Chapter 12. Security

In view of the Logjam security vulnerability, the gss-group1-sha1-* key-exchange methods are no longer considered secure. While there was the possibility to disable this key-exchange method as a normal key exchange, it was not possible to disable it as a GSSAPI key exchange. With this update, the administrator can selectively disable this or other algorithms used by the GSSAPI key exchange.

Previously, SELinux policy for Red Hat Gluster Storage (RHGS) components was missing, and Gluster worked correctly only when SELinux was in permissive mode. With this update, SELinux policy rules for the glusterd (glusterFS Management Service), glusterfsd (NFS sever), smbd, nfsd, rpcd, adn ctdbd processes have been updated providing SELinux support for Gluster.

The openscap packages have been upgraded to upstream version 1.2.5, which provides a number of bug fixes and enhancements over the previous version.

Notable enhancements include:

* Support for OVAL version 5.11, which brings multiple improvements such as for systemd properties

* Introduced native support of xml.bz2 input files

* Introduced the oscap-ssh tool for assessing remote systems

* Introduced the oscap-docker tool for assessing containers/images

The scap-security-guide tool has been upgraded to upstream version 0.1.25, which provides a number of bug fixes and enhancements over the previous version.

Notable enhancements include:

* New security profiles for Red Hat Enterprise Linux 7 Server: Common Profile for General-Purpose Systems, Draft PCI-DSS v3 Control Baseline, Standard System Security Profile, and Draft STIG for Red Hat Enterprise Linux 7 Server.

* New security benchmarks for Firefox and Java Runtime Environment (JRE) components running on Red Hat Enterprise Linux 6 and 7.

* New scap-security-guide-doc subpackage, which contains HTML-formatted documents containing security guides generated from XCCDF benchmarks (for every security profile shipped in security benchmarks for Red Hat Enterprise Linux 6 and 7, Firefox, and JRE).