[PATCH] [Fedora] Include datastream file (for remote system scans) into RPM package too
by Jan Lieskovsky
Based on Shawn's datastream format enhancements from
yesterday include the generated ssg-fedora-ds.xml datastream
file also into the final RPM package, so users could scan
remote Fedora systems without the need to perform the explicit
conversion by themselves.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
10 years, 1 month
Looking to start contributing
by Lee Kinser
Hey guys,
I just wanted to send out a quick hello to the list in hopes of getting to know some of you. I'm part of one of our security teams inside of Red Hat and am looking to do what I can to help expand on remediation content inside of SSG. I've worked for years in Government spaces, so my experience and interest is primarily around STIG content... I'd love to get SSG to a point where we can scan and remediate essentially everything that can possibly be automated inside of the STIG. I just might need some help from you guys in getting started. :)
First question, what's the format for remediation content? It appears that everything is held under ./scap-security-guide/RHEL/6/input/fixes/bash, but since they're named with words instead of finding ID, I'm a bit unsure as to how to map them to requirements in the policy... anyone have any tips there? How about how to add new fixes? Writing the BASH content is the easy part, I just need to know how to incorporate it into the SSG.
Thanks for the help!
--
Lee Kinser
Solutions Architect
Navy & Marine Corps
Red Hat Federal
843-868-1024 (Mobile)
lkinser(a)redhat.com
10 years, 1 month
[PATCH] [RHEL/7] Fix 'make validate' error caused by missing two OVAL checks definitions
by Jan Lieskovsky
This patch fixes 'make validate' error on current RHEL-7 content.
Running 'make validate' in RHEL/7 currently returns output as
detailed in attached old_output.txt.
This problem is / was caused by missing OVAL definitions for:
* service_sshd_disabled.xml and
* package_openssh-server_removed.xml
checks. Thus provide RHEL-7 specific check for service_sshd_disabled
(since it uses systemd and can't be shared with RHEL-6), and
move original package_openssh-server_removed.xml definition into
shared, making symlinks on appropriate places for RHEL-6 and RHEL-7
content(s).
After the patch 'make validate' succeeds already as shown in
attached new_output.txt (it still prints warnings about missing
definitions, but these aren't defined in RHEL-7 content yet => that
warning being expected and to be fixed gradually later together with
adding appropriate definitions. But after application of the patch
make validate runs / completes correctly, without the above error).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
10 years, 1 month
(no subject)
by Kordell, Luke T
Hello,
I have been following the steps listed on this website to attempt remediation of the selinux_policytype rule.
http://isimluk.livejournal.com/3573.html
I tried to edit the line in the /etc/selinux/config file via a fix tag in the selinux.xml file. After running the make command and re-scanning my system I realized the results omitted ALL rules dealing with Selinux. Just to make sure it wasn't anything within the <fix> tags I inserted a simple "touch" statement. It yielded the same results.
Does anyone know what might be causing this? I am attaching my version of the selinux.xml file.
Thanks,
Luke
10 years, 1 month