Bug 1958789 - Update rhel7 DISA STIG profile to v3r3
Summary: Update rhel7 DISA STIG profile to v3r3
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: scap-security-guide
Version: 7.9
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Vojtech Polasek
QA Contact: Matus Marhefka
Jan Fiala
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-05-10 07:22 UTC by Vojtech Polasek
Modified: 2021-07-25 05:57 UTC (History)
6 users (show)

Fixed In Version: scap-security-guide-0.1.54-4.el7_9
Doc Type: Enhancement
Doc Text:
.Profiles for DISA STIG version v3r3 The Defense Information Systems Agency (DISA) has published an updated version of the Secure Technical Implementation Guide (STIG) for RHEL 7 version 3, release 3. The update available with the link:https://access.redhat.com/errata/RHBA-2021:2803[RHBA-2021:2803] advisory: * Aligns all rules within the existing `xccdf_org.ssgproject.content_profile_stig` profile with the latest STIG release. * Adds a new profile `xccdf_org.ssgproject.content_profile_stig_gui` for systems with a graphical user interface (GUI).
Clone Of:
Environment:
Last Closed: 2021-07-21 01:06:27 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
HTML report from scan of a system installed with STIG profile (minimal install) (3.26 MB, application/xhtml+xml)
2021-06-23 13:28 UTC, Matus Marhefka
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:2803 0 None None None 2021-07-21 01:06:32 UTC

Comment 23 Matus Marhefka 2021-06-23 13:28:03 UTC
Created attachment 1793472 [details]
HTML report from scan of a system installed with STIG profile (minimal install)

Comment 24 Matus Marhefka 2021-06-23 13:31:03 UTC
Verified for scap-security-guide-0.1.54-6.el7_9

Status of STIG profile v3r3:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Rules without Bash and Ansible remediations (remediations are omitted on purpose):
grub2_password
package_MFEhiplsm_installed
install_antivirus
set_firewalld_default_zone
network_configure_name_resolution

Rules with missing Ansible remediations:
aide_verify_ext_attributes
aide_verify_acls
aide_use_fips_hashes
aide_scan_notification
configure_firewalld_ports
postfix_prevent_unrestricted_relay
chronyd_or_ntpd_set_maxpoll
smartcard_auth

Known issues:
rpm_verify_hashes - fails because rule require_singleuser_auth modifies /usr/lib/systemd/system/rescue.service

HTML report from scan of a system installed with STIG profile is attached as
stig.html (minimal install).

Comment 33 errata-xmlrpc 2021-07-21 01:06:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2803


Note You need to log in before you can comment on or make changes to this bug.