note for the USGCB tickets
by Jeffrey Blank
Shawn (et al),
The ticketing system shows me you'd opened up a bunch of tickets to add
a "New rule" for items which were in the old RHEL 5 USGCB profile.
Okay, great, this helps with ensuring there is continuation of that
profile/baseline with some consistency.
A few notes:
1) I've been able to close some of the tickets as "fixed", providing
explanation as to why. Some of them are being handled through other
mechanisms for RHEL 6.
2) If anybody starts executing on the other tickets, the goal is NOT to
add new rules as the ticket says, but rather to conduct investigation to
see if the Rule is applicable to RHEL 6 in the same way it was
applicable to RHEL 5.
3) In the ticket titles, there is some of the odd CCE language which
talks about disabling/enabling things "as appropriate". That's fine as
an identifier (and the RHEL 6 USGCB did use some of this language).
However, this style of language, which is intended for neither a human
nor a machine, should never appear in the project's XCCDF. (Just in case
anybody gets any ideas.)
Thanks,
Jeff
--
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance
10 years, 2 months
xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett
Hello,
I'm trying to get started with making the latest clone from the git
repository and I get the following error:
[bpm]$ git clone
http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide
Cloning into 'scap-security-guide'...
remote: Counting objects: 14016, done.
remote: Compressing objects: 100% (5257/5257), done.
remote: Total 14016 (delta 10574), reused 10664 (delta 7718)
Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done.
Resolving deltas: 100% (10574/10574), done.
[bpm]$ cd scap-security-guide/RHEL6/
[bpm]$ make all
xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml
xmllint --format --output output/rhel6-shorthand.xml
output/rhel6-shorthand.xml
xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml
transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml
compilation error: file transforms/shorthand2xccdf.xslt line 19 element
attribute
xsl:attribute: The attribute name 'xmlns' is not allowed.
make: *** [shorthand2xccdf] Error 5
I've a fedora 18 , x86_64 installation.
Any ideas?
Thanks.
--
Brian Millett
"Shifts in paradigms
often cause nose bleeds."
Greg Glenn
10 years, 3 months
[PATCH 0/3] More tidying for make validate
by Maura Dailey
There are a few more coming that need more testing or aren't working correctly, but here's a small batch for now.
The behavior recurse="files" was deprecated, so I changed it to the normal "symlinks and directories". Also, the
environment variable tests were updated and replaced by the environmentvariable58 tests, objects, and states.
One check I can't submit an update to yet that has a similar problem is "accounts_root_path_dirs_no_write". I was
cleaning it up and replacing the deprecated check when I noticed that the check is not actually working correctly.
Specifying a single path in file_object gets the correct result of true or false, but passing in a variable with
multiple values (PATH, split into multiple strings) appears to always fail with "does not exist".
- Maura Dailey
Maura Dailey (3):
Replacing deprecated <ind:environmentvariable_...> tags with
<ind:environmentvariable58_...> tags
Removing deprecated recurse=files behavior.
Removing deprecated recurse="files" behavior
.../checks/accounts_dangerous_path_for_root.xml | 53 ++++++++++----------
.../input/checks/file_permissions_ungroupowned.xml | 4 +-
RHEL6/input/checks/file_permissions_unowned.xml | 4 +-
3 files changed, 31 insertions(+), 30 deletions(-)
10 years, 3 months
[PATCH 0/3] 3 Updates to cleanup make validate
by Maura Dailey
1. Added new check display_login_attempts to check for a pam_lastlog.so session line.
2. Added new check for .netrc files in /home
3. Renamed existing check so that the file name, OVAL id, and rule id all match.
- Maura Dailey
Maura Dailey (3):
Adding check for pam_lastlog.so
Adding check for no_netrc_files
Renaming oval check no_rsh_trusted_host_files to no_rsh_trust_files
to match rule ID
RHEL6/input/checks/display_login_attempts.xml | 25 +++++++++++++++++++
RHEL6/input/checks/no_netrc_files.xml | 22 ++++++++++++++++
RHEL6/input/checks/no_rsh_trust_files.xml | 26 ++++++++++----------
RHEL6/input/services/obsolete.xml | 2 +-
RHEL6/input/system/accounts/pam.xml | 2 +-
.../accounts/restrictions/password_storage.xml | 2 +-
6 files changed, 63 insertions(+), 16 deletions(-)
create mode 100644 RHEL6/input/checks/display_login_attempts.xml
create mode 100644 RHEL6/input/checks/no_netrc_files.xml
10 years, 4 months
[PATCH 0/3] copy editing
by David Smith
Most of this was just cleanup. Within the services and system directories, "RHEL6" and "RHEL 6" appeared nearly the same number of times -- this patch changes all of them to "RHEL 6" for consistency.
David Smith (3):
removed extraneous comma
copy editing
additional copy editing
RHEL6/input/intro/intro.xml | 2 +-
RHEL6/input/services/dns.xml | 2 +-
RHEL6/input/services/ldap.xml | 2 +-
RHEL6/input/services/mail.xml | 2 +-
RHEL6/input/services/nfs.xml | 2 +-
RHEL6/input/services/obsolete.xml | 2 +-
RHEL6/input/services/services.xml | 8 ++++----
RHEL6/input/system/accounts/accounts.xml | 2 +-
RHEL6/input/system/logging.xml | 2 +-
RHEL6/input/system/network/iptables.xml | 6 +++---
RHEL6/input/system/network/wireless.xml | 2 +-
RHEL6/input/system/selinux.xml | 4 ++--
12 files changed, 18 insertions(+), 18 deletions(-)
10 years, 4 months
[PATCH] Adding check for disabling GNOME thumbnailers
by Maura Dailey
I based this on the existing disable GNOME automounting check. I've run the command to disable it manually
and checked its output against what my script checks for with testcheck.py and everything seems to work
correctly.
- Maura Dailey
Maura Dailey (1):
Adding check for disabling GNOME thumbnailers in gconf
.../checks/gconf_gnome_disable_thumbnailers.xml | 28 ++++++++++++++++++++
RHEL6/input/system/permissions/mounting.xml | 2 +-
2 files changed, 29 insertions(+), 1 deletions(-)
create mode 100644 RHEL6/input/checks/gconf_gnome_disable_thumbnailers.xml
10 years, 4 months
[PATCH] modified makefile to remove test attestation from prose guide -- revised
by David Smith
---
RHEL6/Makefile | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 3e0ba59..9214ce9 100644
--- a/RHEL6/Makefile
+++ b/RHEL6/Makefile
@@ -37,7 +37,8 @@ guide: shorthand2xccdf
# remove auxiliary Groups which are only for use in tables, and not guide output.
# specifying a nonexistent profile, "allrules," to make oscap print all Rules
xsltproc -o $(OUT)/unlinked-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml
- oscap xccdf generate guide --profile allrules $(OUT)/unlinked-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html
+ xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf.xml
+ oscap xccdf generate guide --profile allrules $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html
# example, if needed: for converting XCCDF into shorthand
#xccdf2shorthand:
--
1.7.1
10 years, 4 months
[PATCH 0/6] getting make-validate closer to OK
by Jeffrey Blank
This is largely about deleting vestigial OVAL checks.
Some of the remaining "OVAL Check is not referenced by XCCDF" messages which
"make validate" produces call for more investigation.
And of course the OVAL schematron still has problems. But this gets us
closer.
Jeffrey Blank (6):
removal of packages from check templates
removal or correction of misnamed or obsolete OVAL checks
removal of comments, reference to nonexistent OVAL
refine verify-references to deal only with OVAL compliance checks for
OVAL
removal of references to nonexistent OVAL for some NFS guidance
corrections for typos in OVAL references
.../accounts_no_nis_inclusions_etc_passwd.xml | 23 ------
.../input/checks/audit_rules_dac_modification.xml | 40 -----------
RHEL6/input/checks/cups_limit_web_interface.xml | 30 --------
RHEL6/input/checks/file_mode_etc_crontab.xml | 33 ---------
RHEL6/input/checks/file_ownership_etc_skel.xml | 39 -----------
.../file_permissions_boot_grub_grub_conf.xml | 46 -------------
RHEL6/input/checks/file_user_owner_etc_crontab.xml | 25 -------
RHEL6/input/checks/mount_option_nodev_on_tmp.xml | 30 --------
.../input/checks/package_ipsec-tools_installed.xml | 25 -------
RHEL6/input/checks/package_talk-server_removed.xml | 25 -------
RHEL6/input/checks/package_talk_removed.xml | 25 -------
RHEL6/input/checks/service_abrtd_disabled.xml | 3 +
RHEL6/input/checks/sysconfig_ipv6_disable.xml | 37 ----------
RHEL6/input/checks/sysconfig_ipv6_networking.xml | 37 ----------
.../checks/sysconfig_networking_ipv6_ifcfg.xml | 37 ----------
...tl_net_ipv6_conf_default_accept_ra_rtr_pref.xml | 31 ---------
RHEL6/input/checks/templates/Makefile | 4 +-
.../input/checks/templates/packages_installed.csv | 5 --
RHEL6/input/checks/templates/packages_removed.csv | 3 -
RHEL6/input/checks/templates/services_disabled.csv | 2 +-
RHEL6/input/checks/xwindows_remote_listening.xml | 30 --------
RHEL6/input/services/http.xml | 72 --------------------
RHEL6/input/services/nfs.xml | 4 -
RHEL6/input/services/obsolete.xml | 2 +-
RHEL6/input/system/permissions/partitions.xml | 2 +-
RHEL6/utils/verify-references.py | 5 +-
26 files changed, 11 insertions(+), 604 deletions(-)
delete mode 100644 RHEL6/input/checks/accounts_no_nis_inclusions_etc_passwd.xml
delete mode 100644 RHEL6/input/checks/audit_rules_dac_modification.xml
delete mode 100644 RHEL6/input/checks/cups_limit_web_interface.xml
delete mode 100644 RHEL6/input/checks/file_mode_etc_crontab.xml
delete mode 100644 RHEL6/input/checks/file_ownership_etc_skel.xml
delete mode 100644 RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml
delete mode 100644 RHEL6/input/checks/file_user_owner_etc_crontab.xml
delete mode 100644 RHEL6/input/checks/mount_option_nodev_on_tmp.xml
delete mode 100644 RHEL6/input/checks/package_ipsec-tools_installed.xml
delete mode 100644 RHEL6/input/checks/package_talk-server_removed.xml
delete mode 100644 RHEL6/input/checks/package_talk_removed.xml
delete mode 100644 RHEL6/input/checks/sysconfig_ipv6_disable.xml
delete mode 100644 RHEL6/input/checks/sysconfig_ipv6_networking.xml
delete mode 100644 RHEL6/input/checks/sysconfig_networking_ipv6_ifcfg.xml
delete mode 100644 RHEL6/input/checks/sysctl_net_ipv6_conf_default_accept_ra_rtr_pref.xml
delete mode 100644 RHEL6/input/checks/xwindows_remote_listening.xml
10 years, 4 months
[PATCH] Renamed ensure_gpgcheck_never_disabled.xml
by Maura Dailey
The XCCDF pointed to an OVAL check that did not exist because the contents of
the OVAL check file did not match the filename. I renamed the OVAL check file
to match its contents and updated the OVAL reference to point to the correct
check.
- Maura Dailey
Maura Dailey (1):
Renamed OVAL check file to match contents, then updated OVAL
reference to point to said file.
.../checks/ensure_gpgcheck_never_disabled.xml | 26 --------------------
RHEL6/input/checks/yum_gpgcheck_never_disabled.xml | 26 ++++++++++++++++++++
RHEL6/input/system/software/updating.xml | 2 +-
3 files changed, 27 insertions(+), 27 deletions(-)
delete mode 100644 RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml
create mode 100644 RHEL6/input/checks/yum_gpgcheck_never_disabled.xml
10 years, 4 months