following ciphers are allowed:
- aes128-ctr
- aes192-ctr
- aes256-ctr
- aes128-cbc
- aes192-cbc
- aes256-cbc
- 3des-cbc
- [e-mail]
Only the following message authentication codes are allowed:
- hmac-sha1
- hmac-sha2-256
- hmac-sha2-512
- [e-mail]
- [e-mail]
- [e-mail]
> What is the procedure in cases like this?

I'd just configure the STIG subset of FIPS, and maybe ask DISA to add a clarification note to the STIG.  Many folks are concerned about the FIPS-permitted 3DES algorithm [7], "3DES is deprecated for all new applications and usage is disallowed after 2023"

V/r,
James Cassell

[4] Caution-https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_securi...

[5] Caution-https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_securi...

[6] Caution-https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-pr...

[7] Caution-https://www.cryptomathic.com/news-events/blog/3des-is-officially-being-retir...
> References:
> > [3]:
>
> Caution-https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2017-12-14/findin...

_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: Caution-https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: Caution-https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: Caution-https://lists.fedorahosted.org/archives/list/[e-mail]...

FIPS vs STIG

[Steve Grubb]

On Wednesday, March 11, 2020 12:20:38 PM EDT Reese, Brian J CTR (USA) wrote:
> Having the CBC mode ciphers enabled will trigger Nessus Plugin ID 70658:
>
> https://www.tenable.com/plugins/nessus/70658
>
> This was likely a factor in DISA's decision to remove them from the STIG.
> Older versions of the STIG (at least the RHEL 6 STIG) had the CBC modes
> enabled, but they were taken out at some point for reasons unrelated to
> FIPS 140-2.

Right. There was a vulnerability on RHEL 5 & 6 that was fixed. This is 
CVE-2008-5161. Fixed long ago.

-Steve
> On Wed, Mar 11, 2020, at 11:36 AM, Matěj Týč wrote:
> > One of RHEL7 bugzillas [1] shows an interesting discrepancy between our
> >
> > content and STIG:
> > We feature [2] a rule "Use Only FIPS 140-2 Validated Ciphers"
> > STIG has its own [3] "A FIPS 140-2 approved cryptographic algorithm
> >
> > must be used for SSH communications."
> > There is a discrepancy between the two - while we claim that the
> > following ciphers are FIPS 140-2 certified on Red Hat Enterprise Linux
> >
> > 7, only three of them are recognized as such by the STIG:
> > aes128-ctr(STIG)
> > aes192-ctr(STIG)
> > aes256-ctr(STIG)
> > aes128-cb
> > aes192-cbc
> > aes256-cbc
> > 3des-cbc
> > [e-mail]
> >
> > I have confirmed correctness of our description with our FIPS SME Tomas
> > Mraz (in CC), so this issue looks as a bug in STIG - either the
> > requirement is too strict, so it is incorrect, or it is supposed to be
> > strict, and it should therefore be reworded, and we need to create a
> > new rule in our content.
>
> Indeed, the STIG allows fewer ciphers than FIPS allows; the STIG currently
> says "If any ciphers other than "aes128-ctr", "aes192-ctr", or
> "aes256-ctr" are listed, the "Ciphers" keyword is missing, or the returned
> line is commented out, this is a finding." [4]
>
> Similarly, for the MACs allowed, "If any ciphers other than "hmac-sha2-256"
> or "hmac-sha2-512" are listed or the returned line is commented out, this
> is a finding." [5]
>
> More are permitted by FIPS than by SSH, but the STIG is FIPS compliant
> as-is, using a subset of the FIPS ciphers. From the Security Policy
> document for the certification [6],
>
> Only the following ciphers are allowed:
> aes128-ctr
> aes192-ctr
> aes256-ctr
> aes128-cbc
> aes192-cbc
> aes256-cbc
> 3des-cbc
> [e-mail]
>
> Only the following message authentication codes are allowed:
> hmac-sha1
> hmac-sha2-256
> hmac-sha2-512
> [e-mail]
> [e-mail]
> [e-mail]
> > What is the procedure in cases like this?
>
> I'd just configure the STIG subset of FIPS, and maybe ask DISA to add a
> clarification note to the STIG.  Many folks are concerned about the
> FIPS-permitted 3DES algorithm [7], "3DES is deprecated for all new
> applications and usage is disallowed after 2023"
>
> V/r,
> James Cassell
>
> [4]
> Caution-https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linu
> x_7_security_technical_implementation_guide/V-72221?version=V2R6
>
> [5]
> Caution-https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linu
> x_7_security_technical_implementation_guide/V-72253?version=V2R6
>
> [6]
> Caution-https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-val
> idation-program/documents/security-policies/140sp3067.pdf
>
> [7]
> Caution-https://www.cryptomathic.com/news-events/blog/3des-is-officially-b
> eing-retired
> > References:
> > > html#xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers> 
> > >  [3]:
> >
> > Caution-https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2017-1
> > 2-14/finding/V-72221
>
> scap-security-guide mailing list --
> [e-mail] To unsubscribe send an email to
> [e-mail] Fedora Code of Conduct:
> Caution-https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List
> Guidelines: Caution-https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> Caution-https://lists.fedorahosted.org/archives/list/scap-security-guide@l
> ists.fedorahosted.org

FIPS vs STIG

[Trevor Vaughan]

I'm really hoping that we can move past tailoring the policies to the
brokenness of any given set of scanners at some point.

It also seems to have issues with some of the SELinux checks among other
things that are mandated by the STIG.

Trevor

On Wed, Mar 11, 2020 at 12:43 PM Steve Grubb  wrote:
> On Wednesday, March 11, 2020 12:20:38 PM EDT Reese, Brian J CTR (USA)
> wrote:
> > Having the CBC mode ciphers enabled will trigger Nessus Plugin ID 70658:
> >
> > https://www.tenable.com/plugins/nessus/70658
> >
> > This was likely a factor in DISA's decision to remove them from the STIG.
> > Older versions of the STIG (at least the RHEL 6 STIG) had the CBC modes
> > enabled, but they were taken out at some point for reasons unrelated to
> > FIPS 140-2.
>
> Right. There was a vulnerability on RHEL 5 & 6 that was fixed. This is
> CVE-2008-5161. Fixed long ago.
>
> -Steve
> > On Wed, Mar 11, 2020, at 11:36 AM, Matěj Týč wrote:
> > > One of RHEL7 bugzillas [1] shows an interesting discrepancy between our
> > >
> > > content and STIG:
> > > We feature [2] a rule "Use Only FIPS 140-2 Validated Ciphers"
> > > STIG has its own [3] "A FIPS 140-2 approved cryptographic algorithm
> > >
> > > must be used for SSH communications."
> > > There is a discrepancy between the two - while we claim that the
> > > following ciphers are FIPS 140-2 certified on Red Hat Enterprise Linux
> > >
> > > 7, only three of them are recognized as such by the STIG:
> > > aes128-ctr(STIG)
> > > aes192-ctr(STIG)
> > > aes256-ctr(STIG)
> > > aes128-cb
> > > aes192-cbc
> > > aes256-cbc
> > > 3des-cbc
> > > [e-mail]
> > >
> > > I have confirmed correctness of our description with our FIPS SME Tomas
> > > Mraz (in CC), so this issue looks as a bug in STIG - either the
> > > requirement is too strict, so it is incorrect, or it is supposed to be
> > > strict, and it should therefore be reworded, and we need to create a
> > > new rule in our content.
> >
> > Indeed, the STIG allows fewer ciphers than FIPS allows; the STIG
>
> currently
> > says "If any ciphers other than "aes128-ctr", "aes192-ctr", or
> > "aes256-ctr" are listed, the "Ciphers" keyword is missing, or the
>
> returned
> > line is commented out, this is a finding." [4]
> >
> > Similarly, for the MACs allowed, "If any ciphers other than
>
> "hmac-sha2-256"
> > or "hmac-sha2-512" are listed or the returned line is commented out, this
> > is a finding." [5]
> >
> > More are permitted by FIPS than by SSH, but the STIG is FIPS compliant
> > as-is, using a subset of the FIPS ciphers. From the Security Policy
> > document for the certification [6],
> >
> > Only the following ciphers are allowed:
> > aes128-ctr
> > aes192-ctr
> > aes256-ctr
> > aes128-cbc
> > aes192-cbc
> > aes256-cbc
> > 3des-cbc
> > [e-mail]
> >
> > Only the following message authentication codes are allowed:
> > hmac-sha1
> > hmac-sha2-256
> > hmac-sha2-512
> > [e-mail]
> > [e-mail]
> > [e-mail]
> > > What is the procedure in cases like this?
> >
> > I'd just configure the STIG subset of FIPS, and maybe ask DISA to add a
> > clarification note to the STIG.  Many folks are concerned about the
> > FIPS-permitted 3DES algorithm [7], "3DES is deprecated for all new
> > applications and usage is disallowed after 2023"
> >
> > V/r,
> > James Cassell
> >
> > [4]
> > Caution-
>
> https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linu
> > x_7_security_technical_implementation_guide/V-72221?version=V2R6
> >
> > [5]
> > Caution-
>
> https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linu
> > x_7_security_technical_implementation_guide/V-72253?version=V2R6
> >
> > [6]
> > Caution-
>
> https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-val
> > idation-program/documents/security-policies/140sp3067.pdf
> >
> > [7]
> > Caution-
>
> https://www.cryptomathic.com/news-events/blog/3des-is-officially-b
> > eing-retired
> > > References:
> > > >
>
> https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig.
> > > > html#xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers>
> > > >  [3]:
> > >
> > > Caution-
>
> https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2017-1
> > > 2-14/finding/V-72221
> >
> > scap-security-guide mailing list --
> > [e-mail] To unsubscribe send an email
>
> to
> > [e-mail] Fedora Code of Conduct:
> > Caution-https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>
> List
> > Guidelines: Caution-
>
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > Caution-
>
> https://lists.fedorahosted.org/archives/list/scap-security-guide@l
> > ists.fedorahosted.org
>
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Non-DoD Source] Re: FIPS vs STIG

[Salowitz, Mark A CTR]

70658 rears its ugly head again. I’m glad to know I’m not the only who had to deal with that stupid plugin.

Thanks,

Mark Salowitz

From: Trevor Vaughan 
Sent: Wednesday, March 11, 2020 12:49 PM
To: SCAP Security Guide 
Cc: Reese, Brian J CTR (USA) 
Subject: [Non-DoD Source] Re: FIPS vs STIG

I'm really hoping that we can move past tailoring the policies to the brokenness of any given set of scanners at some point.

It also seems to have issues with some of the SELinux checks among other things that are mandated by the STIG.

Trevor

On Wed, Mar 11, 2020 at 12:43 PM Steve Grubb <[e-mail]> wrote:
On Wednesday, March 11, 2020 12:20:38 PM EDT Reese, Brian J CTR (USA) wrote:
> Having the CBC mode ciphers enabled will trigger Nessus Plugin ID 70658:
>
> https://www.tenable.com/plugins/nessus/70658https://urldefense.proofpoint.com/v2/url?u=https-3A__www.tenable.com_plugins_nessus_70658&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=dDwuY9twPy57JiH3E92qkyFfoKfL_GP2656_ENERHCU&e=
>
> This was likely a factor in DISA's decision to remove them from the STIG.
> Older versions of the STIG (at least the RHEL 6 STIG) had the CBC modes
> enabled, but they were taken out at some point for reasons unrelated to
> FIPS 140-2.

Right. There was a vulnerability on RHEL 5 & 6 that was fixed. This is
CVE-2008-5161. Fixed long ago.

-Steve
> On Wed, Mar 11, 2020, at 11:36 AM, Matěj Týč wrote:
> > One of RHEL7 bugzillas [1] shows an interesting discrepancy between our
> >
> > content and STIG:
> > We feature [2] a rule "Use Only FIPS 140-2 Validated Ciphers"
> > STIG has its own [3] "A FIPS 140-2 approved cryptographic algorithm
> >
> > must be used for SSH communications."
> > There is a discrepancy between the two - while we claim that the
> > following ciphers are FIPS 140-2 certified on Red Hat Enterprise Linux
> >
> > 7, only three of them are recognized as such by the STIG:
> > aes128-ctr(STIG)
> > aes192-ctr(STIG)
> > aes256-ctr(STIG)
> > aes128-cb
> > aes192-cbc
> > aes256-cbc
> > 3des-cbc
> > [e-mail]
> >
> > I have confirmed correctness of our description with our FIPS SME Tomas
> > Mraz (in CC), so this issue looks as a bug in STIG - either the
> > requirement is too strict, so it is incorrect, or it is supposed to be
> > strict, and it should therefore be reworded, and we need to create a
> > new rule in our content.
>
> Indeed, the STIG allows fewer ciphers than FIPS allows; the STIG currently
> says "If any ciphers other than "aes128-ctr", "aes192-ctr", or
> "aes256-ctr" are listed, the "Ciphers" keyword is missing, or the returned
> line is commented out, this is a finding." [4]
>
> Similarly, for the MACs allowed, "If any ciphers other than "hmac-sha2-256"
> or "hmac-sha2-512" are listed or the returned line is commented out, this
> is a finding." [5]
>
> More are permitted by FIPS than by SSH, but the STIG is FIPS compliant
> as-is, using a subset of the FIPS ciphers. From the Security Policy
> document for the certification [6],
>
> Only the following ciphers are allowed:
> aes128-ctr
> aes192-ctr
> aes256-ctr
> aes128-cbc
> aes192-cbc
> aes256-cbc
> 3des-cbc
> [e-mail]
>
> Only the following message authentication codes are allowed:
> hmac-sha1
> hmac-sha2-256
> hmac-sha2-512
> [e-mail]
> [e-mail]
> [e-mail]
> > What is the procedure in cases like this?
>
> I'd just configure the STIG subset of FIPS, and maybe ask DISA to add a
> clarification note to the STIG.  Many folks are concerned about the
> FIPS-permitted 3DES algorithm [7], "3DES is deprecated for all new
> applications and usage is disallowed after 2023"
>
> V/r,
> James Cassell
>
> [4]
> Caution-https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linuhttps://urldefense.proofpoint.com/v2/url?u=https-3A__vaulted.io_library_disa-2Dstigs-2Dsrgs_red-5Fhat-5Fenterprise-5Flinu&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=HngVpPWhBMCqQdi7EQl0QPyK7WaJiStX_GorI2cti6Q&e=
> x_7_security_technical_implementation_guide/V-72221?version=V2R6
>
> [5]
> Caution-https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linuhttps://urldefense.proofpoint.com/v2/url?u=https-3A__vaulted.io_library_disa-2Dstigs-2Dsrgs_red-5Fhat-5Fenterprise-5Flinu&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=HngVpPWhBMCqQdi7EQl0QPyK7WaJiStX_GorI2cti6Q&e=
> x_7_security_technical_implementation_guide/V-72253?version=V2R6
>
> [6]
> Caution-https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-valhttps://urldefense.proofpoint.com/v2/url?u=https-3A__csrc.nist.gov_CSRC_media_projects_cryptographic-2Dmodule-2Dval&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=xtvGTPAsopSAXtuIpq6zG4r_pDBTVKJAjp909xMZxFQ&e=
> idation-program/documents/security-policies/140sp3067.pdf
>
> [7]
> Caution-https://www.cryptomathic.com/news-events/blog/3des-is-officially-bhttps://urldefense.proofpoint.com/v2/url?u=https-3A__www.cryptomathic.com_news-2Devents_blog_3des-2Dis-2Dofficially-2Db&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=Bc_D2EONLxOpsO6JD_yQw2MgNeQ9gr86I_79OPCGVus&e=
> eing-retired
> > References:
> > > [2]:
> > >  Caution-https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stighttps://urldefense.proofpoint.com/v2/url?u=https-3A__static.open-2Dscap.org_ssg-2Dguides_ssg-2Drhel7-2Dguide-2Dstig&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=KPkT4LTrEMDg-uZ5jwxOONj04Y6eywGQDt1l1kfw9hg&e=.
> > >  html#xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers>
> > >  [3]:
> >
> > Caution-https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2017-1https://urldefense.proofpoint.com/v2/url?u=https-3A__www.stigviewer.com_stig_red-5Fhat-5Fenterprise-5Flinux-5F7_2017-2D1&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=fCpl4caVPWTPU14DvX_HpzLWjsZN8sbe3Th10S2ep-Q&e=
> > 2-14/finding/V-72221
>
> scap-security-guide mailing list --
> [e-mail] To unsubscribe send an email to
> [e-mail] Fedora Code of Conduct:
> Caution-https://docs.fedoraproject.org/en-US/project/code-of-conduct/https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.org_en-2DUS_project_code-2Dof-2Dconduct_&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=SrlgcOCuvsjmdsg48r2hVHCHwjh-vmwSb0bZRZXhD_Y&e= List
> Guidelines: Caution-https://fedoraproject.org/wiki/Mailing_list_guidelineshttps://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wiki_Mailing-5Flist-5Fguidelines&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=xM72tlid4kg6sTs710dsnzLCO6Tv9Cci9S05xS0dar8&e=
> List Archives:
> Caution-https://lists.fedorahosted.org/archives/list/scap-security-guide@lhttps://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.org_archives_list_scap-2Dsecurity-2Dguide-40l&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=3t3--m8U2cEfF73aM3W9scLW4F5FcPuvkTZuOx309HM&e=
> ists.fedorahosted.orghttps://urldefense.proofpoint.com/v2/url?u=http-3A__ists.fedorahosted.org&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=aTFURFzfjb8XajzIHDxxEjpHh226e7n1svBO_ou9awo&e=

_______________________________________________
scap-security-guide mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.org_en-2DUS_project_code-2Dof-2Dconduct_&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=SrlgcOCuvsjmdsg48r2hVHCHwjh-vmwSb0bZRZXhD_Y&e=
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelineshttps://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wiki_Mailing-5Flist-5Fguidelines&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=xM72tlid4kg6sTs710dsnzLCO6Tv9Cci9S05xS0dar8&e=
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.org_archives_list_scap-2Dsecurity-2Dguide-40lists.fedorahosted.org&d=DwMFaQ&c=0NKfg44GVknAU-XkWXjNxQ&r=iohgjlRx8rzsacNUP-p6Uoa5Wl3Ea1utSdxGRRALEQk&m=XQXyOSKSM2jYWIfu6VKWkGq4mEamQMzRiaiW0rAi7YY&s=Bsm1eGz42Rf0xbg86-KsH0AMhrenOsiRrZ6xObESCkU&e=

--
Trevor Vaughan
Vice President, Onyx Point, Inc
[phone] x788

-- This account not approved for unencrypted proprietary information --