Skip to content

Drop deprecated or removed packages in RHEL8 #3632

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yuumasato wants to merge 6 commits into from
Closed

Drop deprecated or removed packages in RHEL8 #3632

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
da2433c
Drop deprecated or removed packages in RHEL8
yuumasato Nov 30, 2018
f652cc9
Remove rules not applicable to RHEL8
yuumasato Nov 30, 2018
de69cc1
Remove dropped packages rules from RHEL8 profiles
yuumasato Dec 4, 2018
af92ef4
Smartcards auth in RHEL8 should be done via sssd
yuumasato Dec 4, 2018
37e698a
Remove smartcard_auth from RHEL8
yuumasato Dec 4, 2018
737a42b
Remove install_smartcard_packages from RHEL8
yuumasato Dec 4, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions fedora/templates/csv/packages_installed.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ libreswan
ntp
opensc
openssh-server
pcsc-lite
vsftpd
postfix
screen
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/services/ldap/openldap_server/package_openldap-servers_removed/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel6,rhel7,rhel8
prodtype: rhel6,rhel7

title: 'Uninstall openldap-servers Package'

Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel6,rhel7,rhel8,ol7
prodtype: rhel6,rhel7,ol7

title: 'Remove NIS Client'

Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/services/obsolete/nis/service_ypbind_disabled/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel6,rhel7,rhel8
prodtype: rhel6,rhel7

title: 'Disable ypbind Service'

Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel6,rhel7,rhel8
prodtype: rhel6,rhel7

title: 'Uninstall rsh Package'

Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/services/obsolete/r_services/service_rsh_disabled/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel6,rhel7,rhel8,ol7
prodtype: rhel6,rhel7,ol7

title: 'Disable rsh Service'

Expand Down
2 changes: 1 addition & 1 deletion ...counts-physical/screen_locking/smart_card_login/install_smartcard_packages/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = multi_platform_rhel
# platform = Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7
. /usr/share/scap-security-guide/remediation_functions

package_install esc
Expand Down
1 change: 0 additions & 1 deletion ...ounts-physical/screen_locking/smart_card_login/install_smartcard_packages/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
<title>Install needed packages for smartcard use.</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 7</platform>
<platform>Red Hat Enterprise Linux 8</platform>
</affected>
<description>The RPM packages esc pam_pkcs11 and authconfig-gtk must be installed.</description>
</metadata>
Expand Down
2 changes: 1 addition & 1 deletion ...nts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel7,rhel8
prodtype: rhel7

title: 'Install Smart Card Packages For Multifactor Authentication'

Expand Down
2 changes: 1 addition & 1 deletion ...accounts-physical/screen_locking/smart_card_login/smartcard_auth/anaconda/shared.anaconda
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# platform = multi_platform_rhel, multi_platform_ol
# platform = Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7,multi_platform_ol

package --add=pam_pkcs11 --add=esc
2 changes: 1 addition & 1 deletion .../accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 8,multi_platform_ol
# platform = Red Hat Enterprise Linux 7,multi_platform_ol
. /usr/share/scap-security-guide/remediation_functions

# Install required packages
Expand Down
1 change: 0 additions & 1 deletion ...accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
<platform>Red Hat Enterprise Linux 7</platform>
<platform>Red Hat Enterprise Linux 8</platform>
<platform>multi_platform_ol</platform>
</affected>
<description>Enable Smart Card logins</description>
Expand Down
2 changes: 1 addition & 1 deletion ...system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

prodtype: rhel6,rhel7,rhel8,fedora,ol7
prodtype: rhel6,rhel7,fedora,ol7

title: 'Enable Smart Card Login'

Expand Down
5 changes: 0 additions & 5 deletions rhel8/profiles/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,22 +34,17 @@ selections:
- sshd_disable_root_login
- libreswan_approved_tunnels
- no_rsh_trust_files
- package_rsh_removed
- package_rsh-server_removed
- package_talk_removed
- package_talk-server_removed
- package_telnet_removed
- package_telnet-server_removed
- package_xinetd_removed
- package_ypbind_removed
- package_ypserv_removed
- service_crond_enabled
- service_rexec_disabled
- service_rlogin_disabled
- service_rsh_disabled
- service_telnet_disabled
- service_xinetd_disabled
- service_ypbind_disabled
- service_zebra_disabled
- use_kerberos_security_all_exports
- disable_host_auth
Expand Down
8 changes: 7 additions & 1 deletion rhel8/profiles/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,13 @@ selections:
- ensure_redhat_gpgkey_installed
- ensure_gpgcheck_globally_activated
- ensure_gpgcheck_never_disabled
- smartcard_auth
- package_opensc_installed
- var_smartcard_drivers=cac
- configure_opensc_nss_db
- configure_opensc_card_drivers
- force_opensc_card_drivers
- service_pcscd_enabled
- sssd_enable_smartcards
- set_password_hashing_algorithm_systemauth
- set_password_hashing_algorithm_logindefs
- set_password_hashing_algorithm_libuserconf
Expand Down
1 change: 1 addition & 0 deletions rhel8/templates/csv/packages_installed.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ libreswan
ntp
Copy link
Copy Markdown
Member Author

@yuumasato yuumasato Dec 4, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have kept ntp here because rule service_chronyd_or_ntpd_enabled relies on check for package_ntp_installed.
chronyd_or_ntpd rules need a chronyd only rule version before ntp can be removed from this CSV.

Copy link
Copy Markdown
Collaborator

@jan-cerny jan-cerny Dec 4, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That could be achieved by JInja macros in the rule, OVALs and remediations.

Copy link
Copy Markdown
Member Author

@yuumasato yuumasato Dec 4, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could filter out checks for ntp and make it work, but the rule would still be called chronyd_or_ntpd, which would be confusing...

Copy link
Copy Markdown
Collaborator

@jan-cerny jan-cerny Dec 5, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can rename the rule to clock_synchronization_enabled. But I agree with keeping ntp here, it's easier.

Copy link
Copy Markdown
Contributor

@redhatrises redhatrises Dec 11, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is already a ticket to break out these rules which should be separate rules and not rules joined by jinja.

opensc
openssh-server
pcsc-lite
vsftpd
postfix
tmux
Expand Down
5 changes: 0 additions & 5 deletions rhel8/templates/csv/packages_removed.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,18 +21,15 @@ mcstrans
mdadm
net-snmp
nfs-utils
ntp
ntpdate
oddjob
openldap-servers
openssh-server
portreserve
prelink
qpid-cpp-server
quagga
quota-nld
rhnsd
rsh
rsh-server
samba
samba-common
Expand All @@ -52,6 +49,4 @@ tftp-server
vsftpd
xinetd
xorg-x11-server-common
ypbind
ypserv
systemd