RHEL6/Makefile | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/RHEL6/Makefile b/RHEL6/Makefile
index 3e0ba59..7edef74 100644
@@ -37,6 +37,7 @@ guide: shorthand2xccdf
# remove auxiliary Groups which are only for use in tables, and not guide output.
# specifying a nonexistent profile, "allrules," to make oscap print all Rules
xsltproc -o $(OUT)/unlinked-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removeaux.xslt $(OUT)/unlinked-rhel6-xccdf.xml
+ xsltproc -o $(OUT)/unlinked-notest-rhel6-xccdf-guide.xml $(TRANS)/xccdf-removetested.xslt $(OUT)/unlinked-rhel6-xccdf-guide.xml
oscap xccdf generate guide --profile allrules $(OUT)/unlinked-rhel6-xccdf-guide.xml > $(OUT)/rhel6-guide.html
# example, if needed: for converting XCCDF into shorthand
The existing values for <Value id="login_banner_text"> would never match anything because special
characters were not escaped properly. I added backslashes where appropriate and added information
to the description tag to inform future users. I also replaced line breaks and existing newlines
in "dod_default" and "usgcb_default" with a regex class that would allow for multiple spaces, tabs,
and newlines to increase the chances that imperfect copying and pasting from existing guidance will
work correctly. More can be done to improve this even further, but it would be at the risk of severely
It's worth pointing out that a tool like HTML tidy could potentially break these kinds of Regex
checks in the future by adding line breaks in inappropriate places.
Maura Dailey (2):
Fixing indenting for external variable line.
Added backslash escapes to the warning texts to fix the RegEx,
replaced line breaks with newlines, and added some more flexible
regex to handle variable spacing and newlines.
RHEL6/input/checks/banner_etc_issue.xml | 2 +-
RHEL6/input/system/accounts/banners.xml | 15 ++++-----------
2 files changed, 5 insertions(+), 12 deletions(-)
Various fixups/updates, to make this closer to publishable
as a guide.
Jeffrey Blank (7):
updates to the CCE verification script to be more informative
removal of commented/obsolete items for base services
changed Dovecot Rule to Group as it is guidance and not a compliance
update to NFS section (still perhaps incomplete)
removal of commented text, invalid CCE from root logins guidance
removal of commented/obsolete text from logging section
removal of unnecessary guidance from SSL section
RHEL6/input/services/base.xml | 51 ---------
RHEL6/input/services/imap.xml | 9 +--
RHEL6/input/services/nfs.xml | 109 ++------------------
.../system/accounts/restrictions/root_logins.xml | 20 +---
RHEL6/input/system/logging.xml | 13 ---
RHEL6/input/system/network/ssl.xml | 92 ++---------------
RHEL6/utils/verify-cce.py | 38 ++++---
7 files changed, 46 insertions(+), 286 deletions(-)
For those following the SCAP enablement of Anaconda, a new video. This
was originally posted to open-scap-list, but thought there would be
-------- Original Message --------
Subject: Re: [Open-scap] Video preview of the OSCAP Anaconda addon
Date: Tue, 14 May 2013 11:26:04 +0200
From: Vratislav Podzimek <vpodzime(a)redhat.com>
I've recorded another video  showing the current state of the addon's
UI and functionality.
The addon now handles not only data stream collections but also various
archives (ZIPs and tarballs) containing separate files with the XCCDF
benchmark with OVAL checks etc.
In the UI it is now possible to switch between profiles and in case of a
data stream collection content, it is also possible to switch between
data streams and checklists.
Enjoy the video and let me know, what you think about it!
Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic
Open-scap-list mailing list
Shawn & Crew.
First, wish to thank all for your efforts. It was very helpful for me, as I used the SSG to help me ensure I was ready and also as a sanity check after updates are done. We just went through our IV&V and my RHEL6 box did very well.
Wanted to give some feedback after latest scan regarding the disable_telnet_service check. It is now failing with the latest SSG content w/ openscap 0.9.3 from RH. telnet is not even installed on this box (removing telnet is another STIG). I know I can ignore this, but would think a check would be done to see if it is even installed first, and only do the disable check if telnet is in fact installed.