Attached is a patch that demonstrates a method for adding fixes in a
It should allow fixes from different "systems" (bash, puppet, chef(?),
well whatever) and even different sets of fixes from the same "system"
(such as different sets of Puppet modules designed for different use
cases) to be linked into XCCDF output easily, and also would keep
remediation resources discrete from both each other and the main
project. It depends on linkage to Rules via id.
Comments are solicited.
Attached you will find the httpd patches I've been working on for the
Team's review. Forgive the amount of files, there was a lot of content
to be added and some changes done after further review of the initial
commits, brief description below. Feel free to contact me if you have
0001,0002,0004,0017 - Prose content for http.xml
0003,0005,0006,0007, 0008, 0009, 0010, 0011, 0018 - OVAL checks related
Willy Santos, RHCE
Red Hat Consulting
Cell: +1 (301) 254-7077
I've done a quick review of the SSG as far as were we stand in
comparison milestone 1 objectives. We are missing roughly 195/634 or
about 31% of the line items needed to meet milestone 1. The exact line
items missing are specified in the attached. I've opened tickets for
each piece up on the SSG site
(https://fedorahosted.org/scap-security-guide/report/2). If your
working on a section it would be great if you took the ticket so we can
try and avoid duplication of effort where possible.
I've added some guidelines for what constitutes good Rule-writing to the
(This is also linked from the main page in "How to Create a New Guidance
Item in XCCDF").
TLDR? Perhaps. But there are a few recent commits that provided
excellent content but which I may reformat to be consistent with these
We'll shortly be committing a script to do checking for consistency
between our OVAL and XCCDF. This should detect situations such as:
a reference from an XCCDF rule to an OVAL definition that doesn't exist.
an XCCDF rule exists (and is used in a profile) but doesn't include any
reference to a check.
mismatch between filename and OVAL definition name (as this is an
important convention for our approach to modular definitions)
NSA Information Assurance
Attached please find a patch to split up multiple values within single
ident element. It avoids things like the following
The separations will also help applications (Spacewalk for example) with
data processing, storing to database, etc.
In the current content there seems to be mixed two approaches how to
devise the ident:
(1) <ident system="http://cce.mitre.org">4365-3</ident>
(2) <ident system="http://cce.mitre.org">CCE-4112-9</ident>
I would like to not mix two. For instance usgsb-for-rhel5-desktop uses
exclusively the latter one. Even thought in the second approach there
seems to be kind of duplicity, I prefer it.
Would be a patch converting (1) to (2) acceptable for you?