Re: [Open-scap] Need help on openscap SSG question
by Jan Cerny
Hi,
I have no idea. Does Nessus have any "verbose" mode to get more
helpful error message?
Including scap-security-guide list in this conversation because there
might be people familiar with using SSG with Nessus.
Regards
On Mon, Apr 29, 2019 at 4:54 PM Riaz Ebrahim <mriazebrahim1(a)gmail.com> wrote:
>
> Hi Jan Cerny,
>
> Thanks a lot for your response, Your answer was very useful to understand about SSG files. As per your advice i tried with scap-security-guide-0.1.43-oval-510.zip and XML validation error was gone, but encountering new error as below from nessus
>
> "ssg-rhel6-ds-1.zip : Default namespace not found in OVAL"
>
> Do you get any clue by seeing this error?. Thanks in advance :)
>
> Thanks,
> Riaz
>
> On Mon, Apr 29, 2019 at 2:44 PM Jan Cerny <jcerny(a)redhat.com> wrote:
>>
>> Hi,
>>
>> I will try to answer, but I don't use Nessus, so I'm not sure what is
>> the exact reason of this fail.
>>
>> In general, the SSG files are validated against SCAP XML schemas, so
>> they are valid SCAP content.
>> However, SCAP standard consist of multiple separate specifications.
>> Strictly speaking, the SSG datastream
>> doesn't conform to SCAP 1.2 specification, because the datastream
>> contains OVAL checks conforming to OVAL
>> version 5.11 which is a part of SCAP 1.3. For SCAP 1.2 conformance it
>> would need to use OVAL checks
>> in version 5.10 or older.
>>
>> According to this forum thread, it seems that Nessus doesn't support
>> OVAL 5.11 it yet, but they say it's planned to be updated
>> https://community.tenable.com/s/question/0D5f200005hKRwqCAG/nessus-pro-7-...
>>
>> It could be a problem that Nessus expects datastreams that contain
>> OVAL 5.10 only.
>> Try using the SSG datastreams that contain OVAL 5.10 only. They can be
>> downloaded from
>> https://github.com/ComplianceAsCode/content/releases/download/v0.1.43/sca...
>> I hope Nessus should be able to consume these files.
>>
>> The reason why we use 5.11 is that it contains new checks that allows
>> us to check easily system services using systemd
>> and other new things introduced in RHEL 7. The aforementioned
>> datastreams that contain OVAL 5.10 only
>> have limited abilities in comparison with those containing OVAL 5.11.
>>
>> Best Regards
>>
>> Jan Černý
>> Security Technologies | Red Hat, Inc.
>>
>>
>> On Sat, Apr 27, 2019 at 6:34 AM Riaz Ebrahim <mriazebrahim1(a)gmail.com> wrote:
>> >
>> > I need help on openscap SSG project.
>> >
>> > I am currently exploring SCAP Auditing feature from Nessus console. I understood that Nessus supports SCAP Content (1.0 or 1.1 or 1.2) which can be downloaded from NIST repository (https://nvd.nist.gov/ncp/repository) based on the target host version. This works great, However when i use SCAP from OpenSCAP SSG (example "ssg-rhel6-ds.xml”), i am getting error as “sg-rhel6-ds. .zip : sg-rhel6-ds.xml failed XML Schema validation” .
>> >
>> > I would like to what is the difference between openSSG scap data stream & scap1.2 content downloaded from NIST repository. How i can convert openssg data stream (Example - ssg-rhel6-ds.xml) to NIST scap 1.2 format.
>> >
>> >
>> > My objective - To use openscap SSG from Nessus. Nessus scap scanning expects SCAP 1.0, 1.1 or 1.2 content(in zip format).
>> >
>> >
>> > Thanks in advance!
>> >
>> > _______________________________________________
>> > Open-scap-list mailing list
>> > Open-scap-list(a)redhat.com
>> > https://www.redhat.com/mailman/listinfo/open-scap-list
--
Jan Černý
Security Technologies | Red Hat, Inc.
4 years, 1 month
Benchmark Group Rule order
by Alexander Bergmann
Hi everyone,
I have a question about the rules execution order. From my testing the
execution order is simply the rule order inside a group of a benchmark.
It looks like the order simply depends on the directory structure of
linux_os/guide.
Is there a way to specify the execution order?
The reason I'm asking is the following. I have 3 rules A, B and C. Rules
B and C can only be executed successfully if rule A was executed before.
A) package_X_installed
B) service_X_enabled
C) set_X_configuration
Sure, this is not a problem during normal evaluation, but the
remediation scripts will need the dependency. Otherwise the package is
not installed and the script will try to fix something.
An ugly workaround would be to run the remediation twice or three times,
but this should be avoided.
Any idea anyone? :)
Regards,
Alex~
--
Alexander Bergmann <abergmann(a)suse.com>, Security Engineer, GPG:9FFA4886
SUSE Linux GmbH, GF: Felix Imendörffer, Mary Higgins, Sri Rasiah
HRB 21284 (AG Nürnberg)
4 years, 1 month
"Could not parse profile" error
by Shawn Wells
When building off master, I receive the following errors:
> ./build_product rhel7
>
> ........
> Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_enhanced.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_high.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_intermediary.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_minimal.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/C2S-docker.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/docker-host.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/rhelh-stig.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-ansible-tower-upstream.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-http-disa.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-ipa-server-upstream.profile.
> . Skipping None.Could not parse profile
> /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-satellite-upstream.profile.
The ssg-rhel7-ds.xml appears built successfully. "xccdf info" shows the
profiles and I'm able to scan a host. But not sure what those output
lines mean -- any pointers?
4 years, 1 month
/root/openscap_data
by Mike Johnston
I'm a new to this project and have always done my SCAP lock downs with
kickstart scripts up until now. This looks to be something I switched to a
long time ago.
In the environment I work in, I need to make custom ISO installation disks
to send out to the field. I've been testing out the 'addon
xccdf_org.ssgproject.content_profile_stig-rhel7-disa' security profile and
then made a custom tailored XML following the guidelines keep a few things
on that were being removed. My problem is that now that I have my
'ssg-rhel7-ds-tailoring.xml' file, where do I put it in my kickstart
image? I've tried copying it in the post -nochroot section of my kickstart
to /tmp/openscap_data and /root/openscap_data and neither of those
worked.
Can someone tell me or show me where in the guide it show where it's
supposed to go?
This is what my kickstart looks like:
-------------------------------------
%post --nochroot
cp /run/install/repo/hardening/ssg-rhel7-ds-tailoring.xml
/root/openscap_data/
%addon org_fedora_oscap
content-type = scap-security-guide
profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa
tailoring-path=ssg-rhel7-ds-tailoring.xml
%end
-------------------------------------
Thanks for all the work...this is a great project.
4 years, 1 month