There are still many questions around using SCAP, such as the SCAP for
CVE scanning thread a few days ago.
To begin documenting FAQs -- both for the OpenSCAP/SSG pages, and formal
Red Hat documentation -- I've started to document common questions here:
What other topics/questions should be covered? Feel free to edit the
wiki directly or reply to the list! This feedback will be driven into
our wikis/manuals, and formal docs off redhat.com.
Don't limit to use SSG.... broader questions on how to store SCAP data,
using OpenSCAP, how policy is developed all make sense!
The 2015 Red Hat Summit (http://www.redhat.com/summit) will take
place June 23-26 in Boston. The event may seem far away, but we all know
how long it takes for integrators and govies to allocate training and
travel budgets... :)
This year we've ensured that _*any*_ member of the SSG & broader
OpenSCAP community is eligible for discounted Summit passes at $950/pass
(or $895/pass for groups of 4+). Doesn't matter if you're a code
contributor, occasional voice on the mailing lists, or silent partner.
For reference, the full conference pass is generally $1,975 (ref
In 2012 the SCAP session was standing room only, and in 2013 it was
rated the #3 session (out of 196 sessions) by attendees. We hope to see
you there this year!
In full transparency: I don't get any RHT kickback or commissions
off this. I received a special registration code that allows me to
empirically show various managers/event staff how much interest there is
in SCAP and Security Automation. For every 10 registrants that use the
code, I get to send a RHT engineer to Red Hat Summit.
Contact me _*off-list*_ if interested!
To date, I've used OpenSCAP to check the configuration of Unix operating
systems against government baselines.
But I assume OpenSCAP can consume any SCAP content including daily CVE
feeds? I have not tried that yet. And superficial searching did not reveal
any obvious documentation.
Does anyone know of a good example that would get a person started with
using OpenSCAP to consume CVE feeds? Any recommendations of freely
I was curious to know if anyone has tried building SCAP content on RHEL 5? Given that the intention of the scap-security-guide rpm package is meant to be built individually on each platform (RHEL5, RHEL 6, RHEL 7, Fedora), I have attempted trying to build SCAP content on RHEL5.
I am running into all sorts of issues. Here's what I gathered so far:
1) The following python files include 'with' statements, which are not supported by the latest version of Python on RHEL5 (2.4.3-56):
I was able to work through these errors, using the suggested workaround here:
2) The command 'xmlwf input/checks/*.xml' produces syntax errors for every file processed.
input/checks/system_info_architecture_x86.xml:1:0: syntax error
3) When the errors above are corrected in item 1, another error is generated, which has me stumped:
../shared/transforms/relabelids.py unlinked-fedora-xccdf.xml ssg
File "../shared/transforms/relabelids.py", line 62
ovalfile = ovalfiles.pop() if ovalfiles else None
SyntaxError: invalid syntax
There could be many more issues, but this is as far as I have gotten so far.
I am not much of a python guru so I was hoping someone else could chime in.
Trey Henefield, CISSP
Senior IAVA Engineer
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2015-03-18 14:15:56 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
Configuration Management for IT Systems (CMITS) 1.3 has been released on GitHub at <https://github.com/afseo/cmits>. From the README:
This is a toolset that makes it easier for network administrators to configure IT systems in compliance with U.S. Department of Defense requirements, and to document that compliance as automatically as possible, at several levels of detail.
CMITS contains many Puppet modules that implement portions of compliance with about 1000 requirements from nine DoD-level policy documents. These modules make it easier for administrators to construct a complete Puppet manifest which tells IT systems how to configure themselves in a compliant fashion. ("Puppet is IT automation software that helps system administrators manage infrastructure throughout its lifecycle" <http://puppetlabs.com/puppet/what-is-puppet/>.)
CMITS also contains scripts and extensions necessary to create a unified policy document, which lays out in complete detail how systems are configured using Puppet, and offers a single place to document IT-related processes, especially those necessary for compliance. The scripts and extensions also create automatic summaries, cross-references and indices, so that auditors can easily find assertions about compliance.
-- Jared Jennings, RHCE, Network Administrator, SURVICE Engineering Co.