scap-security-guide September 2015

scap-security-guide@lists.fedorahosted.org

10 participants
5 discussions

Insight into release timing of RHEL7 STIG as "official" -- any help needed on the Project?
by Jeffrey Hawkins 13 Oct '15

13 Oct '15

Anyone have any insight on when the RHEL7 STIG is going to be ready for prime time to be picked up by DISA? I work for a company the delivers RHEL based Products that use the STIG as part of the Security Standards /Benchmark to follow, and right now we are middle of development cycle of migrating our Products from RHEL6 to RHEL7. We are leveraging existing RHEL6 STIG, and the early RHEL7 drafts where it make sense within our own Hardening Framework (developed and carried forward from pre-RHEL4 days). We would like to avoid what we faced with RHEL6 with chasing the Draft verses RHEL5 STIG, and speculating what would be in the final . So, thought I would raise a query of the Benchmark rollout... Are there areas where help is needed as I/we would be more than happy to help the Project? Thanks, Jeff

8 10

SSG 0.1.26 release timing
by Martin Preisler 23 Sep '15

23 Sep '15

Hi Jan! I plan to make SCAP Workbench 1.1.1 release in the short-term. The Windows and MacOSX versions bundle SSG. For obvious reasons I'd like to bundle fresh SSG 0.1.26. I am willing to wait a few days with the release to achieve that. Do you have specific plans regarding the timing? -- Martin Preisler Security Technologies | Red Hat, Inc.

2 1

Public Jenkins infrastructure
by Zbynek Moravec 22 Sep '15

22 Sep '15

Hi contributors, We have make our Jenkins server public - https://jenkins.open-scap.org/ (self signed certificate currently). Test-machines with Fedora22/RHEL6/RHEL7 are used. When you push something to your pull requests, Jenkins will automatically start testing (or ask admin to verification). White-list for automatic testing currently should contains people which have ever contributed to OpenSCAP/scap-security-guide. Tips: - If you don't want to test your your pull request automatically, you can add "[skip ci]" phrase to pull request description. - If you are in admin-list(currently OpenSCAP team in Brno), you can control jenkins testing by pull-request comments: - "ok to test" to accept this pull request for testing - "test this please" for a one time test run - "add to whitelist" to add the author to the whitelist If you have any tips/issue with jenkins, feel free to contact me. Zbynek Moravec

4 4

Why is Fedora xccdf missing so much compared to RHEL?
by Bruno Wolff III 18 Sep '15

18 Sep '15

I was looking at what is available for checks in Fedora compared to RHEL by using scap-workbench customization and found tha Fedora was missing a lot, even when the test commands were available (e.g yum check-update) in Fedora. I can believe that doing CVE checks for Fedora would be a significant amount of ongoing work that no one might want to do, but most stuff that works in RHEL is probably available in Fedora. And new stuff in Fedora that requires changes is likely to eventually show up in future RHEL versions and not be completely extra work.

3 5

A tool for support of SCAP content development
by Jan Cerny 14 Sep '15

14 Sep '15

Hello, Nowadays, there is almost no support for OVAL content development. The developers have to edit the XML files manually, there is no analysis tool, no debugger or any other tool that could make the content development faster and easier. I have started working on a new utility that will be able to debug OVAL checks, show step-by-step how they are evaluated, browse collected objects and system characteristics, communicate with probes, etc. I'm working on design of the utility now. I'm considering many alternatives, so I would like to ask you a few questions. * Can you describe most common problems that you have to face when you create the OVAL content? * How do you usually solve these problems? * Can you tell me an example when did you run into issues with OVAL? * Imagine an ideal tool for an OVAL developer. What should it be able to do? What would be its features? I would appreciate any suggestions, remarks or other inputs. Thank you very much for your reply. Regards Jan Černý Security Technologies | Red Hat, Inc.

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2015