<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Thanks, I’ll take a look at that.<o:p></o:p> <o:p> </o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com">william.boucher@mza.com</a><o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: open-scap-list-bounces@redhat.com [mailto:open-scap-list-bounces@redhat.com] On Behalf Of Shawn Wells Sent: Wednesday, January 30, 2019 2:16 AM To: open-scap-list@redhat.com Subject: Re: [Open-scap] Hardening Redhawk 6.5<o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> <div> On 1/29/19 11:14 PM, Boucher, William wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hi folks,<o:p></o:p> <o:p></o:p> I’ve been tasked with applying the RedHat 6 STIG to several RedHawk 6.5 systems.<o:p></o:p> Running oscap should be relatively easy, to see where a base install sits initially (RedHawk is RedHat with modifications for embedded realtime use). <o:p></o:p> The RedHawk site talks about testing RedHawk performance after applying the RedHat STIG (in a white paper), but it makes no mention on how to apply it.<o:p></o:p> </blockquote> <o:p> </o:p> RedHawk Linux doesn't have a STIG or common criteria, so not sure what security configuration guides (if any) are available.<o:p></o:p> If the RHEL STIGs can be applied to it, akin to CentOS, the ComplianceAsCode user guide might be helpful:<o:p></o:p> <a href="https://github.com/ComplianceAsCode/content/blob/master/docs/manual/user_guide.adoc">https://github.com/ComplianceAsCode/content/blob/master/docs/manual/user_guide.adoc</a><o:p></o:p> Specifically remediation section: <a href="https://github.com/ComplianceAsCode/content/blob/master/docs/manual/user_guide.adoc#remediation">https://github.com/ComplianceAsCode/content/blob/master/docs/manual/user_guide.adoc#remediation</a><o:p></o:p> <o:p> </o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Applying it manually is an option, but I’d sure like to automate some. <o:p></o:p> But my question really concerns adding packages (like selinix). RedHawk discourages using yum (with the RedHat repositories) to update packages, as there may be incompatibilities between the standard packages and the RedHawk modifications to the OS.<o:p></o:p> Perhaps I should direct this question to RedHawk support, but I thought I’d ask it here first to get your input.<o:p></o:p> </blockquote> Not sure how RedHawk works. If they're layering RedHawk software ontop of Red Hat instances, then you'd have a Red Hat subscription for every node (and could ask Red Hat support). If RedHawk is distributing their own independent linux distro, it'd be appropriate to query them about package management.<o:p></o:p> <o:p> </o:p> </div> </body> </html>