-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
needs mapping/rule: SRG-OS-000375-GPOS-00160, SV-87057r2_rule, RHEL-07-041003 (ocsp_on) #1863
Comments
|
@shawndwells Is there a OCSP responder that ships with Red Hat (besides the one in openssl hopefully)? If so, shouldn't we be required to enable that for all local systems to restrict the amount of outbound traffic from systems? |
On 6/21/17 10:20 PM, Trevor Vaughan wrote:
@shawndwells <https://github.com/shawndwells> Is there a OCSP
responder that ships with Red Hat (besides the one in openssl hopefully)?
via IdM
upstream is dogtag: http://pki.fedoraproject.org/wiki/PKI_Main_Page
If so, shouldn't we be required to enable that for all local systems
to restrict the amount of outbound traffic from systems?
Meaning services should be configured to check w/an OCSP responder?
|
@shawndwells Yes, any service that uses PKI should be configured to use either an OCSP or SCVP responder. Any service that does not support this capability should not be used. Is there an IPA and/or dogtag configuration guide since it appears to be a required infrastructure capability? |
No description provided.
The text was updated successfully, but these errors were encountered: