Adding rules for SUSE.
by S, Gautam
Hello,
I am trying to test how new rules can be added to SUSE. I could not find any documentation so this is what I have done so far:
1) Added a new file input/xccdf/system/permissions/files.xml with a couple of rules to check file ownership and permissions of the passwd file. These are copies on the same in RHEL/6 folder.
2) Updated the guide.xslt file for including this group.
3) Added "<platform>multi_platform_sle</platform>" to the appropriate OVAL checks in shared/oval.
4) Added "# platform = multi_platform_sle" to the appropriate fix scripts in /shared/templates/static/bash.
5) Modified Make to remove CentOS related operations from derivatives, guide and validate because they were breaking and are possibly not relevant to SUSE anyhow.
With this I am able to complete the build without errors and generate the output files. [Make fails for the latest sources fetched from the git repo]
I would like to start contributing the rules into SUSE directory. Would the above process be alright? Also, I do not know what needs to be done for the reference and ident tags in XCCDF. Please advise.
Thank you.
Regards,
Gautam.
6 years, 7 months
SCAP Security Guide 0.1.30
by Jan Lieskovsky
Hello folks,
it's my pleasure and honor to announce that SCAP Security Guide
release 0.1.30 has been created and is now available for download.
Highlights of this release:
* CNSS No.1253 (nist-CL-IL-AL) profile has been ported to Red Hat
Enterprise Linux 7,
* SCAP benchmark for Red Hat Enterprise Linux 7 now passes official
NIST SCAP ScapVal-1.2.14.1 content validation tool requirements,
* The XCCDF rules for Red Hat Enterprise Linux 7 has been equipped
with CCE identifiers,
* New CJIS "Criminal Justice Information Services (CJIS) Security Policy"
profile has been added to Red Hat Enterprise Linux 7 benchmark,
* Profile for each ANSSI hardening level for NP targets has been
added to Debian 8 benchmark,
* Remediation scripts don't rely on external
/usr/share/scap-security-guide/remediation_functions shell library
any more (instead starting from this release the remediation scripts
are part of the specific benchmark itself). This allows to perform
remediation without the need to have scap-security-guide RPM package
being installed.
For a more detailed overview of changes (bug fixes, enhancements)
implemented in this release please have a look at more detailed changelog:
* https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30
Full changelog at:
* https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.30
Zip archives with pre-built benchmarks in DataStream form:
* https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30...
(Zip archive using OVAL-5.11.1 language version)
* https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30...
(Zip archive using OVAL-5.10 language version)
Happy hardening!
Regards, Jan
--
Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream team)
6 years, 8 months
State of SUSE SSG builds.
by S, Gautam
Hello folks,
I see there are some PRs for adding initial build directories for SUSE. When I try a make on the directory it fails with a minor issue:
make
xsltproc --stringparam SHARED_RP "/root/ssg_sles/scap-security-guide/shared" -o output/shorthand.xml input/guide.xslt output/guide.xml
XPath error : Invalid expression
document('concat($SHARED_RP, '/xccdf/intro/shared_intro_os.xml'))
^
compilation error: file input/guide.xslt line 37 element apply-templates
XSLT-apply-templates: could not compile select expression 'document('concat($SHARED_RP, '/xccdf/intro/shared_intro_os.xml'))'
Upon fixing the extra single quote, I get another error:
make
xsltproc --stringparam SHARED_RP "/root/ssg_sles/scap-security-guide/shared" -o output/shorthand.xml input/guide.xslt output/guide.xml
warning: failed to load external entity "input/xccdf/system/system.xml"
warning: failed to load external entity "input/xccdf/services/services.xml"
warning: failed to load external entity "input/auxiliary/srg_support.xml"
xmllint --format --output output/shorthand.xml output/shorthand.xml
xsltproc --stringparam ssg_version "0.1.30" -o output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt output/shorthand.xml
oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml output/xccdf-unlinked-unresolved.xml
xsltproc -stringparam ref "nist" -o output/table-sle11-nistrefs.html transforms/xccdf2table-byref.xslt output/xccdf-unlinked-empty-groups.xml
xsltproc -stringparam profile "common" -o output/table-sle11-nistrefs-common.html \
transforms/xccdf2table-profilenistrefs.xslt output/xccdf-unlinked-empty-groups.xml
xsltproc -o output/table-sle11-cces.html transforms/xccdf2table-cce.xslt output/xccdf-unlinked-empty-groups.xml
xsltproc -stringparam map-to-items "../output/xccdf-unlinked-empty-groups.xml" -o output/table-sle11-srgmap.html \
transforms/table-srgmap.xslt ../../shared/references/disa-os-srg-v1r1.xml
warning: failed to load external entity "../../shared/references/disa-os-srg-v1r1.xml"
unable to parse ../../shared/references/disa-os-srg-v1r1.xml
make: *** [table-srgmap] Error 6
# ls ../../shared/references/disa-os-srg-v1r1.xml
ls: cannot access ../../shared/references/disa-os-srg-v1r1.xml: No such file or directory
Is there some other process for SUSE builds?
6 years, 9 months