Bug 1755447
| Summary: | DISA STIG profile for RHEL-8 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | amitkuma |
| Component: | scap-security-guide | Assignee: | Watson Yuuma Sato <wsato> |
| Status: | CLOSED ERRATA | QA Contact: | Jan Černý <jcerny> |
| Severity: | urgent | Docs Contact: | Jan Fiala <jafiala> |
| Priority: | high | ||
| Version: | 8.4 | CC: | awestbro, brian.hoppus, bwelterl, danclark, eddiecarswell13, ggasparb, gkeegan, jafiala, jcerny, lmiksik, mhaicman, mjahoda, mmarhefk, mthacker, posttoashok, pvrabec, rmullett, ross.marullo, terry.bartholomew.ctr, wrydberg, wsato |
| Target Milestone: | rc | Keywords: | FutureFeature |
| Target Release: | 8.0 | Flags: | jafiala:
needinfo+
pm-rhel: mirror+ |
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | scap-security-guide-0.1.48-6.el8 | Doc Type: | Enhancement |
| Doc Text: |
.RHEL 8 now contains the DISA STIG profile
Security Technical Implementation Guides (STIG) are a set of baseline recommendations published by the Defense Information Systems Agency (DISA) to harden the security of information systems and software that might otherwise be vulnerable. This release includes the profile and Kickstart file for this security policy. With this enhancement, users can check systems for compliance, remediate systems to be compliant, and install systems compliant with DISA STIG for Red Hat Enterprise Linux 8.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 15:30:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1583 |
Description of problem: RHEL-8 does not contain DISA STIG profile separately. # oscap info --profiles ssg-rhel8-ds.xml xccdf_org.ssgproject.content_profile_ospp:Protection Profile for General Purpose Operating Systems xccdf_org.ssgproject.content_profile_pci-dss:PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux But some rules in ssg-rhel8-ds.xml are written with DISA STIG in mind example: 1. xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification 2. xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading etc a. Being said, DISA STIG is more of a derivative of the OSPP profile, Can customer's use OSPP for hardening systems for DISA-STIG standards? b. if ospp is being worked on to make DISA STIG complaint -> In which RHEL version, scap-security-guide version(Current version:0.1.46-1.el8) OSPP profile will contain all rules defined by DISA STIG standards? c. Or Can we say current scap-security-guide(scap-security-guide-0.1.42-11.el8.noarch.rpm) is fully DISA STIG complaint, If customers harden their system with ospp, their systems are DISA STIG complaint? Version-Release number of selected component (if applicable): scap-security-guide-0.1.42-11.el8.noarch.rpm How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: RHEL-8 should contain a DISA-STIG complaint profile Additional info: