The 2015 Red Hat Summit (http://www.redhat.com/summit) will take
place June 23-26 in Boston. The event may seem far away, but we all know
how long it takes for integrators and govies to allocate training and
travel budgets... :)
This year we've ensured that _*any*_ member of the SSG & broader
OpenSCAP community is eligible for discounted Summit passes at $950/pass
(or $895/pass for groups of 4+). Doesn't matter if you're a code
contributor, occasional voice on the mailing lists, or silent partner.
For reference, the full conference pass is generally $1,975 (ref
In 2012 the SCAP session was standing room only, and in 2013 it was
rated the #3 session (out of 196 sessions) by attendees. We hope to see
you there this year!
In full transparency: I don't get any RHT kickback or commissions
off this. I received a special registration code that allows me to
empirically show various managers/event staff how much interest there is
in SCAP and Security Automation. For every 10 registrants that use the
code, I get to send a RHT engineer to Red Hat Summit.
Contact me _*off-list*_ if interested!
We used to have to keep out banners under /etc/issue for the console,
and /etc/issue.net for remote access.
Would it be okay to make this rule deal with either one?
diff --git a/shared/oval/sshd_enable_warning_banner.xml
index 0bd8d32..ace8b75 100644
@@ -25,7 +25,7 @@
<ind:textfilecontent54_object id="obj_sshd_banner_set" version="2">
- <ind:pattern operation="pattern
+ <ind:pattern operation="pattern
I think there is a problem in the SSG content. I think that the current
content is intended to check the system configuration. This would be done by
examining the files on disk to warn about changes or thing that are
misconfigured. There is also another category of testing that is forensics
which checks the ephemeral / current values being enforced. Both are necessary
and useful, but they should not be mixed.
Some examples to illustrate the point:
auditctl -l vs cat /etc/audit/audit.rules
mount vs cat /etc/fstab
sysctl -a vs cat/etc/sysctl.conf
service ip6tables status vs chkconfig ip6tables --list
All these need to be changed in the prose to better express what the SCAP tool
is actually checking. IOW, you can get different results by hand than the tool
itself would report.
This really needs to be addressed before anyone else uses SSG as the basis of
their own recommendations. Again, forensic checking is useful and I would say
content should be specifically designed with that in mind. But it is not what
should be in a baseline.
-------- Original Message --------
Subject: [OVAL-DEVELOPER-LIST] OVAL Language 5.11 Release Candidate 1
Date: Tue, 18 Nov 2014 16:21:06 -0500
From: Rothenberg, David B. <drothenberg(a)MITRE.ORG>
Reply-To: OVAL Developer List (Closed Public Discussion)
Version 5.11 Release Candidate 1 is now available for community review
and comment. Attached is the change log for a full list of updates in
This Release Candidate includes support for several new platform schemas
migrated from the OVAL Sandbox  as voted upon by the OVAL Board .
Some of these community contributions expands on the possible collection
endpoints to include the mobile platforms Android and Apple iOS, and the
network management protocol NETCONF. Changes made to the existing
Independent, Windows, Linux, Solaris, and Cisco IOS schemas include new
Tests, improved enumeration options, and clarified documentation. The
Windows accesstoken_test, user_test, and group_test have all been
deprecated in this version of the Language in favor of newer tests to
address identified limitations. This is not a full list of all changes
to be expected from the official OVAL 5.11 Language release, as other
proposals are still being voted on by the OVAL Board.
Please let us know if you have any questions or discover any issues
while reviewing this Release Candidate.
To unsubscribe, send an email message to LISTSERV(a)LISTS.MITRE.ORG with
SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have
difficulties, write to OVAL-DEVELOPER-LIST-request(a)LISTS.MITRE.ORG.
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130
Using RHEL 5.11
xccdf.xml source from
Downloaded "Red Hat 5 Manual STIG - Version 1, Release 8"
That contains the U_RedHat_5_V1R8_Manual-xccdf.xml file.
I just tried running it, and all results show "notapplicable"
Looking through the docs, it does seem to point out, and google seems to
also point out that I need to be running on the right platform. It seems I
This is truly a Redhat 5 workstation(or server), not CentOS.
My command looks like this
oscap xccdf eval --profile MAC-1_Public --results result.xml
The zip file from iase website didn't contain a CPE file, so I assumed one
was not needed? Though I have a feeling this is my problem.
NOTE, that when I running I do see this message to stderr
WARNING: Skipping ./oval.xml file which is referenced from XCCDF content
Really hoping to get this working, this seems a great tool.
A while back you showed me a list of what I would describe as sign-offs on the tests and fixes for the different profiles?
Can you describe where to find that again?
Also looking for 800-53 to CcE mappings?
Sent from my iPhone
I think there should be an option to track the score even if a rule is waived. The score is a representation of risk, waiving the rule doesn't mean the risk disappeared but simply accepted. The amount of risk being accepted should be made available to the authorizing official or system owner. Also, a field for how long the waiver is valid for will be beneficial since permanent waivers are frowned upon in general.
----- Original Message -----
> From: "Josh Kayse" <Joshua.Kayse(a)gtri.gatech.edu>
> To: "Martin Preisler" <mpreisle(a)redhat.com>
> Cc: "open-scap-list" <open-scap-list(a)redhat.com>, scap-workbench(a)lists.fedorahosted.org, "SCAP Security Guide"
> Sent: Thursday, November 6, 2014 6:58:33 PM
> Subject: Re: [Open-scap] Waiver support in HTML report
> > On Nov 6, 2014, at 10:49 AM, Martin Preisler <mpreisle(a)redhat.com> wrote:
> > Hi,
> > I wrote a short blog post about waivers in HTML report.
> > These changes are coming in 1.2.0 so we would like to gather
> > some feedback before the release.
> > Suggestions welcome!
> > http://martin.preisler.me/2014/11/waivers-in-openscap-html-report/
> This is awesome. I’ll echo Shawn Wells question about generating waivers.
Replied about this to Shawn.
> Additionally, does a waived rule still impact the score of the system?
It does not. For all intents and purposes it behaves like a rule of the result
the waiver set it to. So if you waive a failed rule and make it "pass" you
basically make it behave exactly like a passed rule.
Today Red Hatters around the world are celebrating the twentieth
anniversary of the first release of Red Hat Linux, the Halloween
release, that set the stage for what has become RHEL:
Wanted to say thank you to everyone in the community who has
participated in the OpenSCAP and SSG communities. Between the OpenSCAP
interpreter and SSG projects there has been ~100 individuals contribute
code across 8,113 patches and 1,639,072 lines of code . OpenSCAP
established itself as the only open source, NIST certified interpreter.
The SSG project worked with government agencies, such as DISA FSO, NSA,
and NRO, to not only release their baselines, but incorporate them into
an open source project. RHEL now natively includes these tools and
content to natively support security baseline attestation and continuous
monitoring. It's been an amazing ride.
Back in 1998 I rode my /bicycle/ to purchase Red Hat Linux 5.2 (I was in
5th grade!), as my Windows desktop crapped out. I didn't actually know
what Linux was. All I knew was that I needed an operating system, and
that the Red Hat box had a cheaper sticker price than the Microsoft one.
After installing RHL I began exploring the Linux community, becoming
fascinated by it. The open source model fascinated me. As a kid I
imagined how amazing it'd be to someday work with the brightest minds
possible, to create technology that would be used all over the world, to
help make things better on a massive scale. Working with the OpenSCAP
and SSG communities has fulfilled that personal dream. I can't imagine
collaborating with a better group of people.
Sincerely, on behalf of Red Hat, and on behalf of myself, thank you to
everyone who has participated in the communities. Everyone here has
touched technology that now ships in Linux. Take a second to reflect on
that -- it's an amazing accomplishment!
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130