Hello,

Just wondering if this is in the queue to be looked at. :)

Thanks,

Gabe

On Mon, Jun 30, 2014 at 8:29 AM, Gabe Alford redhatrises@gmail.com wrote:

Hello,

These patches should address a few sshd false positives [Patch 0001] and add support for %gconf-tree.xml [Patch 0002] as well as a recommendation to change remediation for the GDM login banner from a gdm user default to a gconf mandatory setting [Patch 0003].

[Patch 0001]:

  When initially running the scan, some sshd settings such as

PermitRootLogin were showing that they were set correcly. This patch should fix those as well as hopefully address https://fedorahosted.org/scap-security-guide/ticket/434

[Patch 0002]:

  Adds support to check %gconf-tree.xml. If %gconf-tree.xml exists

(such as being deployed through Satellite), it takes precedence over any directory containing a %gconf.xml file under /etc/gconf/gconf.xml.mandatory. Plus having a single configuration file to create/change/modify is always a plus. Could potentially help address https://fedorahosted.org/scap-security-guide/ticket/282

[Patch 0003]:

  This is a recommendation to move setting the gdm banner and login

settings from /var/lib/gdm to /etc/gconf/gconf.xml.mandatory. Reason for this is that the /etc/gconf directory is the location for administrators to set mandatory system policies over user set policies. Plus due to the gconf order of processing/precedance, it would be recommended to set under /etc rather than /var as anything set as a mandatory policy would be the default no matter what was in /var/lib/gdm. If approved, would potentially address https://fedorahosted.org/scap-security-guide/ticket/319

Thanks,

Gabe