I updated the partition check macro to more properly reflect what we're
trying to accomplish with it. This is a result of the recent checks,
and test tags being gone through one by one (and the most recent
conversations with Jeff, and Shawn).
It will now output something similiar to the following example:
After running the following command verify that /tmp is in fact on its
own partition, or logical volume:
# df -h /tmp
To verify if /tmp lives on its own partition, or volume group simply
review the output of the above command. Often times, people forget to
assign important system filesystems to individual slices while building
the core system. This results in everything "living" under the root
volume group -- which in many enterprise environments is not the
If the directory in question does not reside on it's own partition or
volume group, this is a finding.
Tested on 20120928 by MM.
This patchset involves changing all output filenames so that their formatting
agrees with NIST SP 800-126. This is long overdue, but could cause
disruption for anyone getting something based on its filename.
This patchset also involves the creation of a new Makerule called content-stig,
which is a first cut at assembling SCAP content for use as a specific baseline.
Note that it is all very pre-release and pre-draft (and clearly labelled as such).
But it demonstrates how easily (well, compared to other SCAP things anyway)
the content can be transformed into a specific structure or format, and demonstrates
how we can iterate forward.
Jeffrey Blank (7):
new transform to add references to Rules (e.g. if a default ref
very rough first cut at producing XCCDF structured in the manner of a
minor typo fixups
including dublin core namespace in input documents
changed Makefile to create output filenames compliant with NIST
changed supporting transforms and scripts to support new filename
moving xccdf resolve operation to a Rule off the critical path (for
RHEL6/Makefile | 122 ++++++++++++++++------------
RHEL6/input/guide.xml | 2 +-
RHEL6/input/guide.xslt | 2 +-
RHEL6/transforms/cpe_generate.py | 5 +-
RHEL6/transforms/relabelids.py | 9 +-
RHEL6/transforms/shorthand2xccdf.xslt | 15 ++--
RHEL6/transforms/xccdf-addrefs.xslt | 46 +++++++++++
RHEL6/transforms/xccdf-ocilcheck2ref.xslt | 2 +-
RHEL6/transforms/xccdf2stigformat.xslt | 63 +++++++++++----
9 files changed, 181 insertions(+), 85 deletions(-)
create mode 100644 RHEL6/transforms/xccdf-addrefs.xslt
Hi Jeff (and list)
After talking with Shawn today, and recapping his conversation with you
this evening over IM, I'll start from the top again and do a row by row,
of all conent -- not just the check text. Will do the same yes/no
analysis, and of course submit content changes, and updates to wording
accordingly. Test tags will be added, like before so nothing changes
from that point.
Just an FYI.
> Date: Sun, 30 Sep 2012 14:50:15 -0400
> From: Shawn Wells <shawn(a)redhat.com>
> To: scap-security-guide(a)lists.fedorahosted.org
> Subject: Re: [PATCH] Fixed typo in example iptables network/netmask
> pair for limiting ssh port to trusted networks.
> Message-ID: <50689467.5000400(a)redhat.com>
> Content-Type: text/plain; charset=UTF-8; format=flowed
> On 9/28/12 1:21 PM, Andrew Gilmore wrote:
> > -<pre>-A RH-Firewall-1-INPUT -s netwk /mask -m state --state NEW -p tcp
> --dport 22 -j ACCEPT</pre>
> > +<pre>-A RH-Firewall-1-INPUT -s netwk/mask -m state --state NEW -p tcp
> --dport 22 -j ACCEPT</pre>
> Thanks for the catch! Ack
> Please push (or indicate you need someone to do so for you).
I don't have write access, this patch was mostly a drive by.
My agency is attempting to STIG a CentOS 6 image themselves, and I both
don't have time to wait, and thought someone else was probably doing it.
I'm glad you all are, but seems like you're months out as well from
production release. I know, I know, it is done when it is done. :)
I should probably introduce myself, as well.
I work for a Dept. of Interior agency on databases and hydrology, but
sometimes dabble here and there. :) I have contributed to the CIS
benchmarks for RHEL 5 and 6, and have all of two lines of code in the linux