scap-security-guide November 2020

scap-security-guide@lists.fedorahosted.org

4 participants
4 discussions

New CaC/content Developer Documentation page on ReadTheDocs.org
by Gabriel Gaspar Becker 19 Jan '21

19 Jan '21

Hello all, I'm glad to announce availability of the page: https://complianceascode.readthedocs.io. It contains the developer documentation of https://github.com/ComplianceAsCode/content/ Additionally, contains documentation of our Jinja macros and Python Modules. In future, it will have even more documentation. With this new documentation hosting platform in place, we are deprecating the older Developer Guide <https://github.com/ComplianceAsCode/content/blob/master/docs/manual/develop…>. It will still exist for some time, but the preferred version is the ReadTheDocs.org one. We needed a platform where we could scale and organize better the documentation as it only gets bigger. If you would like to build the same documentation locally, follow the Sphinx build instructions on Building <https://complianceascode.readthedocs.io/en/latest/manual/developer/02_build…> Regards. -- Gabriel Gaspar Becker Software Engineer Red Hat <https://www.redhat.com> <https://red.ht/sig>

1 1

ComplianceAsCode Content 0.1.53
by Vojtech Polasek 14 Nov '20

14 Nov '20

Hello all, ComplianceAsCode/Content 0.1.53 has been released. Among the highlights of this release are: Remove OCP3 content (#6296) Remove SLE11 (#6164) Remove Ubuntu 14.04 (#6154) Remove Debian8 (#6137) Remove JBoss EAP6 (#6119) Introduce machine and package platform conditionals to Bash remediations (#6061) Introduce package conditionals to Ansible remediations (#6025) OCP4: Enhance e2e tests to check individual rules (#6315) For full release notes, please have a look at: - https://github.com/ComplianceAsCode/content/releases/tag/v0.1.53 Zip archive with pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.53/scap-… Zip archive with pre-built content using only OVAL-5.10: https://github.com/ComplianceAsCode/content/releases/download/v0.1.53/scap-… Thank you to everyone who contributed! Happy hardening! -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

New Github issue template for requesting a new rule
by Vojtech Polasek 13 Nov '20

13 Nov '20

Hello all, I would like to propose a new Github issue template which should make requesting a new SCAP rule easier. It should guide the issue reporter and answer questions which are important for content authors right away. Here is the list of questions I would like to have in the template. Please feel free to give any feedback, ideally until Monday November 16. ~~~ ##Which products does the rule apply to? ##Describe the configuration setting enforced by this rule. ##Why is the configuration security relevant? ##How to check the configuration? ###Is it order dependent? (does it need to be at certain place in the file? ###What is correct and incorrect syntax? ##How to remediate ###Does any command need to be run? ##Are there going to be other rules like (similar configuration) this in the future? (is it worth creating template?) ##Are there any caveats to be considered when testing? ##Is the configuration loaded directly by the <software> or is it stored in some intermediate database (similar to dconf)? (We want to edit the lowest level possible, if appropriate) ##Is it possible to check / remediate this configuration in offline mode? (scanning containers or offline systems) ## Please provide security policy references if possible e.g. STIG ~~~ Have a nice weekend, -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

3 4

stabilization of v0.1.53
by Vojtech Polasek 02 Nov '20

02 Nov '20

Hello all, *Release of Content version 0.1.53 is scheduled for November 13th*, so I've created a stabilization branch for it. Now is a good time to hunt for bugs and propose fixes for them. Starting today, merged Pull Requests should be assigned to milestone v0.1.54. Bug fixes should be proposed to master and labeled "bugfix", they will be cherry-picked to the stabilization branch. The next release 0.1.54 will happen on January 22nd. Stabilization phase will start on January 11th. Best regards, -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2020