I've done a quick review of the SSG as far as were we stand in
comparison milestone 1 objectives. We are missing roughly 195/634 or
about 31% of the line items needed to meet milestone 1. The exact line
items missing are specified in the attached. I've opened tickets for
each piece up on the SSG site
(https://fedorahosted.org/scap-security-guide/report/2). If your
working on a section it would be great if you took the ticket so we can
try and avoid duplication of effort where possible.
We'll shortly be committing a script to do checking for consistency
between our OVAL and XCCDF. This should detect situations such as:
a reference from an XCCDF rule to an OVAL definition that doesn't exist.
an XCCDF rule exists (and is used in a profile) but doesn't include any
reference to a check.
mismatch between filename and OVAL definition name (as this is an
important convention for our approach to modular definitions)
NSA Information Assurance
Attached please find a patch to split up multiple values within single
ident element. It avoids things like the following
The separations will also help applications (Spacewalk for example) with
data processing, storing to database, etc.
In the current content there seems to be mixed two approaches how to
devise the ident:
(1) <ident system="http://cce.mitre.org">4365-3</ident>
(2) <ident system="http://cce.mitre.org">CCE-4112-9</ident>
I would like to not mix two. For instance usgsb-for-rhel5-desktop uses
exclusively the latter one. Even thought in the second approach there
seems to be kind of duplicity, I prefer it.
Would be a patch converting (1) to (2) acceptable for you?
Just in case anyone was curious, severity tags are now assigned to all
Rules. This should help ensure that the content meets the needs of
customers who require this.
Earlier, "high" and "medium" values were manually added to the severity
attribute for each XCCDF Rule (in line with corresponding DIACAP
definitions and influenced by previous STIGs).
For other Rules (the majority), the shorthand2xccdf.xslt transform was
tweaked to automatically add severity="low" if no severity was
specified. So the default case should be easy for authoring.
This could easily be shown in the html tables ("spreadsheets" if you
In keeping with the goal of Shawn's recent patch submissions, I added a
"dist" directory and placed some of the new information there. This
should put us on a patch to providing an RPM form of our output (and the
directories there should clarify our goals as well).
Note that the files in the "output" directory are not necessarily final
output, and at this time some of the scripts assume that they live in a
flat directory. The files in output may be further transformed (or may
in fact be final output). Lifting from "output" into "dist" shoud
signify an intent to distribute as final product.