"No definition with ID: ...." errors on RHEL 7.2 / SSG 0.1.25-3
by Shawn Wells
Running on RHEL 7.2, receiving "No definition with ID: ...." errors.
Known issue?
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.2 (Maipo)
# yum -y install openscap-scanner scap-security-guide
# rpm -qv openscap-scanner scap-security-guide
openscap-scanner-1.2.5-3.el7.x86_64
scap-security-guide-0.1.25-3.el7.noarch
# oscap info /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
.......
Profiles:
.........
xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream
# oscap xccdf eval --profile
xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream \
> /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
........
Title Enable SSH Warning Banner
Rule xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner
Ident CCE-27314-4
Result unknown
Title Create Warning Banners for All FTP Users
Rule xccdf_org.ssgproject.content_rule_ftp_present_banner
Ident CCE-RHEL7-CCE-TBD
Result pass
OpenSCAP Error: Probe at sd=4 (systemdunitdependency) reported an error:
Unknown error [oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:691 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:749 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:231 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:349 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:288 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:217 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:751 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:546 in result model. [oval_agent.c:188]
Probe at sd=4 (systemdunitdependency) reported an error: Unknown error
[oval_probe_ext.c:393]
Unable to receive a message from probe [oval_probe_ext.c:579]
No definition with ID: oval:ssg:def:319 in result model. [oval_agent.c:188]
8 years
Save the date -- Upcoming SCAP Security Guide Q/A Contributor Workshop (2015-11-24 09:00 => 11:00 AM Eastern Time)
by Jan Lieskovsky
Hello folks,
since:
* the above topic is appearing on the SSG mailing list pretty often
(people searching for guidance how to possibly contribute to SSG),
* the current documentation / wiki pages WRT to topic of contributing
aren't well at all,
we have decided to hold a SCAP Security Guide Q/A Contributor Workshop
to happen on Tuesday in a week from now, 2015-11-24 for two hours
(from 09:00 AM - 11:00 AM Eastern Time) with the following preliminary
agenda / topics:
SCAP Security Guide Q/A Contributor Workshop:
-----------------------------------------------------------------------
Agenda:
* Identify existing issues / problems when attempting to contribute to SSG
* How to contribute a new rule?
* How to design logical structure of the rule? (which existing group to place it)
* Basic details about SSG contribution:
* How to create and where to store XCCDF, OVAL, and remediation script?
* (Possibly) Create a new group within SSG
* Create all rules
* Expected developer workflow (how to commit & test the proposed changes)
* Test own scenario (if appropriate)
* Where's the documentation?
* Any other issues / problems identified during the call & subsequent feedback.
The above agenda is just sketch of (possible) topics to discuss.
Should you find some of the important items missing below,
let me know and I will add them.
As for the medium I am proposing BlueJeans. Should we need to use something
else, let me know!
Would you be interested in attending of this workshop (meet the SCAP Security
Guide upstream online and raise your voice / questions / concerns), please
let me know (OFF-LIST PREFERABLY) and I will add your name to the list
of the invited guests.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream)
8 years
Question on use of pam_faillock.so in account lockout remediation
by Sean
Hi,
I was curious if someone could point me toward the reasoning behind why
these remediation scripts are using /etc/pam.d/system-auth and
/etc/pam.d/password-auth? It seems like the man page for pam_faillock
directs the usage to /etc/pam.d/login instead.
Thank you kindly,
--Sean
8 years
OpenStack scap content
by Jeff Pullen
I'm new here... so I apologize if this has already been discussed. It seems that not much has been done lately with the OpenStack SCAP content. So it seems like a good place to start learning how to contribute to this project.
1. I wanted to get opinions on how to tackle the quick release cycle, and various components used within OpenStack. I noticed that in RHEL it is broken into versions (5/6/7), but Fedora isn't. OpenStack has a Fedora like release cycle, and it may be difficult to maintain numerous versions. Does it make sense to just have this work with the latest version?
2. OpenStack also has different server roles that will have different requirements, and services. For example the controllers have databases and web servers, where the computes will not. What is the best way to separate these?
Finally, if there are resources that can cut down on the learning curve on how all the scap files interact with each other I would really appreciate if you could send me those (off list).
8 years
could anyone please let me know how to obtain a vulnerability only (CVE) list output
by Su Zhang
Hello everyone,
I am new to scap project. I played with OVAL long time ago. I remember OVAL
was able to output a list of CVEs with true or false status indicating if
there is a vulnerability or not within the target system. However, while I
am playing with scap, I can not see such list in the report.html. Instead,
I can only see succeed or failed tests against certain properties. And only
vectors like CCE, CWE are mentioned in the outcome report. Is there any
option I can use to create a CVE only report?
Thanks a lot!
--
Su Zhang
8 years
auditing gnome use of elevated privileges (e.g. reboot/shutdown)?
by Robert Jacobson
How does one audit when the user performs an action that normally
requires elevated privileges?
Right now I'm allowing my users to shutdown/reboot systems, using the
Gnome menu item(s) and/or power button on the login screen.
I would like to audit this specific event but I don't know how to do
it. Just auditing the execution of /sbin/shutdown doesn't give me
sufficient information in order to determine that the reboot was a
result of a user clicking the gnome GUI item. I don't even see a
message that indicates the uid of the user in connection with the
shutdown event.
Here's an excerpt of the audit.log for when a normal user performs a reboot:
37 type=SYSCALL msg=audit(1446729410.820:6348): arch=c000003e
syscall=59 success=yes exit=0 a0=7e2700 a1=7e0bf0 a2=7e0780 a3=7f
fce02dad00 items=2 ppid=8633 pid=8634 auid=4294967295 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses =4294967295
comm="shutdown" exe="/sbin/shutdown"
subj=system_u:system_r:shutdown_t:s0-s0:c0.c1023 key="power"
38 type=EXECVE msg=audit(1446729410.820:6348): argc=3
a0="/sbin/shutdown" a1="-r" a2="now"
39 type=CWD msg=audit(1446729410.820:6348): cwd="/"
40 type=PATH msg=audit(1446729410.820:6348): item=0
name="/sbin/shutdown" inode=501 dev=fd:00 mode=0100755 ouid=0 ogid=0
rdev=0 0:00 obj=system_u:object_r:shutdown_exec_t:s0 nametype=NORMAL
41 type=PATH msg=audit(1446729410.820:6348): item=1 name=(null)
inode=1649 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=
system_u:object_r:ld_so_t:s0 nametype=NORMAL
42 type=SYSCALL msg=audit(1446729410.861:6349): arch=c000003e syscall=2
success=yes exit=5 a0=7fc8c1147db3 a1=80002 a2=7fc8c114 7db3
a3=fffffffffffffdcf items=1 ppid=8633 pid=8634 auid=4294967295 uid=0
gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="shutdown" exe="/sbin/shutdown"
subj=system_u:system_r:shutdown_t:s0-s0:c0.c1023 key="session "
43 type=CWD msg=audit(1446729410.861:6349): cwd="/"
44 type=PATH msg=audit(1446729410.861:6349): item=0
name="/var/run/utmp" inode=262150 dev=fd:03 mode=0100664 ouid=0 ogid=22
rde v=00:00 obj=system_u:object_r:initrc_var_run_t:s0 nametype=NORMAL
Unless I'm missing it, I don't see anything that indicates the action
originated from a gnome GUI item. I think this falls under AC-6.
Below is a link to my current audit.rules (based on an older security
baseline, not the current scap-security-guide)
http://pastebin.com/KvxNNBjZ
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Robert Jacobson Robert.C.Jacobson(a)nasa.gov
Lead System Admin Solar Dynamics Observatory (SDO)
Bldg 14, E222 (301) 286-1591
8 years, 1 month
when is dual ARCH required in audit.rules?
by Robert Jacobson
I've recently been trying to reconcile the audit.rules on my systems vs.
the scap-security-guide, and I'm confused about the ARCH rules.
When is it required to check both 32- and 64-bit architectures?
e.g. the guide says both 32- and 64-bit rules are required to check for
unauthorized access attempts:
# Unauthorized Access attempts (audit_rules_unsuccessful_file_modification)
-a always,exit -F arch=b32 -S creat -S open -S openat -S
open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500
-F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S
open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500
-F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S
open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500
-F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S
open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500
-F auid!=4294967295 -k access
But for modifying the network environment, only the 64-bit rule is required:
# Network changes ( audit_rules_networkconfig_modification )
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k
audit_rules_networkconfig_modification
I don't understand why the 32-bit check is required for open() calls but
not sethostname() calls?
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Robert Jacobson Robert.C.Jacobson(a)nasa.gov
Lead System Admin Solar Dynamics Observatory (SDO)
Bldg 14, E222 (301) 286-1591
8 years, 1 month
7th Anniversary and a New Website
by Martin Preisler
Dear OpenSCAP and SCAP Security Guide community,
today is the 7th anniversary of OpenSCAP! It has been a very exciting 7 years.
We have seen OpenSCAP grow from humble beginnings into a respected and widely
used project.
On the occasion of the anniversary we have released a new website for all
the OpenSCAP projects. We changed the concept of the website from a technical
wiki site for developers to a more hands-on, practical website suitable for
users. The URL -- http://www.open-scap.org/ -- is about the only thing we
kept as it was :-) We hope you like the changes. Please use
https://github.com/OpenSCAP/website/issues/new to provide feedback and
report any issues.
PS: Check out this amazing OpenSCAP anniversary cake by Lenka Horakova :-)
http://www.open-scap.org/wp-content/uploads/2015/11/openscap_cake.jpg
--
On behalf of the OpenSCAP team,
Martin Preisler
8 years, 1 month