14:03:49 <Sparks> #startmeeting Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings
14:03:49 <zodbot> Meeting started Thu Jan 14 14:03:49 2016 UTC.  The chair is Sparks. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:03:49 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
14:03:49 <zodbot> The meeting name has been set to 'security_team_meeting_-_agenda:_https://fedoraproject.org/wiki/security_team_meetings'
14:03:52 <Sparks> #meetingname Fedora Security Team
14:03:52 <zodbot> The meeting name has been set to 'fedora_security_team'
14:03:55 <zodbot> Sparks: Error: Can't start another meeting, one is in progress.
14:03:58 <Sparks> #meetingname Fedora Security Team
14:03:58 <zodbot> The meeting name has been set to 'fedora_security_team'
14:04:01 <Sparks> #topic Roll Call
14:04:02 * Sparks 
14:05:48 * linuxmodder 
14:06:20 <linuxmodder> .fas corey84
14:06:21 <zodbot> linuxmodder: corey84 'Corey Sheldon' <sheldon.corey@gmail.com>
14:07:35 * Sparks gives everyone a few more minutes
14:09:39 <Astradeus> .fas astra
14:09:39 <zodbot> Astradeus: rustomafs 'Rustom Irani' <rustom@acefastrack.com> - netman 'Andrey Krasukov' <netman@astratel.ru> - astralstorm 'Radosław Szkodziński' <astralstorm@gmail.com> - astratik 'Alexandre Stratikopoulos' <ale.stratik@gmail.com> - astra 'David Kaufmann' <astra@ionic.at> - astrawin 'Dick Chapman' <astrawin@rogers.com> - ambyte 'Sergey Gulyaev' <astraway@gmail.com> - sabroso 'Luis Alberto Pelaez' (3 more messages)
14:09:54 <Astradeus> ah, no, that was the wrong one^^
14:10:03 <Astradeus> .hello astra
14:10:04 <zodbot> Astradeus: astra 'David Kaufmann' <astra@ionic.at>
14:11:16 <linuxmodder> scarce on folks today :(
14:11:45 <Sparks> Okay, lets get started
14:12:29 <Sparks> #topic Follow up on last week's tasks
14:12:37 * Sparks notes pjp isn't here
14:12:46 <Sparks> #action pjp to give a status update on security policy in the wiki (carried over)
14:12:57 <Sparks> #action Sparks to figure out how FST members can get access to Fedora security bugs
14:13:07 <Sparks> #topic Fedora Security Team FAD
14:13:35 <Sparks> #link http://whenisgood.net/8fshcdf/results/9czp49s
14:13:56 <Sparks> It appears we've narrowed down our available time to a couple of Fridays in March.
14:14:21 <Sparks> #action Sparks to follow up on meeting locations to verify their availability.
14:14:46 <Sparks> We also need to get a solid agenda together.  We need a list of things we want to accomplish.
14:15:41 <Sparks> Anyone?
14:15:48 <Astradeus> sounds good?
14:16:23 <Astradeus> don't have much fst experience, so i can't really contribute to an agenda
14:18:26 <Sparks> #action Sparks to bring up the agenda topic on the list
14:18:35 <Sparks> #topic Apprenticeship
14:18:44 <Sparks> #link https://fedoraproject.org/wiki/Security_Team_Apprenticeship
14:19:03 <linuxmodder> Sounds good to me,  any plans to  do a  intro session at  FAD ?   or  similar  like a  lab day
14:19:04 <linuxmodder> not necessarily a  pen lab but a   basics lab  ( help get everyone  acquainted with each other | skills and  best  mentors in each skill)
14:19:05 <Sparks> I think we're still working on this but this should be something we work on at the FAD.
14:19:27 <Sparks> linuxmodder: Yes!
14:20:18 <linuxmodder> I am more than willing to  help with the  security  for  dummies |noobs  lab (like the  010 -0200 courses)
14:20:26 <Sparks> ack
14:20:27 <linuxmodder> firewalls  |acls etc
14:20:35 <Sparks> Okay, we'll move on along...
14:20:42 <Sparks> #topic Outstanding BZ Tickets
14:20:50 <Sparks> #info Thursday's numbers: Critical 0 (0), Important 43 (+7), Moderate 429 (+5), Low 173 (+27), Total 645
14:20:57 <Sparks> +Tickets by Severity-+-------+---------+
14:20:57 <Sparks> | Severity | Tickets | Owned | Unowned |
14:20:57 <Sparks> +----------+---------+-------+---------+
14:20:57 <Sparks> | medium   | 429     | 40    | 389     |
14:20:57 <Sparks> | low      | 173     | 13    | 160     |
14:21:00 <Sparks> | high     | 43      | 21    | 22      |
14:21:01 <linuxmodder> getting some lag  here on my end  apoligzes for any  odd relay delays
14:21:02 <Sparks> +----------+---------+-------+---------+
14:21:35 <linuxmodder> glad to see critical back at 0
14:21:44 <Sparks> much agreed.
14:21:54 <Sparks> Now if we could just get rid of the highs.
14:22:33 <linuxmodder> I'll take another look tonight or  tomorrow at the  high list  see if I can  help squash a few
14:22:52 <Sparks> #topic Open floor discussion/questions/comments
14:22:57 <linuxmodder> everything under 20 would be a  nice  improvement
14:22:57 <Sparks> Okay, anyone have anything?
14:23:01 <Astradeus> maybe
14:23:13 <linuxmodder> Astradeus,  shoot
14:23:27 <Astradeus> in the next two hours there seems to be an upcoming CVE for ssh
14:23:41 <Astradeus> https://twitter.com/phessler/status/687637446469771264 CVE-2016-0777
14:24:03 <linuxmodder> Astradeus,  link ?   haven't seen that  (albeit  a  bit  out of pocket this week helping a  client)
14:24:15 <Astradeus> not sure if it's something, but just came in
14:24:39 <Astradeus> don't have more information, just saw it few minutes ago
14:25:01 <linuxmodder> added to  list of  followed tweets
14:25:58 <linuxmodder> Sparks,  any current  appliance or  method for  recruiting  | training say  CS students at the local level for FST or  just the Apprenticeship
14:26:24 <Sparks> linuxmodder: Not yet but we should.  We need to get our training figured out first so we're ready.
14:28:08 <Sparks> Anyone have anything else?
14:28:49 <linuxmodder> Sparks,  fully  agree
14:28:56 * mhayden is here
14:29:12 <Sparks> mhayden: Oh good, right before we're planning on closing!
14:29:13 <Sparks> :)
14:29:14 <linuxmodder> have anything for  open floor  mhayden
14:29:23 <mhayden> oof :P
14:29:44 <mhayden> i'm considering adapting openstack-ansible-security for Fedora
14:29:51 <mhayden> http://docs.openstack.org/developer/openstack-ansible-security/
14:30:12 <Sparks> mhayden: Tell us more!
14:30:13 <mhayden> TL;DR - apply STIG hardening standards w/ansible so that it's easy to roll into other playbooks/roles
14:30:35 <mhayden> right now it takes the RHEL 6 STIG and translates it to Ubuntu 14.04 (which is not terribly fun) ;)
14:30:44 <mhayden> but another company is adapting it for Debian 7/8
14:30:53 <mhayden> and i plan to get it working on F23 soon if i can get some tie
14:31:06 <mhayden> s/tie/time/
14:31:17 <Sparks> mhayden++
14:31:25 <linuxmodder> mhayden,  I can throw some testing time toward that  starting later this month
14:31:26 <mhayden> yes, one could use SCAP for this, but SCAP is a little heavy at times
14:31:34 <mhayden> linuxmodder: woot
14:31:46 <mhayden> also, it's not easy to roll in scap w/ansible if you're deploying new systems
14:31:49 <linuxmodder> have a STIG system on on personal lappy  even
14:31:56 <mhayden> haha, indeed! :)
14:32:12 <linuxmodder> using a slightly modded  Centos secure stig  ks
14:32:35 <mhayden> gotcha
14:32:47 <linuxmodder> likely same one you referenced think it was 6.4  based
14:33:02 <mhayden> yeah, any idea on when the RHEL 7 stig might get released?
14:33:16 <mhayden> IIRC, some RHT folks contribute to that
14:33:39 <Sparks> mhayden: I think it all comes from RH.
14:33:51 <Sparks> mhayden: Maybe talk to Shawn Wells?
14:33:54 <linuxmodder> not seen any  dates but can  probe
14:34:34 <mhayden> Sparks: ah, that name sounds quite familiar
14:34:42 <mhayden> i think i was in one of his summit talks once
14:37:06 <mhayden> Sparks: that was about it for me
14:38:28 <Sparks> Okay, anyone have anything else?
14:38:48 <linuxmodder> anyone with  any youth or outreach ideas feel free to hit me  up have a startup venture with laptop meant to be  STIG complaint  in all variants and  oyuth  workshops
14:39:01 <Sparks> mhayden: Perhaps you could start a topic on the list regarding Ansible?
14:39:06 <linuxmodder> #link https://github.com/ameridea
14:39:26 <mhayden> Sparks: sure, in the context of the openstack-ansible-security repository?
14:39:42 <linuxmodder> makes sense to go that  route  mhayden
14:39:57 * mhayden will do
14:40:15 <linuxmodder> feel free to use my  github  addy or  corey84@fp.o ||  csheldon@ameridea.net
14:40:44 <Sparks> mhayden: Yes
14:44:35 <Sparks> Okay, anything else?
14:46:37 <Sparks> Okay, I'm hearing nothing else.  Everyone have a good day!
14:46:42 <Sparks> #endmeeting