[redhat-lspp] Configuring for STIG/FISMA compliance

[Stephen J. Smoogen]

On 2/7/06, Steve Grubb <sgrubb at redhat.com> wrote:
> On Sunday 05 February 2006 15:24, Stephen J. Smoogen wrote:
> > Has anyone else seen any open-source tool-sets that are aimed at this?
> > I am interested in either in putting my ugly bash/sed/awk stuff
> > (currently called Jotun as a play on the Titan toolkit) or
> > contributing to other projects.
>
> Out of curiosity, does your script have a verify mode that can later check the
> system to ensure that its still in the right config?
>
> -Steve
>

Yes. Each subsection is broken into 3 smaller sub-functions Audit,
Configure, Restore. The Audit is the default mode to see if a function
has reached its point. The Configure does whatever the step is, and
Restore tries to back out the change via a reverse function or a
restore of a backed up file.

Doing a 1:1 with the STIGS is the more tedious part as you can have a
seperate step for
  ownership of a file
  group ownership of a file
  permissions of a file
  data in a file

And the STIGS arent always consistent.. in that sometimes they worry
about root ownership but not group ownership... or they will do them
in weird orders. In this case, I wouldnt recommend doing a 1:1 STIG
python tool.. but something that took sections of the STIGS and did
them as a cluster.

--
Stephen J Smoogen.
CSIRT/Linux System Administrator