SCAP Security Guide release notes

Updated

The scap-security-guide package provides collections of security policies for Linux systems. The guidance consists of a catalog of practical hardening advice, linked to government requirements where applicable. The project bridges the gap between generalized policy requirements and specific implementation guidelines.

0.1.79

0.1.78

0.1.77

  • The STIG profiles were aligned with the latest DISA STIG policies:
    • Red Hat Enterprise Linux 8 to V2R3
    • Red Hat Enterprise Linux 9 to V2R4
  • Red Hat Enterprise Linux 8 notable bug fixes:
  • Red Hat Enterprise Linux 9 notable bug fixes:
  • Red Hat Enterprise Linux 10 content has been updated to reflect changes in RHEL 10 components.

0.1.76

0.1.75

0.1.74

0.1.73

0.1.72

0.1.69

  • ANSSI profiles were updated to version 2.0.
  • Three new SCAP profiles were added for RHEL 9 aligned with the CCN-STIC-610A22 Guide:
Profile nameProfile IDPolicy version
CCN Red Hat Enterprise Linux 9 - Advancedxccdf_org.ssgproject.content_profile_ccn_advanced2022-10
CCN Red Hat Enterprise Linux 9 - Basicxccdf_org.ssgproject.content_profile_ccn_basic2022-10
CCN Red Hat Enterprise Linux 9 - Intermediatexccdf_org.ssgproject.content_profile_ccn_intermediate2022-10

0.1.66

  • Updated RHEL 8 STIG profiles
  • Deprecated rule account_passwords_pam_faillock_audit in favor of accounts_passwords_pam_faillock_audit

0.1.63

  • New compliance rules for sysctl, grub2, pam_pwquality, and build time kernel configuration were added.
  • Rules hardening the PAM stack now use authselect as the configuration tool. Note: With this change the rules hardening the PAM stack will not be applied if the PAM stack was edited by other means.

0.1.60

  • Rules hardening the PAM stack now use authselect as the configuration tool.
  • Tailoring files that define profiles which represent the differences between DISA STIG automated SCAP content and SCAP automated content (delta tailoring) are now supported.
  • The rule xccdf_org.ssgproject.content_enable_fips_mode now checks only whether the FIPS mode has been enabled properly. It does not guarantee that system components have undergone FIPS certification.

0.1.54

  • The Operating System Protection Profile (OSPP) has been updated in accordance with the Protection Profile for General Purpose Operating Systems for Red Hat Enterprise Linux 8.4.
  • The ANSSI family of profiles based on the ANSSI BP-028 recommendations from the French National Security Agency (ANSSI), has been introduced. The content contains profiles implementing rules of the Minimum, Intermediary and Enhanced hardening levels.
  • The Security Technical Implementation Guide (STIG) security profile has been updated, and it implements rules from the recently-released version V1R1.

0.1.50

  • Ansible content has been improved: numerous rules contain Ansible remediations for the first time and other rules have been updated to address bug fixes.
  • Fixes and improvements to the scap-security-guide content for scanning RHEL7 systems, including:
    • The scap-security-guide packages now provide a profile aligned with the CIS RHEL 7 Benchmark v2.2.0.
      Note that the rpm_verify_permissions rule in the CIS profile does not work correctly; see the This content is not included.BZ-1843913 - rpm_verify_permissions fails in the CIS profile known issue.
    • The SCAP Security Guide profiles now correctly disable and mask services that should not be started.
    • The audit_rules_privileged_commands rule in the scap-security-guide packages now works correctly for privileged commands.
    • Remediation of the dconf_gnome_login_banner_text rule in the scap-security-guide packages no longer incorrectly fails.
SBR
Product(s)
Category
Components
Article Type