For the helping out, we can use the Aqueduct channel for coordinating who's working on what.
IRC: #aqueduct on freenode.net
Vince = tummy
Lee Kinser = [~syn]
Vincent C. Passaro
CISSP, L|PT, E|CSA, C|EH, CEPT, CPT, LPIC-3 (Core/Security), RHCSA, Novell CLA, MCP, Security+, A+
Looking for volunteer to deal with ticket 103 (and to inspect other OVAL associated with
XCCDF in execution.xml).
Jeffrey Blank (1):
prose cleanup for execshield, daemon umask, core dumps * note
that a ticket was also issued for the OVAL, which had problems
RHEL6/input/system/permissions/execution.xml | 134 +++++++++++++-------------
1 files changed, 66 insertions(+), 68 deletions(-)
Updates based on DISA FSO feedback for STIG profile.
Willy Santos (3):
Added value selector for dod_short and commented value selector for
any_text; as reference in trac ticket #95
Mapped CCI-224 to no_files_unowned_by_user and
Created group and added prose for use of antivirus.
RHEL6/input/auxiliary/srg_support.xml | 4 ++--
RHEL6/input/system/accounts/banners.xml | 3 ++-
RHEL6/input/system/permissions/files.xml | 4 ++--
RHEL6/input/system/software/integrity.xml | 14 ++++++++++++++
4 files changed, 20 insertions(+), 5 deletions(-)
I wanted show off some of the features that are unique to SecState and are very relevant to this project. All of you are likely familiar with oscap. This tool is great if your use case includes interpreting entire sets of content described in a profile. However, if you want to tweak a profile you must adjust the XML by hand. SecState is capable of content management. You can cherry pick elements relevant to your environment.
What follows is an example of using SecState for the purpose.
First you import a profile (thanks to SSG for the content!):
# secstate import /usr/local/scap-security-guide/RHEL6/output/rhel6-xccdf-scap-security-guide.xml
Next you disable content you don't want to interpret. This is great when you want to enter a continuous monitoring mode and you want to trim down the result sets.
# secstate select -r RHEL-6 intro
Then you run the audit:
# secstate audit
Remediate the findings (thanks to Aqueduct for the content!).
# secstate remediate -y
I would recommend re-running the audit to ensure the findings are fixed:
# secstate audit
The reports it generates can be seen here:
I've uploaded some packages from CLIP here and created a yum repo:
My rationale for this email is that I need others, particularly those developing SCAP content, to use and advocate the use of this tool. It provides a great feature set not available in other tools.