Just out of curiosity, has anyone else received messages from the mailing list that about too many bounces? I got one a couple of weeks ago and did see a bunch of email on the web archive that I never received via email, but I just got another notice and there is nothing (recent) in the archive that I don't have here.
I've asked my IT group here to back track and see if any of our filters are bouncing stuff...
As promised, here is a display of the OVAL testing progress on
scap-security-guide, against the Rules for the STIG profile:
A very fat green bar in the "Check Text" column indicates that both OVAL
and XCCDF have been tested; a note with the testers' names/initials are
displayed at the bottom of the associated cell.
How check attestations are added to the project are covered in previous
discussions on the list (and hopefully apparent at a glance in the
corresponding input file).
The number of tested checks could increase significantly (momentum!), if
some of the templated ones are tested (which would then likely involve
adding a tag to the template, at least for the OVAL). Relatedly, I seem to
recall that one of the templated OVAL checks may not quite be right, such
as enabling/disabling a service for all runlevels instead of the usual 2-5.
Just a typo I noticed in passing.
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
RHEL6/input/system/auditing.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 4597b6f..cfb1425 100644
@@ -555,7 +555,7 @@ to the system time should be audited.</rationale>
<description>On a 32-bit system, add the following to <tt>/etc/audit/audit.rules</tt>:
-a always,exit -F arch=b32 -S stime -k audit_time_rules</pre>
-On a 64-bit system, the "-S time" is not necessary. The -k option allows for
+On a 64-bit system, the "-S stime" is not necessary. The -k option allows for
the specification of a key in string form that can be used for better
reporting capability through ausearch and aureport. Multiple system calls
can be defined on the same line to save space if desired, but is not required.
Here are minutes for the scap-security-guide meeting at DuClaw on 8/28.
Attendance was less than we'd hoped -- maybe we'll have more next time!
We want to prioritize the following activities:
1) Review/act/closeout existing Trac tickets. (Working on it this
2) Comprehensive proofread of the XCCDF guide.
3) Get with DISA FSO to sync on how to link the project's STIG profile
in XCCDF, with whatever they can ingest. This is really important to
make sure that the OVAL testing corresponds to the right XCCDF.
4) Continued OVAL testing (in parallel), with results captured
graphically. Currently the table with testing info should be captured
in the file table-stig-rhel6-shorttitles.html. (Oddly this doesn't quite
seem to be working, and it should likely be captured in a different file
anyway.) Ambition is to use maven and jenkins for testing against
openscap, and even other tools such as SCC.
5) Decide how to handle any references to NIST 800-53 controls in some
intellectually coherent/consistent way, to the extent possible.
6) Issue the prose guide and automated checking content, following the
testing of the OVAL content. This may precede the DISA issuance of
automated content. This should occur prior to the Red Hat Government
Symposium on Nov 6.
So I am still in the learning process and am currently creating my own SSG benchmark for Java.
Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types.
While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone.
However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal.
I can't seem to find any good information that breaks down each of these and their intended outcome.
Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true.
So to achieve my suggested goal, my thoughts were the following for cpe-oval:
That seems to work, but the criteria for the actual checks seem to get a little more grey.
My thoughts were:
But that doesn't seem to pan out the way I expected it to.
Any thoughts on how best to accomplish this?
Trey Henefield, CISSP
Senior IAVA Engineer
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2013-08-29 12:13:20 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
I have recently joined the Red Hat Security Technologies Team,
to help with selected packages maintenance and participate on discussions
wrt to OVAL content.
I have previously worked for Red Hat Security Response Team,
so OVAL and XCCDF shouldn't be that strange topics in comparison with those, I have
been working in the past with (but of course some time will be needed
me to get / become a fully-fledged member of this community).
Jeff's previously provided link:
was helpful for me too :) (already requested membership to the SCAP Security Guide
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item):
RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8)
[ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_\-\.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855.
[ERROR] Check system [ocil-transitional] is not supported. Check will not be performed.
Target System: RH64-64
Selected Profile: rht-ccp
Stream Name: ssg-rhel6-
Stream Version: 0.9
Stream Date: 2013-07-05
Rule ID: partition_for_tmp
This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed.
I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group.