Hi all, I'm trying out SSG. Great work! I think I noticed a typo. Search for "veal" here and I think it should be "eval"... https://fedorahosted.org/scap-security-guide/ And now on to the question... :-) Does SSG generate (or plan to generate) remediation content? Check the very bottom of this page for an example... http://dev.gentoo.org/~swift/docs/genoval.xml I tried "generate fix" with the SSG content, but the resulting script was empty. I guess I'm not sure if I'm doing something wrong, or if more needs to be added to SSG to provide remediation capabilities. Thanks! Dave

Thanks for the reply Jeff! Maybe this is something we can talk about on the Aqueduct call [1] this Friday at 1p ET? Seems like the Aqueduct community would be interested in the availability<fix>-like content whether it was baked into SSG or provided separately via bash or puppet. It would be interesting to flesh out the pros and cons of each. Thanks again! Dave [1] https://fedorahosted.org/aqueduct/wiki/Call ----- Original Message ----- > Typo fixed. > > Comprehensive remediation is scary, but it's easy for some items. > Thanks for the link; this is a simple and clever approach to those > items. > > I did not have concrete plans for including automated remediation > actions directly in scap-security-guide. There was also interest > from others in tying failed checks to other remediation > capabilities (such as Puppet modules). > > The short term priorities are to create XCCDF and OVAL that can > produce a prose guide and tables with policy references, as well as > provide a few useful profiles that can be evaluated. (This is a > nice reminder to adjust the roadmap "deadlines".) > > That said, having<fix> would require only minor modifications to > the existing XSLT transforms to preserve the currently desired > outputs. So this is doable if there's interest. > > > On 03/13/2012 03:54 PM, David Egts wrote: >> Hi all, >> >> I'm trying out SSG. Great work! >> >> I think I noticed a typo. Search for "veal" here and I think it >> should be "eval"... >> >> https://fedorahosted.org/scap-security-guide/ >> >> And now on to the question... :-) >> >> Does SSG generate (or plan to generate) remediation content? >> Check the very bottom of this page for an example... >> >> http://dev.gentoo.org/~swift/docs/genoval.xml >> >> I tried "generate fix" with the SSG content, but the resulting >> script was empty. I guess I'm not sure if I'm doing something >> wrong, or if more needs to be added to SSG to provide remediation >> capabilities. >> >> Thanks! >> >> Dave >> >> > _______________________________________________ scap-security-guide > mailing list scap-security-guide(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/scap-security-guide >