From rmtzcx at gmail.com Fri Jun 3 02:53:05 2016 Content-Type: multipart/mixed; boundary="===============4832962856742886424==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Thu, 02 Jun 2016 21:52:53 -0500 Message-ID: In-Reply-To: CAB6RzTtzXG+g=FJD0ASnfLO=pnmtAvTgsxdcesBuD=wp_-7kxQ@mail.gmail.com --===============4832962856742886424== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi mpreisler, Thanks for you suggestion in IRC. This what I have so far, but it is still not working. I feel I am close, but it is not working yet. I would appreciate any suggestion No system accounts in /etc/at.allow CentOS 5 Red Hat Enterprise Linux 5 Group owner for /etc/at.allow and /etc/at.deny must exist. /etc/passwd ^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ 1 state_at_system_accounts_etc_passwd /etc/passwd ^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ 1 500 /etc/at.allow ^(.+)$ 1 state_at_system_accounts_at_allow_root state_at_system_accounts_at_allow_uid root -- Rodolfo -- Rodolfo Mart=C3=ADnez On Tue, May 31, 2016 at 5:43 PM, Rodolfo Mart=C3=ADnez = wrote: > Hi List, > > After many hours playing with SSG and OpenSCAP and not able to do what > I want I need some help. > > Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to > SSG and I am still getting familiar. > > The following OVAL test searches for system accounts (UID < 500) in > /etc/at.allow (I am showing just the relevant parts of > RHEL/5/input/oval/at_system_accounts.xml to explain my problem): > > > > > > comment=3D"Testing system accounts in /etc/at.allow" > id=3D"test_at_system_accounts_at_allow" version=3D"1"> > > > > > var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least one" > datatype=3D"string" /> > state_at_system_accounts_at_allow_uid > > > comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> > object_ref=3D"object_at_system_accounts_allow_list" /> > > > id=3D"object_at_system_accounts_allow_list" version=3D"1"> > /etc/at.allow > ^(.*)$ > datatype=3D"int">0 > > > version=3D"1"> > 500 > > > > The test above gets the users information from the sources specified > in NSS (/etc/nsswitch.conf) which is correct, however I want to create > a version that uses /etc/passwd directly. Why? We have many > (thousands?) of RHEL 5 based servers with LDAP integration, and many > (thousands?) of accounts in the LDAP servers. > > Simple tests like RHEL/5/input/oval/at_system_accounts.xml and > RHEL/5/input/oval/cron_system_accounts.xml can take hours to run > because they retrieve *all* users information from the LDAP servers > and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. > Also, if we run OpenSCAP (oscap) at the same time in a few servers > they hit the LDAP servers really bad. > > I have been trying to replace password_test and password_object by > textfilecontent54_test and textfilecontent54_object without any luck. > If you want, I can share my at_system_accounts.xml file that I thought > it was going to work. > > I would really appreciate any help or hint? > > > Regards > -- > Rodolfo Mart=C3=ADnez > --===============4832962856742886424== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgbXByZWlzbGVyLDxicj48 YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRh aG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhhbmtzIGZvciB5b3Ugc3VnZ2VzdGlv biBpbiBJUkMuPGJyPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0i Zm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5UaGlzIHdoYXQg SSBoYXZlIHNvIGZhciwgYnV0IGl0IGlzIHN0aWxsIG5vdCB3b3JraW5nLiBJIGZlZWwgSSBhbSBj bG9zZSwgYnV0IGl0IGlzIG5vdCB3b3JraW5nIHlldC4gSSB3b3VsZCBhcHByZWNpYXRlIGFueSBz dWdnZXN0aW9uPGJyPjxicj4mbHQ7ZGVmLWdyb3VwJmd0Ozxicj7CoCAmbHQ7ZGVmaW5pdGlvbiBj bGFzcz0mcXVvdDtjb21wbGlhbmNlJnF1b3Q7IGlkPSZxdW90O2F0X3N5c3RlbV9hY2NvdW50cyZx dW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7bWV0YWRhdGEmZ3Q7 PGJyPsKgwqDCoMKgwqAgJmx0O3RpdGxlJmd0O05vIHN5c3RlbSBhY2NvdW50cyBpbiAvZXRjL2F0 LmFsbG93Jmx0Oy90aXRsZSZndDs8YnI+wqDCoMKgwqDCoCAmbHQ7YWZmZWN0ZWQgZmFtaWx5PSZx dW90O3VuaXgmcXVvdDsmZ3Q7PGJyPsKgwqDCoMKgwqDCoMKgICZsdDtwbGF0Zm9ybSZndDtDZW50 T1MgNSZsdDsvcGxhdGZvcm0mZ3Q7PGJyPsKgwqDCoMKgwqDCoMKgICZsdDtwbGF0Zm9ybSZndDtS ZWQgSGF0IEVudGVycHJpc2UgTGludXggNSZsdDsvcGxhdGZvcm0mZ3Q7PGJyPsKgwqDCoMKgwqAg Jmx0Oy9hZmZlY3RlZCZndDs8YnI+wqDCoMKgwqDCoCAmbHQ7ZGVzY3JpcHRpb24mZ3Q7R3JvdXAg b3duZXIgZm9yIC9ldGMvYXQuYWxsb3cgYW5kIC9ldGMvYXQuZGVueSBtdXN0IGV4aXN0LiZsdDsv ZGVzY3JpcHRpb24mZ3Q7PGJyPsKgwqDCoCAmbHQ7L21ldGFkYXRhJmd0Ozxicj7CoMKgwqAgJmx0 O2NyaXRlcmlhJmd0Ozxicj7CoMKgwqDCoMKgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9JnF1b3Q7 dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgLyZndDs8YnI+wqDCoMKgICZs dDsvY3JpdGVyaWEmZ3Q7PGJyPsKgICZsdDsvZGVmaW5pdGlvbiZndDs8YnI+PGJyPsKgICZsdDsh LS0gVGhpcyB2YXJpYWJsZSBzaG91bGQgZ2V0IGFsbCB1c2VycyBmcm9tIC9ldGMvcGFzc3dkIHRo YXQgaGFzIFVJRCAmZ3Q7PSA1MDAgLS0mZ3Q7PGJyPsKgICZsdDtsb2NhbF92YXJpYWJsZSBpZD0m cXVvdDt2YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsgY29tbWVudD0mcXVv dDtBY2NvdW50cyBBbGxvd2VkJnF1b3Q7IGRhdGF0eXBlPSZxdW90O3N0cmluZyZxdW90OyB2ZXJz aW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7b2JqZWN0X2NvbXBvbmVudCBpdGVt X2ZpZWxkPSZxdW90O3N1YmV4cHJlc3Npb24mcXVvdDsgb2JqZWN0X3JlZj0mcXVvdDtvYmplY3Rf YXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsgLyZndDs8YnI+wqAgJmx0Oy9sb2Nh bF92YXJpYWJsZSZndDs8YnI+PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0 IGlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2ZXJz aW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMv cGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnBhdHRlcm4gb3Bl cmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XihbXjpdKyk6W146XSs6W1xkXSs6 W1xkXSs6W146XSo6W146XSs6W146XSokJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+wqDCoMKgICZs dDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90 OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj7C oMKgwqAgJmx0O2ZpbHRlciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9hdF9z eXN0ZW1fYWNjb3VudHNfZXRjX3Bhc3N3ZCZsdDsvZmlsdGVyJmd0Ozxicj7CoCAmbHQ7L2luZDp0 ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QmZ3Q7PGJyPjxicj7CoCAmbHQ7aW5kOnRleHRmaWxlY29u dGVudDU0X3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19ldGNfcGFzc3dk JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDtpbmQ6ZmlsZXBh dGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+wqDCoMKgICZsdDtpbmQ6 cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteW146XSs6W146 XSs6KFtcZF0rKTpbXGRdKzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxi cj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9y IGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsxJmx0Oy9pbmQ6aW5zdGFu Y2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnN1YmV4cHJlc3Npb24gb3BlcmF0aW9uPSZxdW90O2dy ZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7NTAw Jmx0Oy9pbmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+wqAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50 NTRfc3RhdGUmZ3Q7PGJyPjxicj48YnI+wqAgJmx0OyEtLSBUZXN0IHRvIGNoZWNrIHRoYXQgdGhl cmUgaXMgbm8gc3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQuYWxsb3cgLS0mZ3Q7PGJyPsKgICZs dDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCBjaGVjaz0mcXVvdDthbGwmcXVvdDsgY2hlY2tf ZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsgaWQ9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1f YWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgY29tbWVudD0mcXVvdDtUZXN0aW5nIC9ldGMvYXQuYWxs b3cgZm9yIHN5c3RlbSBhY2NvdW50cyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJy PsKgwqDCoCAmbHQ7aW5kOm9iamVjdCBvYmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1f YWNjb3VudHNfYWxsb3cmcXVvdDsgLyZndDs8YnI+wqAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50 NTRfdGVzdCZndDs8YnI+PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0IGNv bW1lbnQ9JnF1b3Q7L2V0Yy9hdC5hbGxvdyZxdW90OyBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVt X2FjY291bnRzX2FsbG93JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKg ICZsdDshLS0gR2V0IGFsbCB1c2VycyBmcm9tIC9ldGMvYXQuYWxsb3cgLS0mZ3Q7PGJyPsKgwqDC oCAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMvYXQuYWxsb3cmbHQ7L2luZDpmaWxlcGF0aCZndDs8 YnI+wqDCoMKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZx dW90OyZndDteKC4rKSQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0 YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBl PSZxdW90O2ludCZxdW90OyZndDsxJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7 IS0tIEV4Y2x1ZGUgcm9vdCAtLSZndDs8YnI+wqDCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90 O2V4Y2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93X3Jvb3Qm bHQ7L2ZpbHRlciZndDs8YnI+wqDCoMKgICZsdDshLS0gRXhjbHVkZSBhbGwgdXNlciBhY2NvdW50 cyAtLSZndDs8YnI+wqDCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2V4Y2x1ZGUmcXVvdDsm Z3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxi cj7CoCAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QmZ3Q7PGJyPsKgwqDCoCA8YnI+ wqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0 ZW1fYWNjb3VudHNfYXRfYWxsb3dfcm9vdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7 PGJyPsKgwqDCoCAmbHQ7aW5kOnRleHQmZ3Q7cm9vdCZsdDsvaW5kOnRleHQmZ3Q7PGJyPsKgICZs dDsvaW5kOnRleHRmaWxlY29udGVudDU0X3N0YXRlJmd0Ozxicj48YnI+wqAgJmx0O3VuaXg6cGFz c3dvcmRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93X3Vp ZCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7dW5peDp1c2Vy bmFtZSB2YXJfcmVmPSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90 OyB2YXJfY2hlY2s9JnF1b3Q7YXQgbGVhc3Qgb25lJnF1b3Q7IC8mZ3Q7PGJyPsKgICZsdDsvdW5p eDpwYXNzd29yZF9zdGF0ZSZndDs8YnI+PGJyPiZsdDsvZGVmLWdyb3VwJmd0Ozxicj48YnI+LS08 YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRh aG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+Um9kb2xmbzxicj48L2Rpdj48L2Rpdj48 ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGRpdiBjbGFzcz0i Z21haWxfc2lnbmF0dXJlIiBkYXRhLXNtYXJ0bWFpbD0iZ21haWxfc2lnbmF0dXJlIj48ZGl2IHN0 eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+LS08YnI+ PC9mb250PjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48 Zm9udCBzaXplPSIyIj5Sb2RvbGZvIE1hcnTDrW5lejwvZm9udD48L2Rpdj48L2Rpdj48L2Rpdj4K PGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBUdWUsIE1heSAzMSwgMjAxNiBhdCA1OjQz IFBNLCBSb2RvbGZvIE1hcnTDrW5leiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0 bzpybXR6Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4QGdtYWlsLmNvbTwvYT4m Z3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHls ZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1s ZWZ0OjFleCI+SGkgTGlzdCw8YnI+Cjxicj4KQWZ0ZXIgbWFueSBob3VycyBwbGF5aW5nIHdpdGgg U1NHIGFuZCBPcGVuU0NBUCBhbmQgbm90IGFibGUgdG8gZG8gd2hhdDxicj4KSSB3YW50IEkgbmVl ZCBzb21lIGhlbHAuPGJyPgo8YnI+CkZvcmdpdmUgbWUgaWYgSSB1c2UgU0NBUCBvciBPcGVuU0NB UCB0ZXJtcyBpbmNvcnJlY3RseSwgSSBhbSBuZXcgdG88YnI+ClNTRyBhbmQgSSBhbSBzdGlsbCBn ZXR0aW5nIGZhbWlsaWFyLjxicj4KPGJyPgpUaGUgZm9sbG93aW5nIE9WQUwgdGVzdCBzZWFyY2hl cyBmb3Igc3lzdGVtIGFjY291bnRzIChVSUQgJmx0OyA1MDApIGluPGJyPgovZXRjL2F0LmFsbG93 IChJIGFtIHNob3dpbmcganVzdCB0aGUgcmVsZXZhbnQgcGFydHMgb2Y8YnI+ClJIRUwvNS9pbnB1 dC9vdmFsL2F0X3N5c3RlbV9hY2NvdW50cy54bWwgdG8gZXhwbGFpbiBteSBwcm9ibGVtKTo8YnI+ Cjxicj4KJmx0O2NyaXRlcmlhJmd0Ozxicj4KwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVv dDt0ZXN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj4KJmx0Oy9j cml0ZXJpYSZndDs8YnI+Cjxicj4KJmx0O3VuaXg6cGFzc3dvcmRfdGVzdCBjaGVjaz0mcXVvdDth bGwmcXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDs8YnI+CmNvbW1l bnQ9JnF1b3Q7VGVzdGluZyBzeXN0ZW0gYWNjb3VudHMgaW4gL2V0Yy9hdC5hbGxvdyZxdW90Ozxi cj4KaWQ9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgdmVyc2lv bj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KwqAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9JnF1 b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj4KJmx0 Oy91bml4OnBhc3N3b3JkX3Rlc3QmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4OnBhc3N3b3JkX29iamVj dCBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93JnF1b3Q7IHZlcnNp b249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4OnVzZXJuYW1lIG9wZXJhdGlvbj0m cXVvdDtlcXVhbHMmcXVvdDs8YnI+CnZhcl9yZWY9JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50 c19hbGxvd19saXN0JnF1b3Q7IHZhcl9jaGVjaz0mcXVvdDthdCBsZWFzdCBvbmUmcXVvdDs8YnI+ CmRhdGF0eXBlPSZxdW90O3N0cmluZyZxdW90OyAvJmd0Ozxicj4KwqAgJmx0O2ZpbHRlciBhY3Rp b249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxs b3dfdWlkJmx0Oy9maWx0ZXImZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfb2JqZWN0Jmd0Ozxi cj4KPGJyPgombHQ7bG9jYWxfdmFyaWFibGUgaWQ9JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50 c19hbGxvd19saXN0JnF1b3Q7PGJyPgpjb21tZW50PSZxdW90O0FjY291bnRzIEFsbG93ZWQmcXVv dDsgZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8 YnI+CsKgICZsdDtvYmplY3RfY29tcG9uZW50IGl0ZW1fZmllbGQ9JnF1b3Q7c3ViZXhwcmVzc2lv biZxdW90Ozxicj4Kb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2Fs bG93X2xpc3QmcXVvdDsgLyZndDs8YnI+CiZsdDsvbG9jYWxfdmFyaWFibGUmZ3Q7PGJyPgo8YnI+ CiZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0IGNvbW1lbnQ9JnF1b3Q7L2V0Yy9hdC5h bGxvdyZxdW90Ozxicj4KaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19s aXN0JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDtpbmQ6ZmlsZXBh dGgmZ3Q7L2V0Yy9hdC5hbGxvdyZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxicj4KwqAgJmx0O2luZDpw YXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O14oLiopJCZsdDsv aW5kOnBhdHRlcm4mZ3Q7PGJyPgrCoCAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtn cmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDs8YnI+CmRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZn dDswJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPgombHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9v YmplY3QmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4OnBhc3N3b3JkX3N0YXRlIGlkPSZxdW90O3N0YXRl X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1 b3Q7Jmd0Ozxicj4KwqAgJmx0O3VuaXg6dXNlcl9pZCBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsg b3BlcmF0aW9uPSZxdW90O2xlc3MgdGhhbiZxdW90OyZndDs1MDAmbHQ7L3VuaXg6dXNlcl9pZCZn dDs8YnI+CiZsdDsvdW5peDpwYXNzd29yZF9zdGF0ZSZndDs8YnI+Cjxicj4KPGJyPgpUaGUgdGVz dCBhYm92ZSBnZXRzIHRoZSB1c2VycyBpbmZvcm1hdGlvbiBmcm9tIHRoZSBzb3VyY2VzIHNwZWNp ZmllZDxicj4KaW4gTlNTICgvZXRjL25zc3dpdGNoLmNvbmYpIHdoaWNoIGlzIGNvcnJlY3QsIGhv d2V2ZXIgSSB3YW50IHRvIGNyZWF0ZTxicj4KYSB2ZXJzaW9uIHRoYXQgdXNlcyAvZXRjL3Bhc3N3 ZCBkaXJlY3RseS4gV2h5PyBXZSBoYXZlIG1hbnk8YnI+Cih0aG91c2FuZHM/KSBvZiBSSEVMIDUg YmFzZWQgc2VydmVycyB3aXRoIExEQVAgaW50ZWdyYXRpb24sIGFuZCBtYW55PGJyPgoodGhvdXNh bmRzPykgb2YgYWNjb3VudHMgaW4gdGhlIExEQVAgc2VydmVycy48YnI+Cjxicj4KU2ltcGxlIHRl c3RzIGxpa2UgUkhFTC81L2lucHV0L292YWwvYXRfc3lzdGVtX2FjY291bnRzLnhtbCBhbmQ8YnI+ ClJIRUwvNS9pbnB1dC9vdmFsL2Nyb25fc3lzdGVtX2FjY291bnRzLnhtbCBjYW4gdGFrZSBob3Vy cyB0byBydW48YnI+CmJlY2F1c2UgdGhleSByZXRyaWV2ZSAqYWxsKiB1c2VycyBpbmZvcm1hdGlv biBmcm9tIHRoZSBMREFQIHNlcnZlcnM8YnI+CmFuZCB0aGV5IGRvIGl0ICpmb3IgZWFjaCBlbnRy eSogaW4gL2V0Yy9hdC5hbGxvdyBhbmQgL2V0Yy9jcm9uLmFsbG93Ljxicj4KQWxzbywgaWYgd2Ug cnVuIE9wZW5TQ0FQIChvc2NhcCkgYXQgdGhlIHNhbWUgdGltZSBpbiBhIGZldyBzZXJ2ZXJzPGJy Pgp0aGV5IGhpdCB0aGUgTERBUCBzZXJ2ZXJzIHJlYWxseSBiYWQuPGJyPgo8YnI+CkkgaGF2ZSBi ZWVuIHRyeWluZyB0byByZXBsYWNlIHBhc3N3b3JkX3Rlc3QgYW5kIHBhc3N3b3JkX29iamVjdCBi eTxicj4KdGV4dGZpbGVjb250ZW50NTRfdGVzdCBhbmQgdGV4dGZpbGVjb250ZW50NTRfb2JqZWN0 IHdpdGhvdXQgYW55IGx1Y2suPGJyPgpJZiB5b3Ugd2FudCwgSSBjYW4gc2hhcmUgbXkgYXRfc3lz dGVtX2FjY291bnRzLnhtbCBmaWxlIHRoYXQgSSB0aG91Z2h0PGJyPgppdCB3YXMgZ29pbmcgdG8g d29yay48YnI+Cjxicj4KSSB3b3VsZCByZWFsbHkgYXBwcmVjaWF0ZSBhbnkgaGVscCBvciBoaW50 Pzxicj4KPGJyPgo8YnI+ClJlZ2FyZHM8YnI+Ci0tPGJyPgpSb2RvbGZvIE1hcnTDrW5lejxicj4K PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4K --===============4832962856742886424==-- From redhatrises at gmail.com Tue Jun 7 18:04:14 2016 Content-Type: multipart/mixed; boundary="===============3955861756415178357==" MIME-Version: 1.0 From: Gabe Alford To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Tue, 07 Jun 2016 12:03:52 -0600 Message-ID: In-Reply-To: CAB6RzTuzK2vSg5DZhwRX5oRV4HNf54yhSrhwOgdtWCET7UMA0w@mail.gmail.com --===============3955861756415178357== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello Rodolfo, I just did a quick glance as I currently don't have the cycles to look into this but the "state_at_system_accounts_at_allow_uid" exclude filter is where this is not working. It is not filtering UIDs greater than 1 or 500 for that matter. Specifically this subexpression is what is failing: 500 Gabe On Thu, Jun 2, 2016 at 8:52 PM, Rodolfo Mart=C3=ADnez = wrote: > Hi mpreisler, > > Thanks for you suggestion in IRC. > > This what I have so far, but it is still not working. I feel I am close, > but it is not working yet. I would appreciate any suggestion > > > > > No system accounts in /etc/at.allow > > CentOS 5 > Red Hat Enterprise Linux 5 > > Group owner for /etc/at.allow and /etc/at.deny must > exist. > > > > > > > > Allowed" datatype=3D"string" version=3D"1"> > object_ref=3D"object_at_system_accounts_allow_list" /> > > > version=3D"1"> > /etc/passwd > match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ > datatype=3D"int">1 > state_at_system_accounts_etc_passwd > > > version=3D"1"> > /etc/passwd > match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ > datatype=3D"int">1 > datatype=3D"int">500 > > > > > id=3D"test_at_system_accounts_at_allow" comment=3D"Testing /etc/at.allow = for > system accounts" version=3D"1"> > > > > id=3D"object_at_system_accounts_allow" version=3D"1"> > > /etc/at.allow > ^(.+)$ > datatype=3D"int">1 > > action=3D"exclude">state_at_system_accounts_at_allow_root > > state_at_system_accounts_at_allow_uid > > > version=3D"1"> > root > > > version=3D"1"> > var_check=3D"at least one" /> > > > > > -- > Rodolfo > > -- > Rodolfo Mart=C3=ADnez > > On Tue, May 31, 2016 at 5:43 PM, Rodolfo Mart=C3=ADnez > wrote: > >> Hi List, >> >> After many hours playing with SSG and OpenSCAP and not able to do what >> I want I need some help. >> >> Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to >> SSG and I am still getting familiar. >> >> The following OVAL test searches for system accounts (UID < 500) in >> /etc/at.allow (I am showing just the relevant parts of >> RHEL/5/input/oval/at_system_accounts.xml to explain my problem): >> >> >> >> >> >> > comment=3D"Testing system accounts in /etc/at.allow" >> id=3D"test_at_system_accounts_at_allow" version=3D"1"> >> >> >> >> >> > var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least one" >> datatype=3D"string" /> >> state_at_system_accounts_at_allow_uid >> >> >> > comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >> > object_ref=3D"object_at_system_accounts_allow_list" /> >> >> >> > id=3D"object_at_system_accounts_allow_list" version=3D"1"> >> /etc/at.allow >> ^(.*)$ >> > datatype=3D"int">0 >> >> >> > version=3D"1"> >> 500 >> >> >> >> The test above gets the users information from the sources specified >> in NSS (/etc/nsswitch.conf) which is correct, however I want to create >> a version that uses /etc/passwd directly. Why? We have many >> (thousands?) of RHEL 5 based servers with LDAP integration, and many >> (thousands?) of accounts in the LDAP servers. >> >> Simple tests like RHEL/5/input/oval/at_system_accounts.xml and >> RHEL/5/input/oval/cron_system_accounts.xml can take hours to run >> because they retrieve *all* users information from the LDAP servers >> and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. >> Also, if we run OpenSCAP (oscap) at the same time in a few servers >> they hit the LDAP servers really bad. >> >> I have been trying to replace password_test and password_object by >> textfilecontent54_test and textfilecontent54_object without any luck. >> If you want, I can share my at_system_accounts.xml file that I thought >> it was going to work. >> >> I would really appreciate any help or hint? >> >> >> Regards >> -- >> Rodolfo Mart=C3=ADnez >> > > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============3955861756415178357== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdj48ZGl2PjxkaXY+SGVsbG8gUm9kb2xmbyw8YnI+PGJyPjwvZGl2 PkkganVzdCBkaWQgYSBxdWljayBnbGFuY2UgYXMgSSBjdXJyZW50bHkgZG9uJiMzOTt0IGhhdmUg dGhlIGN5Y2xlcyB0byBsb29rIGludG8gdGhpcyBidXQgdGhlICZxdW90O3N0YXRlX2F0X3N5c3Rl bV9hY2NvdW50c19hdF9hbGxvd191aWQmcXVvdDsgZXhjbHVkZSBmaWx0ZXIgaXMgd2hlcmUgdGhp cyBpcyBub3Qgd29ya2luZy4gSXQgaXMgbm90IGZpbHRlcmluZyBVSURzIGdyZWF0ZXIgdGhhbiAx IG9yIDUwMCBmb3IgdGhhdCBtYXR0ZXIuPGJyPjwvZGl2PlNwZWNpZmljYWxseSB0aGlzIHN1YmV4 cHJlc3Npb24gaXMgd2hhdCBpcyBmYWlsaW5nOjxicj48YnI+Jmx0O2luZDpzdWJleHByZXNzaW9u IG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1 b3Q7aW50JnF1b3Q7Jmd0OzUwMCZsdDsvaW5kOnN1YmV4cHJlc3Npb24mZ3Q7PGJyPjwvZGl2Pjxk aXY+PGJyPkdhYmU8YnI+PGRpdj48ZGl2PjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxi cj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gVGh1LCBKdW4gMiwgMjAxNiBhdCA4OjUyIFBN LCBSb2RvbGZvIE1hcnTDrW5leiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpy bXR6Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4QGdtYWlsLmNvbTwvYT4mZ3Q7 PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0i bWFyZ2luOjBweCAwcHggMHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIw NCwyMDQpO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgZGlyPSJsdHIiPjxkaXYgc3R5bGU9ImZvbnQt ZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgbXByZWlzbGVyLDxi cj48YnI+PC9kaXY+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9u dC1zaXplOnNtYWxsIj5UaGFua3MgZm9yIHlvdSBzdWdnZXN0aW9uIGluIElSQy48YnI+PGJyPjwv ZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpz bWFsbCI+VGhpcyB3aGF0IEkgaGF2ZSBzbyBmYXIsIGJ1dCBpdCBpcyBzdGlsbCBub3Qgd29ya2lu Zy4gSSBmZWVsIEkgYW0gY2xvc2UsIGJ1dCBpdCBpcyBub3Qgd29ya2luZyB5ZXQuIEkgd291bGQg YXBwcmVjaWF0ZSBhbnkgc3VnZ2VzdGlvbjxicj48YnI+Jmx0O2RlZi1ncm91cCZndDs8YnI+wqAg Jmx0O2RlZmluaXRpb24gY2xhc3M9JnF1b3Q7Y29tcGxpYW5jZSZxdW90OyBpZD0mcXVvdDthdF9z eXN0ZW1fYWNjb3VudHMmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAg Jmx0O21ldGFkYXRhJmd0Ozxicj7CoMKgwqDCoMKgICZsdDt0aXRsZSZndDtObyBzeXN0ZW0gYWNj b3VudHMgaW4gL2V0Yy9hdC5hbGxvdyZsdDsvdGl0bGUmZ3Q7PGJyPsKgwqDCoMKgwqAgJmx0O2Fm ZmVjdGVkIGZhbWlseT0mcXVvdDt1bml4JnF1b3Q7Jmd0Ozxicj7CoMKgwqDCoMKgwqDCoCAmbHQ7 cGxhdGZvcm0mZ3Q7Q2VudE9TIDUmbHQ7L3BsYXRmb3JtJmd0Ozxicj7CoMKgwqDCoMKgwqDCoCAm bHQ7cGxhdGZvcm0mZ3Q7UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IDUmbHQ7L3BsYXRmb3JtJmd0 Ozxicj7CoMKgwqDCoMKgICZsdDsvYWZmZWN0ZWQmZ3Q7PGJyPsKgwqDCoMKgwqAgJmx0O2Rlc2Ny aXB0aW9uJmd0O0dyb3VwIG93bmVyIGZvciAvZXRjL2F0LmFsbG93IGFuZCAvZXRjL2F0LmRlbnkg bXVzdCBleGlzdC4mbHQ7L2Rlc2NyaXB0aW9uJmd0Ozxicj7CoMKgwqAgJmx0Oy9tZXRhZGF0YSZn dDs8YnI+wqDCoMKgICZsdDtjcml0ZXJpYSZndDs8YnI+wqDCoMKgwqDCoCAmbHQ7Y3JpdGVyaW9u IHRlc3RfcmVmPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93JnF1b3Q7IC8m Z3Q7PGJyPsKgwqDCoCAmbHQ7L2NyaXRlcmlhJmd0Ozxicj7CoCAmbHQ7L2RlZmluaXRpb24mZ3Q7 PGJyPjxicj7CoCAmbHQ7IS0tIFRoaXMgdmFyaWFibGUgc2hvdWxkIGdldCBhbGwgdXNlcnMgZnJv bSAvZXRjL3Bhc3N3ZCB0aGF0IGhhcyBVSUQgJmd0Oz0gNTAwIC0tJmd0Ozxicj7CoCAmbHQ7bG9j YWxfdmFyaWFibGUgaWQ9JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1 b3Q7IGNvbW1lbnQ9JnF1b3Q7QWNjb3VudHMgQWxsb3dlZCZxdW90OyBkYXRhdHlwZT0mcXVvdDtz dHJpbmcmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O29iamVj dF9jb21wb25lbnQgaXRlbV9maWVsZD0mcXVvdDtzdWJleHByZXNzaW9uJnF1b3Q7IG9iamVjdF9y ZWY9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IC8mZ3Q7 PGJyPsKgICZsdDsvbG9jYWxfdmFyaWFibGUmZ3Q7PGJyPjxicj7CoCAmbHQ7aW5kOnRleHRmaWxl Y29udGVudDU0X29iamVjdCBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93 X2xpc3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDpm aWxlcGF0aCZndDsvZXRjL3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxicj7CoMKgwqAgJmx0 O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O14oW146 XSspOlteOl0rOltcZF0rOltcZF0rOlteOl0qOlteOl0rOlteOl0qJCZsdDsvaW5kOnBhdHRlcm4m Z3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRo YW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDpp bnN0YW5jZSZndDs8YnI+wqDCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVv dDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2V0Y19wYXNzd2QmbHQ7L2ZpbHRlciZndDs8 YnI+wqAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj48YnI+wqAgJmx0 O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNj b3VudHNfZXRjX3Bhc3N3ZCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDC oCAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMvcGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJy PsKgwqDCoCAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVv dDsmZ3Q7XlteOl0rOlteOl0rOihbXGRdKyk6W1xkXSs6W146XSo6W146XSs6W146XSokJmx0Oy9p bmQ6cGF0dGVybiZndDs8YnI+wqDCoMKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90 O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7 MSZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpzdWJleHByZXNzaW9uIG9w ZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7 aW50JnF1b3Q7Jmd0OzUwMCZsdDsvaW5kOnN1YmV4cHJlc3Npb24mZ3Q7PGJyPjwvZGl2PjwvZGl2 PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn aW46MHB4IDBweCAwcHggMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIw NCk7cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBkaXI9Imx0ciI+PGRpdiBzdHlsZT0iZm9udC1mYW1p bHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj7CoCAmbHQ7L2luZDp0ZXh0Zmls ZWNvbnRlbnQ1NF9zdGF0ZSZndDs8YnI+PGJyPjxicj7CoCAmbHQ7IS0tIFRlc3QgdG8gY2hlY2sg dGhhdCB0aGVyZSBpcyBubyBzeXN0ZW0gYWNjb3VudHMgaW4gL2V0Yy9hdC5hbGxvdyAtLSZndDs8 YnI+wqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0IGNoZWNrPSZxdW90O2FsbCZxdW90 OyBjaGVja19leGlzdGVuY2U9JnF1b3Q7bm9uZV9leGlzdCZxdW90OyBpZD0mcXVvdDt0ZXN0X2F0 X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyBjb21tZW50PSZxdW90O1Rlc3RpbmcgL2V0 Yy9hdC5hbGxvdyBmb3Igc3lzdGVtIGFjY291bnRzJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90 OyZndDs8YnI+wqDCoMKgICZsdDtpbmQ6b2JqZWN0IG9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2F0 X3N5c3RlbV9hY2NvdW50c19hbGxvdyZxdW90OyAvJmd0Ozxicj7CoCAmbHQ7L2luZDp0ZXh0Zmls ZWNvbnRlbnQ1NF90ZXN0Jmd0Ozxicj48YnI+wqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9v YmplY3QgY29tbWVudD0mcXVvdDsvZXRjL2F0LmFsbG93JnF1b3Q7IGlkPSZxdW90O29iamVjdF9h dF9zeXN0ZW1fYWNjb3VudHNfYWxsb3cmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxi cj7CoMKgwqAgJmx0OyEtLSBHZXQgYWxsIHVzZXJzIGZyb20gL2V0Yy9hdC5hbGxvdyAtLSZndDs8 YnI+wqDCoMKgICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9hdC5hbGxvdyZsdDsvaW5kOmZpbGVw YXRoJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJu IG1hdGNoJnF1b3Q7Jmd0O14oLispJCZsdDsvaW5kOnBhdHRlcm4mZ3Q7PGJyPsKgwqDCoCAmbHQ7 aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsg ZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+wqDC oMKgICZsdDshLS0gRXhjbHVkZSByb290IC0tJmd0Ozxicj7CoMKgwqAgJmx0O2ZpbHRlciBhY3Rp b249JnF1b3Q7ZXhjbHVkZSZxdW90OyZndDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxs b3dfcm9vdCZsdDsvZmlsdGVyJmd0Ozxicj7CoMKgwqAgJmx0OyEtLSBFeGNsdWRlIGFsbCB1c2Vy IGFjY291bnRzIC0tJmd0Ozxicj7CoMKgwqAgJmx0O2ZpbHRlciBhY3Rpb249JnF1b3Q7ZXhjbHVk ZSZxdW90OyZndDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3dfdWlkJmx0Oy9maWx0 ZXImZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDs8YnI+wqDC oMKgIDxicj7CoCAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X3N0YXRlIGlkPSZxdW90O3N0YXRl X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd19yb290JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZx dW90OyZndDs8YnI+wqDCoMKgICZsdDtpbmQ6dGV4dCZndDtyb290Jmx0Oy9pbmQ6dGV4dCZndDs8 YnI+wqAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7PGJyPjxicj7CoCAmbHQ7 dW5peDpwYXNzd29yZF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRf YWxsb3dfdWlkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDt1 bml4OnVzZXJuYW1lIHZhcl9yZWY9JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19s aXN0JnF1b3Q7IHZhcl9jaGVjaz0mcXVvdDthdCBsZWFzdCBvbmUmcXVvdDsgLyZndDs8YnI+wqAg Jmx0Oy91bml4OnBhc3N3b3JkX3N0YXRlJmd0Ozxicj48YnI+Jmx0Oy9kZWYtZ3JvdXAmZ3Q7PGJy Pjxicj4tLTxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJp Zjtmb250LXNpemU6c21hbGwiPlJvZG9sZm88YnI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21h aWxfZXh0cmEiPjxiciBjbGVhcj0iYWxsIj48ZGl2PjxkaXYgZGF0YS1zbWFydG1haWw9ImdtYWls X3NpZ25hdHVyZSI+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxm b250IHNpemU9IjIiPi0tPGJyPjwvZm9udD48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0 YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+Um9kb2xmbyBNYXJ0w61uZXo8L2ZvbnQ+ PC9kaXY+PC9kaXY+PC9kaXY+Cjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gVHVlLCBN YXkgMzEsIDIwMTYgYXQgNTo0MyBQTSwgUm9kb2xmbyBNYXJ0w61uZXogPHNwYW4gZGlyPSJsdHIi PiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJt dHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNz PSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDtib3JkZXItbGVm dDoxcHggc29saWQgcmdiKDIwNCwyMDQsMjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij5IaSBMaXN0LDxi cj4KPGJyPgpBZnRlciBtYW55IGhvdXJzIHBsYXlpbmcgd2l0aCBTU0cgYW5kIE9wZW5TQ0FQIGFu ZCBub3QgYWJsZSB0byBkbyB3aGF0PGJyPgpJIHdhbnQgSSBuZWVkIHNvbWUgaGVscC48YnI+Cjxi cj4KRm9yZ2l2ZSBtZSBpZiBJIHVzZSBTQ0FQIG9yIE9wZW5TQ0FQIHRlcm1zIGluY29ycmVjdGx5 LCBJIGFtIG5ldyB0bzxicj4KU1NHIGFuZCBJIGFtIHN0aWxsIGdldHRpbmcgZmFtaWxpYXIuPGJy Pgo8YnI+ClRoZSBmb2xsb3dpbmcgT1ZBTCB0ZXN0IHNlYXJjaGVzIGZvciBzeXN0ZW0gYWNjb3Vu dHMgKFVJRCAmbHQ7IDUwMCkgaW48YnI+Ci9ldGMvYXQuYWxsb3cgKEkgYW0gc2hvd2luZyBqdXN0 IHRoZSByZWxldmFudCBwYXJ0cyBvZjxicj4KUkhFTC81L2lucHV0L292YWwvYXRfc3lzdGVtX2Fj Y291bnRzLnhtbCB0byBleHBsYWluIG15IHByb2JsZW0pOjxicj4KPGJyPgombHQ7Y3JpdGVyaWEm Z3Q7PGJyPgrCoCAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2Fj Y291bnRzX2F0X2FsbG93JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L2NyaXRlcmlhJmd0Ozxicj4KPGJy PgombHQ7dW5peDpwYXNzd29yZF90ZXN0IGNoZWNrPSZxdW90O2FsbCZxdW90OyBjaGVja19leGlz dGVuY2U9JnF1b3Q7bm9uZV9leGlzdCZxdW90Ozxicj4KY29tbWVudD0mcXVvdDtUZXN0aW5nIHN5 c3RlbSBhY2NvdW50cyBpbiAvZXRjL2F0LmFsbG93JnF1b3Q7PGJyPgppZD0mcXVvdDt0ZXN0X2F0 X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7 PGJyPgrCoCAmbHQ7dW5peDpvYmplY3Qgb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfYXRfc3lzdGVt X2FjY291bnRzX2F0X2FsbG93JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfdGVz dCZndDs8YnI+Cjxicj4KJmx0O3VuaXg6cGFzc3dvcmRfb2JqZWN0IGlkPSZxdW90O29iamVjdF9h dF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0 Ozxicj4KwqAgJmx0O3VuaXg6dXNlcm5hbWUgb3BlcmF0aW9uPSZxdW90O2VxdWFscyZxdW90Ozxi cj4KdmFyX3JlZj0mcXVvdDt2YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsg dmFyX2NoZWNrPSZxdW90O2F0IGxlYXN0IG9uZSZxdW90Ozxicj4KZGF0YXR5cGU9JnF1b3Q7c3Ry aW5nJnF1b3Q7IC8mZ3Q7PGJyPgrCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1 b3Q7Jmd0O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmbHQ7L2ZpbHRlciZn dDs8YnI+CiZsdDsvdW5peDpwYXNzd29yZF9vYmplY3QmZ3Q7PGJyPgo8YnI+CiZsdDtsb2NhbF92 YXJpYWJsZSBpZD0mcXVvdDt2YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDs8 YnI+CmNvbW1lbnQ9JnF1b3Q7QWNjb3VudHMgQWxsb3dlZCZxdW90OyBkYXRhdHlwZT0mcXVvdDtz dHJpbmcmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KwqAgJmx0O29iamVjdF9j b21wb25lbnQgaXRlbV9maWVsZD0mcXVvdDtzdWJleHByZXNzaW9uJnF1b3Q7PGJyPgpvYmplY3Rf cmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyAvJmd0 Ozxicj4KJmx0Oy9sb2NhbF92YXJpYWJsZSZndDs8YnI+Cjxicj4KJmx0O2luZDp0ZXh0ZmlsZWNv bnRlbnQ1NF9vYmplY3QgY29tbWVudD0mcXVvdDsvZXRjL2F0LmFsbG93JnF1b3Q7PGJyPgppZD0m cXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsgdmVyc2lvbj0m cXVvdDsxJnF1b3Q7Jmd0Ozxicj4KwqAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2F0LmFsbG93 Jmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPgrCoCAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZx dW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XiguKikkJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+ CsKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVh bCZxdW90Ozxicj4KZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzAmbHQ7L2luZDppbnN0YW5j ZSZndDs8YnI+CiZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDs8YnI+Cjxicj4K Jmx0O3VuaXg6cGFzc3dvcmRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRz X2F0X2FsbG93X3VpZCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7 dW5peDp1c2VyX2lkIGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyBvcGVyYXRpb249JnF1b3Q7bGVz cyB0aGFuJnF1b3Q7Jmd0OzUwMCZsdDsvdW5peDp1c2VyX2lkJmd0Ozxicj4KJmx0Oy91bml4OnBh c3N3b3JkX3N0YXRlJmd0Ozxicj4KPGJyPgo8YnI+ClRoZSB0ZXN0IGFib3ZlIGdldHMgdGhlIHVz ZXJzIGluZm9ybWF0aW9uIGZyb20gdGhlIHNvdXJjZXMgc3BlY2lmaWVkPGJyPgppbiBOU1MgKC9l dGMvbnNzd2l0Y2guY29uZikgd2hpY2ggaXMgY29ycmVjdCwgaG93ZXZlciBJIHdhbnQgdG8gY3Jl YXRlPGJyPgphIHZlcnNpb24gdGhhdCB1c2VzIC9ldGMvcGFzc3dkIGRpcmVjdGx5LiBXaHk/IFdl IGhhdmUgbWFueTxicj4KKHRob3VzYW5kcz8pIG9mIFJIRUwgNSBiYXNlZCBzZXJ2ZXJzIHdpdGgg TERBUCBpbnRlZ3JhdGlvbiwgYW5kIG1hbnk8YnI+Cih0aG91c2FuZHM/KSBvZiBhY2NvdW50cyBp biB0aGUgTERBUCBzZXJ2ZXJzLjxicj4KPGJyPgpTaW1wbGUgdGVzdHMgbGlrZSBSSEVMLzUvaW5w dXQvb3ZhbC9hdF9zeXN0ZW1fYWNjb3VudHMueG1sIGFuZDxicj4KUkhFTC81L2lucHV0L292YWwv Y3Jvbl9zeXN0ZW1fYWNjb3VudHMueG1sIGNhbiB0YWtlIGhvdXJzIHRvIHJ1bjxicj4KYmVjYXVz ZSB0aGV5IHJldHJpZXZlICphbGwqIHVzZXJzIGluZm9ybWF0aW9uIGZyb20gdGhlIExEQVAgc2Vy dmVyczxicj4KYW5kIHRoZXkgZG8gaXQgKmZvciBlYWNoIGVudHJ5KiBpbiAvZXRjL2F0LmFsbG93 IGFuZCAvZXRjL2Nyb24uYWxsb3cuPGJyPgpBbHNvLCBpZiB3ZSBydW4gT3BlblNDQVAgKG9zY2Fw KSBhdCB0aGUgc2FtZSB0aW1lIGluIGEgZmV3IHNlcnZlcnM8YnI+CnRoZXkgaGl0IHRoZSBMREFQ IHNlcnZlcnMgcmVhbGx5IGJhZC48YnI+Cjxicj4KSSBoYXZlIGJlZW4gdHJ5aW5nIHRvIHJlcGxh Y2UgcGFzc3dvcmRfdGVzdCBhbmQgcGFzc3dvcmRfb2JqZWN0IGJ5PGJyPgp0ZXh0ZmlsZWNvbnRl bnQ1NF90ZXN0IGFuZCB0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3Qgd2l0aG91dCBhbnkgbHVjay48 YnI+CklmIHlvdSB3YW50LCBJIGNhbiBzaGFyZSBteSBhdF9zeXN0ZW1fYWNjb3VudHMueG1sIGZp bGUgdGhhdCBJIHRob3VnaHQ8YnI+Cml0IHdhcyBnb2luZyB0byB3b3JrLjxicj4KPGJyPgpJIHdv dWxkIHJlYWxseSBhcHByZWNpYXRlIGFueSBoZWxwIG9yIGhpbnQ/PGJyPgo8YnI+Cjxicj4KUmVn YXJkczxzcGFuPjxmb250IGNvbG9yPSIjODg4ODg4Ij48YnI+Ci0tPGJyPgpSb2RvbGZvIE1hcnTD rW5lejxicj4KPC9mb250Pjwvc3Bhbj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pgo8YnI+ LS08YnI+ClNDQVAgU2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWls dG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJnZXQ9Il9i bGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4K PGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAt c2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgcmVsPSJub3JlZmVycmVyIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3Rz L3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhy ZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLyIgcmVs PSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQ L3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9hPjxicj4KPGJyPjwvYmxvY2txdW90ZT48L2Rpdj48YnI+ PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+Cg== --===============3955861756415178357==-- From agshew at gmail.com Tue Jun 7 20:51:31 2016 Content-Type: multipart/mixed; boundary="===============1463307756875655995==" MIME-Version: 1.0 From: Andrew Shewmaker To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Tue, 07 Jun 2016 14:50:53 -0600 Message-ID: In-Reply-To: CAB6RzTtzXG+g=FJD0ASnfLO=pnmtAvTgsxdcesBuD=wp_-7kxQ@mail.gmail.com --===============1463307756875655995== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable A totally different approach to addressing your issue would be to use nss_db or http://code.google.com/p/nsscache/ to cache LDAP. On Tue, May 31, 2016 at 4:43 PM, Rodolfo Mart=C3=ADnez = wrote: > Hi List, > > After many hours playing with SSG and OpenSCAP and not able to do what > I want I need some help. > > Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to > SSG and I am still getting familiar. > > The following OVAL test searches for system accounts (UID < 500) in > /etc/at.allow (I am showing just the relevant parts of > RHEL/5/input/oval/at_system_accounts.xml to explain my problem): > > > > > > comment=3D"Testing system accounts in /etc/at.allow" > id=3D"test_at_system_accounts_at_allow" version=3D"1"> > > > > > var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least one" > datatype=3D"string" /> > state_at_system_accounts_at_allow_uid > > > comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> > object_ref=3D"object_at_system_accounts_allow_list" /> > > > id=3D"object_at_system_accounts_allow_list" version=3D"1"> > /etc/at.allow > ^(.*)$ > datatype=3D"int">0 > > > version=3D"1"> > 500 > > > > The test above gets the users information from the sources specified > in NSS (/etc/nsswitch.conf) which is correct, however I want to create > a version that uses /etc/passwd directly. Why? We have many > (thousands?) of RHEL 5 based servers with LDAP integration, and many > (thousands?) of accounts in the LDAP servers. > > Simple tests like RHEL/5/input/oval/at_system_accounts.xml and > RHEL/5/input/oval/cron_system_accounts.xml can take hours to run > because they retrieve *all* users information from the LDAP servers > and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. > Also, if we run OpenSCAP (oscap) at the same time in a few servers > they hit the LDAP servers really bad. > > I have been trying to replace password_test and password_object by > textfilecontent54_test and textfilecontent54_object without any luck. > If you want, I can share my at_system_accounts.xml file that I thought > it was going to work. > > I would really appreciate any help or hint? > > > Regards > -- > Rodolfo Mart=C3=ADnez > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > -- = Andrew Shewmaker --===============1463307756875655995== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9IiI+PGZvbnQg ZmFjZT0iYXJpYWwsIGhlbHZldGljYSwgc2Fucy1zZXJpZiI+QSB0b3RhbGx5IGRpZmZlcmVudCBh cHByb2FjaCB0byBhZGRyZXNzaW5nIHlvdXIgaXNzdWUgd291bGQgYmUgdG8gdXNlIG5zc19kYiBv ciA8YSBocmVmPSJodHRwOi8vY29kZS5nb29nbGUuY29tL3AvbnNzY2FjaGUvIj5odHRwOi8vY29k ZS5nb29nbGUuY29tL3AvbnNzY2FjaGUvPC9hPiB0byBjYWNoZSBMREFQLjwvZm9udD48YnI+PC9k aXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9x dW90ZSI+T24gVHVlLCBNYXkgMzEsIDIwMTYgYXQgNDo0MyBQTSwgUm9kb2xmbyBNYXJ0w61uZXog PHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxi bG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2Jv cmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPkhpIExpc3QsPGJyPgo8 YnI+CkFmdGVyIG1hbnkgaG91cnMgcGxheWluZyB3aXRoIFNTRyBhbmQgT3BlblNDQVAgYW5kIG5v dCBhYmxlIHRvIGRvIHdoYXQ8YnI+Ckkgd2FudCBJIG5lZWQgc29tZSBoZWxwLjxicj4KPGJyPgpG b3JnaXZlIG1lIGlmIEkgdXNlIFNDQVAgb3IgT3BlblNDQVAgdGVybXMgaW5jb3JyZWN0bHksIEkg YW0gbmV3IHRvPGJyPgpTU0cgYW5kIEkgYW0gc3RpbGwgZ2V0dGluZyBmYW1pbGlhci48YnI+Cjxi cj4KVGhlIGZvbGxvd2luZyBPVkFMIHRlc3Qgc2VhcmNoZXMgZm9yIHN5c3RlbSBhY2NvdW50cyAo VUlEICZsdDsgNTAwKSBpbjxicj4KL2V0Yy9hdC5hbGxvdyAoSSBhbSBzaG93aW5nIGp1c3QgdGhl IHJlbGV2YW50IHBhcnRzIG9mPGJyPgpSSEVMLzUvaW5wdXQvb3ZhbC9hdF9zeXN0ZW1fYWNjb3Vu dHMueG1sIHRvIGV4cGxhaW4gbXkgcHJvYmxlbSk6PGJyPgo8YnI+CiZsdDtjcml0ZXJpYSZndDs8 YnI+CsKgICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3Vu dHNfYXRfYWxsb3cmcXVvdDsgLyZndDs8YnI+CiZsdDsvY3JpdGVyaWEmZ3Q7PGJyPgo8YnI+CiZs dDt1bml4OnBhc3N3b3JkX3Rlc3QgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5j ZT0mcXVvdDtub25lX2V4aXN0JnF1b3Q7PGJyPgpjb21tZW50PSZxdW90O1Rlc3Rpbmcgc3lzdGVt IGFjY291bnRzIGluIC9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O3Rlc3RfYXRfc3lz dGVtX2FjY291bnRzX2F0X2FsbG93JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+ CsKgICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNj b3VudHNfYXRfYWxsb3cmcXVvdDsgLyZndDs8YnI+CiZsdDsvdW5peDpwYXNzd29yZF90ZXN0Jmd0 Ozxicj4KPGJyPgombHQ7dW5peDpwYXNzd29yZF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5 c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJy PgrCoCAmbHQ7dW5peDp1c2VybmFtZSBvcGVyYXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7PGJyPgp2 YXJfcmVmPSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2YXJf Y2hlY2s9JnF1b3Q7YXQgbGVhc3Qgb25lJnF1b3Q7PGJyPgpkYXRhdHlwZT0mcXVvdDtzdHJpbmcm cXVvdDsgLyZndDs8YnI+CsKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsm Z3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxi cj4KJmx0Oy91bml4OnBhc3N3b3JkX29iamVjdCZndDs8YnI+Cjxicj4KJmx0O2xvY2FsX3Zhcmlh YmxlIGlkPSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90Ozxicj4K Y29tbWVudD0mcXVvdDtBY2NvdW50cyBBbGxvd2VkJnF1b3Q7IGRhdGF0eXBlPSZxdW90O3N0cmlu ZyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7b2JqZWN0X2NvbXBv bmVudCBpdGVtX2ZpZWxkPSZxdW90O3N1YmV4cHJlc3Npb24mcXVvdDs8YnI+Cm9iamVjdF9yZWY9 JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IC8mZ3Q7PGJy PgombHQ7L2xvY2FsX3ZhcmlhYmxlJmd0Ozxicj4KPGJyPgombHQ7aW5kOnRleHRmaWxlY29udGVu dDU0X29iamVjdCBjb21tZW50PSZxdW90Oy9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90 O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2ZXJzaW9uPSZxdW90 OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMvYXQuYWxsb3cmbHQ7 L2luZDpmaWxlcGF0aCZndDs8YnI+CsKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7 cGF0dGVybiBtYXRjaCZxdW90OyZndDteKC4qKSQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj4KwqAg Jmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1 b3Q7PGJyPgpkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MCZsdDsvaW5kOmluc3RhbmNlJmd0 Ozxicj4KJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj4KPGJyPgombHQ7 dW5peDpwYXNzd29yZF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRf YWxsb3dfdWlkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4 OnVzZXJfaWQgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7IG9wZXJhdGlvbj0mcXVvdDtsZXNzIHRo YW4mcXVvdDsmZ3Q7NTAwJmx0Oy91bml4OnVzZXJfaWQmZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dv cmRfc3RhdGUmZ3Q7PGJyPgo8YnI+Cjxicj4KVGhlIHRlc3QgYWJvdmUgZ2V0cyB0aGUgdXNlcnMg aW5mb3JtYXRpb24gZnJvbSB0aGUgc291cmNlcyBzcGVjaWZpZWQ8YnI+CmluIE5TUyAoL2V0Yy9u c3N3aXRjaC5jb25mKSB3aGljaCBpcyBjb3JyZWN0LCBob3dldmVyIEkgd2FudCB0byBjcmVhdGU8 YnI+CmEgdmVyc2lvbiB0aGF0IHVzZXMgL2V0Yy9wYXNzd2QgZGlyZWN0bHkuIFdoeT8gV2UgaGF2 ZSBtYW55PGJyPgoodGhvdXNhbmRzPykgb2YgUkhFTCA1IGJhc2VkIHNlcnZlcnMgd2l0aCBMREFQ IGludGVncmF0aW9uLCBhbmQgbWFueTxicj4KKHRob3VzYW5kcz8pIG9mIGFjY291bnRzIGluIHRo ZSBMREFQIHNlcnZlcnMuPGJyPgo8YnI+ClNpbXBsZSB0ZXN0cyBsaWtlIFJIRUwvNS9pbnB1dC9v dmFsL2F0X3N5c3RlbV9hY2NvdW50cy54bWwgYW5kPGJyPgpSSEVMLzUvaW5wdXQvb3ZhbC9jcm9u X3N5c3RlbV9hY2NvdW50cy54bWwgY2FuIHRha2UgaG91cnMgdG8gcnVuPGJyPgpiZWNhdXNlIHRo ZXkgcmV0cmlldmUgKmFsbCogdXNlcnMgaW5mb3JtYXRpb24gZnJvbSB0aGUgTERBUCBzZXJ2ZXJz PGJyPgphbmQgdGhleSBkbyBpdCAqZm9yIGVhY2ggZW50cnkqIGluIC9ldGMvYXQuYWxsb3cgYW5k IC9ldGMvY3Jvbi5hbGxvdy48YnI+CkFsc28sIGlmIHdlIHJ1biBPcGVuU0NBUCAob3NjYXApIGF0 IHRoZSBzYW1lIHRpbWUgaW4gYSBmZXcgc2VydmVyczxicj4KdGhleSBoaXQgdGhlIExEQVAgc2Vy dmVycyByZWFsbHkgYmFkLjxicj4KPGJyPgpJIGhhdmUgYmVlbiB0cnlpbmcgdG8gcmVwbGFjZSBw YXNzd29yZF90ZXN0IGFuZCBwYXNzd29yZF9vYmplY3QgYnk8YnI+CnRleHRmaWxlY29udGVudDU0 X3Rlc3QgYW5kIHRleHRmaWxlY29udGVudDU0X29iamVjdCB3aXRob3V0IGFueSBsdWNrLjxicj4K SWYgeW91IHdhbnQsIEkgY2FuIHNoYXJlIG15IGF0X3N5c3RlbV9hY2NvdW50cy54bWwgZmlsZSB0 aGF0IEkgdGhvdWdodDxicj4KaXQgd2FzIGdvaW5nIHRvIHdvcmsuPGJyPgo8YnI+Ckkgd291bGQg cmVhbGx5IGFwcHJlY2lhdGUgYW55IGhlbHAgb3IgaGludD88YnI+Cjxicj4KPGJyPgpSZWdhcmRz PGJyPgotLTxicj4KUm9kb2xmbyBNYXJ0w61uZXo8YnI+Ci0tPGJyPgpTQ0FQIFNlY3VyaXR5IEd1 aWRlIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFo b3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3Jn L2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIg cmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0 ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVk Lm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNl Y3VyaXR5LWd1aWRlLyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9n aXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9hPjxicj4KPC9ibG9ja3F1 b3RlPjwvZGl2Pjxicj48YnIgY2xlYXI9ImFsbCI+PGRpdj48YnI+PC9kaXY+LS0gPGJyPjxkaXYg Y2xhc3M9ImdtYWlsX3NpZ25hdHVyZSIgZGF0YS1zbWFydG1haWw9ImdtYWlsX3NpZ25hdHVyZSI+ QW5kcmV3IFNoZXdtYWtlcjwvZGl2Pgo8L2Rpdj4K --===============1463307756875655995==-- From rmtzcx at gmail.com Wed Jun 8 16:32:48 2016 Content-Type: multipart/mixed; boundary="===============8904698981259862825==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 11:32:34 -0500 Message-ID: In-Reply-To: CAGLxfGwU43fANQ35F41j2=jyhqdbnTy=zPxVFLNQzCafguN_oQ@mail.gmail.com --===============8904698981259862825== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Gabe, Yes, I am more familiar with OVAL syntax now and I understand why it is not working. The problem in my OVAL test is in this part: /etc/passwd ^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ 1 state_at_system_accounts_etc_passwd /etc/passwd ^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ 1 500 '' in block in'' is getting the subexpression pattern from '' which contains the username; so comparing a username to be an integer 'greater or equal to 500' is not valid. My question is much simpler now: How can get all usernames from /etc/passwd that have UID greater or equal to 500 without using password_object? I have been trying to do this for many days now without any luck. Thanks for your time -- Rodolfo Mart=C3=ADnez On Tue, Jun 7, 2016 at 1:03 PM, Gabe Alford wrote: > Hello Rodolfo, > > I just did a quick glance as I currently don't have the cycles to look > into this but the "state_at_system_accounts_at_allow_uid" exclude filter = is > where this is not working. It is not filtering UIDs greater than 1 or 500 > for that matter. > Specifically this subexpression is what is failing: > > datatype=3D"int">500 > > Gabe > > On Thu, Jun 2, 2016 at 8:52 PM, Rodolfo Mart=C3=ADnez wrote: > >> Hi mpreisler, >> >> Thanks for you suggestion in IRC. >> >> This what I have so far, but it is still not working. I feel I am close, >> but it is not working yet. I would appreciate any suggestion >> >> >> >> >> No system accounts in /etc/at.allow >> >> CentOS 5 >> Red Hat Enterprise Linux 5 >> >> Group owner for /etc/at.allow and /etc/at.deny must >> exist. >> >> >> >> >> >> >> >> > comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >> > object_ref=3D"object_at_system_accounts_allow_list" /> >> >> >> > version=3D"1"> >> /etc/passwd >> > match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ >> > datatype=3D"int">1 >> state_at_system_accounts_etc_passwd >> >> >> > version=3D"1"> >> /etc/passwd >> > match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ >> > datatype=3D"int">1 >> > datatype=3D"int">500 >> > >> >> >> >> /etc/at.allow >> ^(.+)$ >> > datatype=3D"int">1 >> >> > action=3D"exclude">state_at_system_accounts_at_allow_root >> >> > action=3D"exclude">state_at_system_accounts_at_allow_uid >> >> >> > id=3D"state_at_system_accounts_at_allow_root" version=3D"1"> >> root >> >> >> > version=3D"1"> >> > var_check=3D"at least one" /> >> >> >> >> >> -- >> Rodolfo >> >> -- >> Rodolfo Mart=C3=ADnez >> >> On Tue, May 31, 2016 at 5:43 PM, Rodolfo Mart=C3=ADnez >> wrote: >> >>> Hi List, >>> >>> After many hours playing with SSG and OpenSCAP and not able to do what >>> I want I need some help. >>> >>> Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to >>> SSG and I am still getting familiar. >>> >>> The following OVAL test searches for system accounts (UID < 500) in >>> /etc/at.allow (I am showing just the relevant parts of >>> RHEL/5/input/oval/at_system_accounts.xml to explain my problem): >>> >>> >>> >>> >>> >>> >> comment=3D"Testing system accounts in /etc/at.allow" >>> id=3D"test_at_system_accounts_at_allow" version=3D"1"> >>> >>> >>> >>> >> version=3D"1"> >>> >> var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least one" >>> datatype=3D"string" /> >>> state_at_system_accounts_at_allow_uid >>> >>> >>> >> comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >>> >> object_ref=3D"object_at_system_accounts_allow_list" /> >>> >>> >>> >> id=3D"object_at_system_accounts_allow_list" version=3D"1"> >>> /etc/at.allow >>> ^(.*)$ >>> >> datatype=3D"int">0 >>> >>> >>> >> version=3D"1"> >>> 500 >>> >>> >>> >>> The test above gets the users information from the sources specified >>> in NSS (/etc/nsswitch.conf) which is correct, however I want to create >>> a version that uses /etc/passwd directly. Why? We have many >>> (thousands?) of RHEL 5 based servers with LDAP integration, and many >>> (thousands?) of accounts in the LDAP servers. >>> >>> Simple tests like RHEL/5/input/oval/at_system_accounts.xml and >>> RHEL/5/input/oval/cron_system_accounts.xml can take hours to run >>> because they retrieve *all* users information from the LDAP servers >>> and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. >>> Also, if we run OpenSCAP (oscap) at the same time in a few servers >>> they hit the LDAP servers really bad. >>> >>> I have been trying to replace password_test and password_object by >>> textfilecontent54_test and textfilecontent54_object without any luck. >>> If you want, I can share my at_system_accounts.xml file that I thought >>> it was going to work. >>> >>> I would really appreciate any help or hint? >>> >>> >>> Regards >>> -- >>> Rodolfo Mart=C3=ADnez >>> >> >> >> -- >> SCAP Security Guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> >> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.f= edorahosted.org >> https://github.com/OpenSCAP/scap-security-guide/ >> >> > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============8904698981259862825== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgR2FiZSw8YnI+PGJyPjwv ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEs c2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPlllcywgSSBhbSBtb3JlIGZhbWlsaWFyIHdpdGgg T1ZBTCBzeW50YXggbm93IGFuZCBJIHVuZGVyc3RhbmQgd2h5IGl0IGlzIG5vdCB3b3JraW5nLjxi cj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5 OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhlIHByb2JsZW0gaW4gbXkgT1ZB TCB0ZXN0IGlzIGluIHRoaXMgcGFydDo8YnI+PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50 NTRfb2JqZWN0IGlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZx dW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOmZpbGVwYXRo Jmd0Oy9ldGMvcGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnBh dHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XihbXjpdKyk6W146 XSs6W1xkXSs6W1xkXSs6W146XSo6W146XSs6W146XSokJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+ wqDCoMKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBl cXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsvaW5kOmluc3RhbmNl Jmd0Ozxicj7CoMKgwqAgJmx0O2ZpbHRlciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtz dGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfZXRjX3Bhc3N3ZCZsdDsvZmlsdGVyJmd0Ozxicj7CoCAm bHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QmZ3Q7PGJyPjxicj7CoCAmbHQ7aW5kOnRl eHRmaWxlY29udGVudDU0X3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19l dGNfcGFzc3dkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDtp bmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+wqDCoMKg ICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDte W146XSs6W146XSs6KFtcZF0rKTpbXGRdKzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2luZDpwYXR0 ZXJuJmd0Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRl ciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsxJmx0Oy9p bmQ6aW5zdGFuY2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnN1YmV4cHJlc3Npb24gb3BlcmF0aW9u PSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVv dDsmZ3Q7NTAwJmx0Oy9pbmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+wqAgJmx0Oy9pbmQ6dGV4dGZp bGVjb250ZW50NTRfc3RhdGUmZ3Q7PGJyPjxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxf ZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpz bWFsbCI+JiMzOTsmbHQ7aW5kOnN1YmV4cHJlc3Npb24mZ3Q7JiMzOTsgaW4gYmxvY2sgaW4mIzM5 OyZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7JiMzOTsgaXMgZ2V0dGluZyB0aGUg c3ViZXhwcmVzc2lvbiBwYXR0ZXJuIGZyb20gJiMzOTsmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0 X29iamVjdCZndDsmIzM5OyB3aGljaCBjb250YWlucyB0aGUgdXNlcm5hbWU7IHNvIGNvbXBhcmlu ZyBhIHVzZXJuYW1lIHRvIGJlIGFuIGludGVnZXIgJiMzOTtncmVhdGVyIG9yIGVxdWFsIHRvIDUw MCYjMzk7IGlzIG5vdCB2YWxpZC48YnI+PGJyPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9k ZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNt YWxsIj5NeSBxdWVzdGlvbiBpcyBtdWNoIHNpbXBsZXIgbm93Ojxicj48YnI+PC9kaXY+PGRpdiBj bGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlm O2ZvbnQtc2l6ZTpzbWFsbCI+SG93IGNhbiBnZXQgYWxsIHVzZXJuYW1lcyBmcm9tIC9ldGMvcGFz c3dkIHRoYXQgaGF2ZSBVSUQgZ3JlYXRlciBvciBlcXVhbCB0byA1MDAgd2l0aG91dCB1c2luZyBw YXNzd29yZF9vYmplY3Q/IEkgaGF2ZSBiZWVuIHRyeWluZyB0byBkbyB0aGlzIGZvciBtYW55IGRh eXMgbm93IHdpdGhvdXQgYW55IGx1Y2suPGJyPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9k ZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNt YWxsIj5UaGFua3MgZm9yIHlvdXIgdGltZTxicj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFp bF9leHRyYSI+PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfc2lnbmF0dXJl IiBkYXRhLXNtYXJ0bWFpbD0iZ21haWxfc2lnbmF0dXJlIj48ZGl2IHN0eWxlPSJmb250LWZhbWls eTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+LS08YnI+PC9mb250PjwvZGl2Pjxk aXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj5S b2RvbGZvIE1hcnTDrW5lejwvZm9udD48L2Rpdj48L2Rpdj48L2Rpdj4KPGJyPjxkaXYgY2xhc3M9 ImdtYWlsX3F1b3RlIj5PbiBUdWUsIEp1biA3LCAyMDE2IGF0IDE6MDMgUE0sIEdhYmUgQWxmb3Jk IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnJlZGhhdHJpc2VzQGdtYWlsLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPnJlZGhhdHJpc2VzQGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3 cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAg MCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PGRp diBkaXI9Imx0ciI+PGRpdj48ZGl2PjxkaXY+SGVsbG8gUm9kb2xmbyw8YnI+PGJyPjwvZGl2Pkkg anVzdCBkaWQgYSBxdWljayBnbGFuY2UgYXMgSSBjdXJyZW50bHkgZG9uJiMzOTt0IGhhdmUgdGhl IGN5Y2xlcyB0byBsb29rIGludG8gdGhpcyBidXQgdGhlICZxdW90O3N0YXRlX2F0X3N5c3RlbV9h Y2NvdW50c19hdF9hbGxvd191aWQmcXVvdDsgZXhjbHVkZSBmaWx0ZXIgaXMgd2hlcmUgdGhpcyBp cyBub3Qgd29ya2luZy4gSXQgaXMgbm90IGZpbHRlcmluZyBVSURzIGdyZWF0ZXIgdGhhbiAxIG9y IDUwMCBmb3IgdGhhdCBtYXR0ZXIuPGJyPjwvZGl2PlNwZWNpZmljYWxseSB0aGlzIHN1YmV4cHJl c3Npb24gaXMgd2hhdCBpcyBmYWlsaW5nOjxzcGFuIGNsYXNzPSIiPjxicj48YnI+Jmx0O2luZDpz dWJleHByZXNzaW9uIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsg ZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzUwMCZsdDsvaW5kOnN1YmV4cHJlc3Npb24mZ3Q7 PGJyPjwvc3Bhbj48L2Rpdj48ZGl2Pjxicj5HYWJlPGJyPjxkaXY+PGRpdj48ZGl2PjxkaXYgY2xh c3M9ImdtYWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPjxkaXY+PGRpdiBj bGFzcz0iaDUiPk9uIFRodSwgSnVuIDIsIDIwMTYgYXQgODo1MiBQTSwgUm9kb2xmbyBNYXJ0w61u ZXogPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJy PjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBw eCAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQgcmdiKDIwNCwyMDQsMjA0KTtwYWRkaW5nLWxl ZnQ6MWV4Ij48ZGl2IGRpcj0ibHRyIj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZjtmb250LXNpemU6c21hbGwiPkhpIG1wcmVpc2xlciw8YnI+PGJyPjwvZGl2PjxkaXYg c3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhh bmtzIGZvciB5b3Ugc3VnZ2VzdGlvbiBpbiBJUkMuPGJyPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJm b250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPlRoaXMgd2hhdCBJ IGhhdmUgc28gZmFyLCBidXQgaXQgaXMgc3RpbGwgbm90IHdvcmtpbmcuIEkgZmVlbCBJIGFtIGNs b3NlLCBidXQgaXQgaXMgbm90IHdvcmtpbmcgeWV0LiBJIHdvdWxkIGFwcHJlY2lhdGUgYW55IHN1 Z2dlc3Rpb248YnI+PGJyPiZsdDtkZWYtZ3JvdXAmZ3Q7PGJyPsKgICZsdDtkZWZpbml0aW9uIGNs YXNzPSZxdW90O2NvbXBsaWFuY2UmcXVvdDsgaWQ9JnF1b3Q7YXRfc3lzdGVtX2FjY291bnRzJnF1 b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDttZXRhZGF0YSZndDs8 YnI+wqDCoMKgwqDCoCAmbHQ7dGl0bGUmZ3Q7Tm8gc3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQu YWxsb3cmbHQ7L3RpdGxlJmd0Ozxicj7CoMKgwqDCoMKgICZsdDthZmZlY3RlZCBmYW1pbHk9JnF1 b3Q7dW5peCZxdW90OyZndDs8YnI+wqDCoMKgwqDCoMKgwqAgJmx0O3BsYXRmb3JtJmd0O0NlbnRP UyA1Jmx0Oy9wbGF0Zm9ybSZndDs8YnI+wqDCoMKgwqDCoMKgwqAgJmx0O3BsYXRmb3JtJmd0O1Jl ZCBIYXQgRW50ZXJwcmlzZSBMaW51eCA1Jmx0Oy9wbGF0Zm9ybSZndDs8YnI+wqDCoMKgwqDCoCAm bHQ7L2FmZmVjdGVkJmd0Ozxicj7CoMKgwqDCoMKgICZsdDtkZXNjcmlwdGlvbiZndDtHcm91cCBv d25lciBmb3IgL2V0Yy9hdC5hbGxvdyBhbmQgL2V0Yy9hdC5kZW55IG11c3QgZXhpc3QuJmx0Oy9k ZXNjcmlwdGlvbiZndDs8YnI+wqDCoMKgICZsdDsvbWV0YWRhdGEmZ3Q7PGJyPsKgwqDCoCAmbHQ7 Y3JpdGVyaWEmZ3Q7PGJyPsKgwqDCoMKgwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0 ZXN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj7CoMKgwqAgJmx0 Oy9jcml0ZXJpYSZndDs8YnI+wqAgJmx0Oy9kZWZpbml0aW9uJmd0Ozxicj48YnI+wqAgJmx0OyEt LSBUaGlzIHZhcmlhYmxlIHNob3VsZCBnZXQgYWxsIHVzZXJzIGZyb20gL2V0Yy9wYXNzd2QgdGhh dCBoYXMgVUlEICZndDs9IDUwMCAtLSZndDs8YnI+wqAgJmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSZx dW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyBjb21tZW50PSZxdW90 O0FjY291bnRzIEFsbG93ZWQmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IHZlcnNp b249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDtvYmplY3RfY29tcG9uZW50IGl0ZW1f ZmllbGQ9JnF1b3Q7c3ViZXhwcmVzc2lvbiZxdW90OyBvYmplY3RfcmVmPSZxdW90O29iamVjdF9h dF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyAvJmd0Ozxicj7CoCAmbHQ7L2xvY2Fs X3ZhcmlhYmxlJmd0Ozxicj48YnI+wqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3Qg aWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IHZlcnNp b249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9w YXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+wqDCoMKgICZsdDtpbmQ6cGF0dGVybiBvcGVy YXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteKFteOl0rKTpbXjpdKzpbXGRdKzpb XGRdKzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj7CoMKgwqAgJmx0 O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7 IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsxJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPsKg wqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1b3Q7Jmd0O3N0YXRlX2F0X3N5 c3RlbV9hY2NvdW50c19ldGNfcGFzc3dkJmx0Oy9maWx0ZXImZ3Q7PGJyPsKgICZsdDsvaW5kOnRl eHRmaWxlY29udGVudDU0X29iamVjdCZndDs8YnI+PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVjb250 ZW50NTRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2V0Y19wYXNzd2Qm cXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDpmaWxlcGF0 aCZndDsvZXRjL3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpw YXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O15bXjpdKzpbXjpd KzooW1xkXSspOltcZF0rOlteOl0qOlteOl0rOlteOl0qJCZsdDsvaW5kOnBhdHRlcm4mZ3Q7PGJy PsKgwqDCoCAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3Ig ZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5j ZSZndDs8YnI+wqDCoMKgICZsdDtpbmQ6c3ViZXhwcmVzc2lvbiBvcGVyYXRpb249JnF1b3Q7Z3Jl YXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDs1MDAm bHQ7L2luZDpzdWJleHByZXNzaW9uJmd0Ozxicj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9k aXY+PC9kaXY+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBw eCAwcHggMHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIwNCwyMDQpO3Bh ZGRpbmctbGVmdDoxZXgiPjxkaXY+PGRpdiBjbGFzcz0iaDUiPjxkaXYgZGlyPSJsdHIiPjxkaXYg c3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+wqAg Jmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7PGJyPjxicj48YnI+wqAgJmx0OyEt LSBUZXN0IHRvIGNoZWNrIHRoYXQgdGhlcmUgaXMgbm8gc3lzdGVtIGFjY291bnRzIGluIC9ldGMv YXQuYWxsb3cgLS0mZ3Q7PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCBjaGVj az0mcXVvdDthbGwmcXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsg aWQ9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgY29tbWVudD0m cXVvdDtUZXN0aW5nIC9ldGMvYXQuYWxsb3cgZm9yIHN5c3RlbSBhY2NvdW50cyZxdW90OyB2ZXJz aW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOm9iamVjdCBvYmplY3RfcmVm PSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3cmcXVvdDsgLyZndDs8YnI+wqAg Jmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCZndDs8YnI+PGJyPsKgICZsdDtpbmQ6dGV4 dGZpbGVjb250ZW50NTRfb2JqZWN0IGNvbW1lbnQ9JnF1b3Q7L2V0Yy9hdC5hbGxvdyZxdW90OyBp ZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93JnF1b3Q7IHZlcnNpb249JnF1 b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDshLS0gR2V0IGFsbCB1c2VycyBmcm9tIC9ldGMv YXQuYWxsb3cgLS0mZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMvYXQuYWxs b3cmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+wqDCoMKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRp b249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteKC4rKSQmbHQ7L2luZDpwYXR0ZXJuJmd0 Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFu IG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsxJmx0Oy9pbmQ6aW5z dGFuY2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7IS0tIEV4Y2x1ZGUgcm9vdCAtLSZndDs8YnI+wqDCoMKg ICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2V4Y2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVt X2FjY291bnRzX2F0X2FsbG93X3Jvb3QmbHQ7L2ZpbHRlciZndDs8YnI+wqDCoMKgICZsdDshLS0g RXhjbHVkZSBhbGwgdXNlciBhY2NvdW50cyAtLSZndDs8YnI+wqDCoMKgICZsdDtmaWx0ZXIgYWN0 aW9uPSZxdW90O2V4Y2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2Fs bG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxicj7CoCAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9v YmplY3QmZ3Q7PGJyPsKgwqDCoCA8YnI+wqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0 ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3dfcm9vdCZxdW90OyB2 ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnRleHQmZ3Q7cm9vdCZs dDsvaW5kOnRleHQmZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X3N0YXRlJmd0 Ozxicj48YnI+wqAgJmx0O3VuaXg6cGFzc3dvcmRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lz dGVtX2FjY291bnRzX2F0X2FsbG93X3VpZCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7 PGJyPsKgwqDCoCAmbHQ7dW5peDp1c2VybmFtZSB2YXJfcmVmPSZxdW90O3Zhcl9hdF9zeXN0ZW1f YWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2YXJfY2hlY2s9JnF1b3Q7YXQgbGVhc3Qgb25lJnF1 b3Q7IC8mZ3Q7PGJyPsKgICZsdDsvdW5peDpwYXNzd29yZF9zdGF0ZSZndDs8YnI+PGJyPiZsdDsv ZGVmLWdyb3VwJmd0Ozxicj48YnI+LS08YnI+PC9kaXY+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6 dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5Sb2RvbGZvPGJyPjwvZGl2PjwvZGl2 PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnIgY2xlYXI9ImFsbCI+PGRpdj48ZGl2IGRhdGEt c21hcnRtYWlsPSJnbWFpbF9zaWduYXR1cmUiPjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9t YSxzYW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj4tLTxicj48L2ZvbnQ+PC9kaXY+PGRpdiBzdHls ZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxmb250IHNpemU9IjIiPlJvZG9sZm8g TWFydMOtbmV6PC9mb250PjwvZGl2PjwvZGl2PjwvZGl2Pgo8YnI+PGRpdiBjbGFzcz0iZ21haWxf cXVvdGUiPk9uIFR1ZSwgTWF5IDMxLCAyMDE2IGF0IDU6NDMgUE0sIFJvZG9sZm8gTWFydMOtbmV6 IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnJtdHpjeEBnbWFpbC5jb20iIHRh cmdldD0iX2JsYW5rIj5ybXR6Y3hAZ21haWwuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj48 YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MHB4IDBweCAwcHgg MC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIwNCk7cGFkZGluZy1sZWZ0 OjFleCI+SGkgTGlzdCw8YnI+Cjxicj4KQWZ0ZXIgbWFueSBob3VycyBwbGF5aW5nIHdpdGggU1NH IGFuZCBPcGVuU0NBUCBhbmQgbm90IGFibGUgdG8gZG8gd2hhdDxicj4KSSB3YW50IEkgbmVlZCBz b21lIGhlbHAuPGJyPgo8YnI+CkZvcmdpdmUgbWUgaWYgSSB1c2UgU0NBUCBvciBPcGVuU0NBUCB0 ZXJtcyBpbmNvcnJlY3RseSwgSSBhbSBuZXcgdG88YnI+ClNTRyBhbmQgSSBhbSBzdGlsbCBnZXR0 aW5nIGZhbWlsaWFyLjxicj4KPGJyPgpUaGUgZm9sbG93aW5nIE9WQUwgdGVzdCBzZWFyY2hlcyBm b3Igc3lzdGVtIGFjY291bnRzIChVSUQgJmx0OyA1MDApIGluPGJyPgovZXRjL2F0LmFsbG93IChJ IGFtIHNob3dpbmcganVzdCB0aGUgcmVsZXZhbnQgcGFydHMgb2Y8YnI+ClJIRUwvNS9pbnB1dC9v dmFsL2F0X3N5c3RlbV9hY2NvdW50cy54bWwgdG8gZXhwbGFpbiBteSBwcm9ibGVtKTo8YnI+Cjxi cj4KJmx0O2NyaXRlcmlhJmd0Ozxicj4KwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0 ZXN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj4KJmx0Oy9jcml0 ZXJpYSZndDs8YnI+Cjxicj4KJmx0O3VuaXg6cGFzc3dvcmRfdGVzdCBjaGVjaz0mcXVvdDthbGwm cXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDs8YnI+CmNvbW1lbnQ9 JnF1b3Q7VGVzdGluZyBzeXN0ZW0gYWNjb3VudHMgaW4gL2V0Yy9hdC5hbGxvdyZxdW90Ozxicj4K aWQ9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgdmVyc2lvbj0m cXVvdDsxJnF1b3Q7Jmd0Ozxicj4KwqAgJmx0O3VuaXg6b2JqZWN0IG9iamVjdF9yZWY9JnF1b3Q7 b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj4KJmx0Oy91 bml4OnBhc3N3b3JkX3Rlc3QmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4OnBhc3N3b3JkX29iamVjdCBp ZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93JnF1b3Q7IHZlcnNpb249 JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4OnVzZXJuYW1lIG9wZXJhdGlvbj0mcXVv dDtlcXVhbHMmcXVvdDs8YnI+CnZhcl9yZWY9JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50c19h bGxvd19saXN0JnF1b3Q7IHZhcl9jaGVjaz0mcXVvdDthdCBsZWFzdCBvbmUmcXVvdDs8YnI+CmRh dGF0eXBlPSZxdW90O3N0cmluZyZxdW90OyAvJmd0Ozxicj4KwqAgJmx0O2ZpbHRlciBhY3Rpb249 JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3df dWlkJmx0Oy9maWx0ZXImZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfb2JqZWN0Jmd0Ozxicj4K PGJyPgombHQ7bG9jYWxfdmFyaWFibGUgaWQ9JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50c19h bGxvd19saXN0JnF1b3Q7PGJyPgpjb21tZW50PSZxdW90O0FjY291bnRzIEFsbG93ZWQmcXVvdDsg ZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+ CsKgICZsdDtvYmplY3RfY29tcG9uZW50IGl0ZW1fZmllbGQ9JnF1b3Q7c3ViZXhwcmVzc2lvbiZx dW90Ozxicj4Kb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93 X2xpc3QmcXVvdDsgLyZndDs8YnI+CiZsdDsvbG9jYWxfdmFyaWFibGUmZ3Q7PGJyPgo8YnI+CiZs dDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0IGNvbW1lbnQ9JnF1b3Q7L2V0Yy9hdC5hbGxv dyZxdW90Ozxicj4KaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0 JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDtpbmQ6ZmlsZXBhdGgm Z3Q7L2V0Yy9hdC5hbGxvdyZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxicj4KwqAgJmx0O2luZDpwYXR0 ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O14oLiopJCZsdDsvaW5k OnBhdHRlcm4mZ3Q7PGJyPgrCoCAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVh dGVyIHRoYW4gb3IgZXF1YWwmcXVvdDs8YnI+CmRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsw Jmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPgombHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmpl Y3QmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4OnBhc3N3b3JkX3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0 X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7 Jmd0Ozxicj4KwqAgJmx0O3VuaXg6dXNlcl9pZCBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsgb3Bl cmF0aW9uPSZxdW90O2xlc3MgdGhhbiZxdW90OyZndDs1MDAmbHQ7L3VuaXg6dXNlcl9pZCZndDs8 YnI+CiZsdDsvdW5peDpwYXNzd29yZF9zdGF0ZSZndDs8YnI+Cjxicj4KPGJyPgpUaGUgdGVzdCBh Ym92ZSBnZXRzIHRoZSB1c2VycyBpbmZvcm1hdGlvbiBmcm9tIHRoZSBzb3VyY2VzIHNwZWNpZmll ZDxicj4KaW4gTlNTICgvZXRjL25zc3dpdGNoLmNvbmYpIHdoaWNoIGlzIGNvcnJlY3QsIGhvd2V2 ZXIgSSB3YW50IHRvIGNyZWF0ZTxicj4KYSB2ZXJzaW9uIHRoYXQgdXNlcyAvZXRjL3Bhc3N3ZCBk aXJlY3RseS4gV2h5PyBXZSBoYXZlIG1hbnk8YnI+Cih0aG91c2FuZHM/KSBvZiBSSEVMIDUgYmFz ZWQgc2VydmVycyB3aXRoIExEQVAgaW50ZWdyYXRpb24sIGFuZCBtYW55PGJyPgoodGhvdXNhbmRz Pykgb2YgYWNjb3VudHMgaW4gdGhlIExEQVAgc2VydmVycy48YnI+Cjxicj4KU2ltcGxlIHRlc3Rz IGxpa2UgUkhFTC81L2lucHV0L292YWwvYXRfc3lzdGVtX2FjY291bnRzLnhtbCBhbmQ8YnI+ClJI RUwvNS9pbnB1dC9vdmFsL2Nyb25fc3lzdGVtX2FjY291bnRzLnhtbCBjYW4gdGFrZSBob3VycyB0 byBydW48YnI+CmJlY2F1c2UgdGhleSByZXRyaWV2ZSAqYWxsKiB1c2VycyBpbmZvcm1hdGlvbiBm cm9tIHRoZSBMREFQIHNlcnZlcnM8YnI+CmFuZCB0aGV5IGRvIGl0ICpmb3IgZWFjaCBlbnRyeSog aW4gL2V0Yy9hdC5hbGxvdyBhbmQgL2V0Yy9jcm9uLmFsbG93Ljxicj4KQWxzbywgaWYgd2UgcnVu IE9wZW5TQ0FQIChvc2NhcCkgYXQgdGhlIHNhbWUgdGltZSBpbiBhIGZldyBzZXJ2ZXJzPGJyPgp0 aGV5IGhpdCB0aGUgTERBUCBzZXJ2ZXJzIHJlYWxseSBiYWQuPGJyPgo8YnI+CkkgaGF2ZSBiZWVu IHRyeWluZyB0byByZXBsYWNlIHBhc3N3b3JkX3Rlc3QgYW5kIHBhc3N3b3JkX29iamVjdCBieTxi cj4KdGV4dGZpbGVjb250ZW50NTRfdGVzdCBhbmQgdGV4dGZpbGVjb250ZW50NTRfb2JqZWN0IHdp dGhvdXQgYW55IGx1Y2suPGJyPgpJZiB5b3Ugd2FudCwgSSBjYW4gc2hhcmUgbXkgYXRfc3lzdGVt X2FjY291bnRzLnhtbCBmaWxlIHRoYXQgSSB0aG91Z2h0PGJyPgppdCB3YXMgZ29pbmcgdG8gd29y ay48YnI+Cjxicj4KSSB3b3VsZCByZWFsbHkgYXBwcmVjaWF0ZSBhbnkgaGVscCBvciBoaW50Pzxi cj4KPGJyPgo8YnI+ClJlZ2FyZHM8c3Bhbj48Zm9udCBjb2xvcj0iIzg4ODg4OCI+PGJyPgotLTxi cj4KUm9kb2xmbyBNYXJ0w61uZXo8YnI+CjwvZm9udD48L3NwYW4+PC9ibG9ja3F1b3RlPjwvZGl2 Pjxicj48L2Rpdj4KPGJyPjwvZGl2PjwvZGl2PjxzcGFuIGNsYXNzPSJIT0VuWmIiPjxmb250IGNv bG9yPSIjODg4ODg4Ij4tLTxicj4KU0NBUCBTZWN1cml0eSBHdWlkZSBtYWlsaW5nIGxpc3Q8YnI+ CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmciIHRhcmdldD0iX2JsYW5rIj5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3Rl ZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRt aW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiByZWw9 Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5v cmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn PC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJp dHktZ3VpZGUvIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1 Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS88L2E+PGJyPgo8YnI+PC9mb250Pjwv c3Bhbj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2PjwvZGl2PjwvZGl2PjwvZGl2PjwvZGl2 PjwvZGl2Pgo8YnI+LS08YnI+ClNDQVAgU2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8 YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn Ij5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBo cmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1 cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2Nh cC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0i aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvIiByZWw9Im5v cmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2Nh cC1zZWN1cml0eS1ndWlkZS88L2E+PGJyPgo8YnI+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rp dj4K --===============8904698981259862825==-- From rmtzcx at gmail.com Wed Jun 8 17:10:05 2016 Content-Type: multipart/mixed; boundary="===============5389906068769358802==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 12:09:54 -0500 Message-ID: In-Reply-To: CAF-E8XE75cG0XaGMzqcy00xguXJqib19z12eCYumLDih-mHYaA@mail.gmail.com --===============5389906068769358802== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Andrew, I took a look at nsscache, it looks good. In fact, a combination of nsscache and nss_db might be a good solution, but not feasible at the moment. If I would be able to get a list of users from /etc/passwd with UID greater or equal to 500 without using password_object (this is the one that pulls all information from LDAP) it would be the best solution now. I will continue trying to do it. I would appreciate any hint or someone that confirm that it is not possible. Thanks -- Rodolfo Mart=C3=ADnez On Tue, Jun 7, 2016 at 3:50 PM, Andrew Shewmaker wrote: > A totally different approach to addressing your issue would be to use > nss_db or http://code.google.com/p/nsscache/ to cache LDAP. > > On Tue, May 31, 2016 at 4:43 PM, Rodolfo Mart=C3=ADnez > wrote: > >> Hi List, >> >> After many hours playing with SSG and OpenSCAP and not able to do what >> I want I need some help. >> >> Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to >> SSG and I am still getting familiar. >> >> The following OVAL test searches for system accounts (UID < 500) in >> /etc/at.allow (I am showing just the relevant parts of >> RHEL/5/input/oval/at_system_accounts.xml to explain my problem): >> >> >> >> >> >> > comment=3D"Testing system accounts in /etc/at.allow" >> id=3D"test_at_system_accounts_at_allow" version=3D"1"> >> >> >> >> >> > var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least one" >> datatype=3D"string" /> >> state_at_system_accounts_at_allow_uid >> >> >> > comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >> > object_ref=3D"object_at_system_accounts_allow_list" /> >> >> >> > id=3D"object_at_system_accounts_allow_list" version=3D"1"> >> /etc/at.allow >> ^(.*)$ >> > datatype=3D"int">0 >> >> >> > version=3D"1"> >> 500 >> >> >> >> The test above gets the users information from the sources specified >> in NSS (/etc/nsswitch.conf) which is correct, however I want to create >> a version that uses /etc/passwd directly. Why? We have many >> (thousands?) of RHEL 5 based servers with LDAP integration, and many >> (thousands?) of accounts in the LDAP servers. >> >> Simple tests like RHEL/5/input/oval/at_system_accounts.xml and >> RHEL/5/input/oval/cron_system_accounts.xml can take hours to run >> because they retrieve *all* users information from the LDAP servers >> and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. >> Also, if we run OpenSCAP (oscap) at the same time in a few servers >> they hit the LDAP servers really bad. >> >> I have been trying to replace password_test and password_object by >> textfilecontent54_test and textfilecontent54_object without any luck. >> If you want, I can share my at_system_accounts.xml file that I thought >> it was going to work. >> >> I would really appreciate any help or hint? >> >> >> Regards >> -- >> Rodolfo Mart=C3=ADnez >> -- >> SCAP Security Guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> >> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.f= edorahosted.org >> https://github.com/OpenSCAP/scap-security-guide/ >> > > > > -- > Andrew Shewmaker > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============5389906068769358802== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgQW5kcmV3LDxicj48YnI+ PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9t YSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SSB0b29rIGEgbG9vayBhdCBuc3NjYWNoZSwg aXQgbG9va3MgZ29vZC4gSW4gZmFjdCwgYSBjb21iaW5hdGlvbiBvZiBuc3NjYWNoZSBhbmQgbnNz X2RiIG1pZ2h0IGJlIGEgZ29vZCBzb2x1dGlvbiwgYnV0IG5vdCBmZWFzaWJsZSBhdCB0aGUgbW9t ZW50Ljxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQt ZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SWYgSSB3b3VsZCBiZSBh YmxlIHRvIGdldCBhIGxpc3Qgb2YgdXNlcnMgZnJvbSAvZXRjL3Bhc3N3ZCB3aXRoIFVJRCBncmVh dGVyIG9yIGVxdWFsIHRvIDUwMCB3aXRob3V0IHVzaW5nIHBhc3N3b3JkX29iamVjdCAodGhpcyBp cyB0aGUgb25lIHRoYXQgcHVsbHMgYWxsIGluZm9ybWF0aW9uIGZyb20gTERBUCkgaXQgd291bGQg YmUgdGhlIGJlc3Qgc29sdXRpb24gbm93LiBJIHdpbGwgY29udGludWUgdHJ5aW5nIHRvIGRvIGl0 LiBJIHdvdWxkIGFwcHJlY2lhdGUgYW55IGhpbnQgb3Igc29tZW9uZSB0aGF0IGNvbmZpcm0gdGhh dCBpdCBpcyBub3QgcG9zc2libGUuPGJyPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZh dWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxs Ij5UaGFua3M8YnI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxiciBjbGVh cj0iYWxsIj48ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX3NpZ25hdHVyZSIgZGF0YS1zbWFydG1haWw9 ImdtYWlsX3NpZ25hdHVyZSI+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2Vy aWYiPjxmb250IHNpemU9IjIiPi0tPGJyPjwvZm9udD48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZh bWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+Um9kb2xmbyBNYXJ0w61uZXo8 L2ZvbnQ+PC9kaXY+PC9kaXY+PC9kaXY+Cjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24g VHVlLCBKdW4gNywgMjAxNiBhdCAzOjUwIFBNLCBBbmRyZXcgU2hld21ha2VyIDxzcGFuIGRpcj0i bHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOmFnc2hld0BnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5r Ij5hZ3NoZXdAZ21haWwuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBj bGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDox cHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2IGRpcj0ibHRyIj48ZGl2IGNsYXNz PSJnbWFpbF9kZWZhdWx0Ij48Zm9udCBmYWNlPSJhcmlhbCwgaGVsdmV0aWNhLCBzYW5zLXNlcmlm Ij5BIHRvdGFsbHkgZGlmZmVyZW50IGFwcHJvYWNoIHRvIGFkZHJlc3NpbmcgeW91ciBpc3N1ZSB3 b3VsZCBiZSB0byB1c2UgbnNzX2RiIG9yIDxhIGhyZWY9Imh0dHA6Ly9jb2RlLmdvb2dsZS5jb20v cC9uc3NjYWNoZS8iIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vY29kZS5nb29nbGUuY29tL3AvbnNz Y2FjaGUvPC9hPiB0byBjYWNoZSBMREFQLjwvZm9udD48YnI+PC9kaXY+PC9kaXY+PGRpdiBjbGFz cz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+PGRpdj48ZGl2IGNs YXNzPSJoNSI+T24gVHVlLCBNYXkgMzEsIDIwMTYgYXQgNDo0MyBQTSwgUm9kb2xmbyBNYXJ0w61u ZXogPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJy PjwvZGl2PjwvZGl2PjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdp bjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgi PjxkaXY+PGRpdiBjbGFzcz0iaDUiPkhpIExpc3QsPGJyPgo8YnI+CkFmdGVyIG1hbnkgaG91cnMg cGxheWluZyB3aXRoIFNTRyBhbmQgT3BlblNDQVAgYW5kIG5vdCBhYmxlIHRvIGRvIHdoYXQ8YnI+ Ckkgd2FudCBJIG5lZWQgc29tZSBoZWxwLjxicj4KPGJyPgpGb3JnaXZlIG1lIGlmIEkgdXNlIFND QVAgb3IgT3BlblNDQVAgdGVybXMgaW5jb3JyZWN0bHksIEkgYW0gbmV3IHRvPGJyPgpTU0cgYW5k IEkgYW0gc3RpbGwgZ2V0dGluZyBmYW1pbGlhci48YnI+Cjxicj4KVGhlIGZvbGxvd2luZyBPVkFM IHRlc3Qgc2VhcmNoZXMgZm9yIHN5c3RlbSBhY2NvdW50cyAoVUlEICZsdDsgNTAwKSBpbjxicj4K L2V0Yy9hdC5hbGxvdyAoSSBhbSBzaG93aW5nIGp1c3QgdGhlIHJlbGV2YW50IHBhcnRzIG9mPGJy PgpSSEVMLzUvaW5wdXQvb3ZhbC9hdF9zeXN0ZW1fYWNjb3VudHMueG1sIHRvIGV4cGxhaW4gbXkg cHJvYmxlbSk6PGJyPgo8YnI+CiZsdDtjcml0ZXJpYSZndDs8YnI+CsKgICZsdDtjcml0ZXJpb24g dGVzdF9yZWY9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgLyZn dDs8YnI+CiZsdDsvY3JpdGVyaWEmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4OnBhc3N3b3JkX3Rlc3Qg Y2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVvdDtub25lX2V4aXN0JnF1 b3Q7PGJyPgpjb21tZW50PSZxdW90O1Rlc3Rpbmcgc3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQu YWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93 JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4Om9iamVjdCBv YmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsg LyZndDs8YnI+CiZsdDsvdW5peDpwYXNzd29yZF90ZXN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpw YXNzd29yZF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxv dyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7dW5peDp1c2VybmFt ZSBvcGVyYXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7PGJyPgp2YXJfcmVmPSZxdW90O3Zhcl9hdF9z eXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2YXJfY2hlY2s9JnF1b3Q7YXQgbGVhc3Qg b25lJnF1b3Q7PGJyPgpkYXRhdHlwZT0mcXVvdDtzdHJpbmcmcXVvdDsgLyZndDs8YnI+CsKgICZs dDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2Fj Y291bnRzX2F0X2FsbG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxicj4KJmx0Oy91bml4OnBhc3N3b3Jk X29iamVjdCZndDs8YnI+Cjxicj4KJmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSZxdW90O3Zhcl9hdF9z eXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90Ozxicj4KY29tbWVudD0mcXVvdDtBY2NvdW50 cyBBbGxvd2VkJnF1b3Q7IGRhdGF0eXBlPSZxdW90O3N0cmluZyZxdW90OyB2ZXJzaW9uPSZxdW90 OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7b2JqZWN0X2NvbXBvbmVudCBpdGVtX2ZpZWxkPSZxdW90 O3N1YmV4cHJlc3Npb24mcXVvdDs8YnI+Cm9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2F0X3N5c3Rl bV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L2xvY2FsX3ZhcmlhYmxl Jmd0Ozxicj4KPGJyPgombHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBjb21tZW50PSZx dW90Oy9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNj b3VudHNfYWxsb3dfbGlzdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAm bHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMvYXQuYWxsb3cmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+ CsKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZn dDteKC4qKSQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj4KwqAgJmx0O2luZDppbnN0YW5jZSBvcGVy YXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7PGJyPgpkYXRhdHlwZT0mcXVv dDtpbnQmcXVvdDsmZ3Q7MCZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj4KJmx0Oy9pbmQ6dGV4dGZp bGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpwYXNzd29yZF9zdGF0ZSBp ZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3dfdWlkJnF1b3Q7IHZlcnNp b249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4OnVzZXJfaWQgZGF0YXR5cGU9JnF1 b3Q7aW50JnF1b3Q7IG9wZXJhdGlvbj0mcXVvdDtsZXNzIHRoYW4mcXVvdDsmZ3Q7NTAwJmx0Oy91 bml4OnVzZXJfaWQmZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfc3RhdGUmZ3Q7PGJyPgo8YnI+ Cjxicj4KVGhlIHRlc3QgYWJvdmUgZ2V0cyB0aGUgdXNlcnMgaW5mb3JtYXRpb24gZnJvbSB0aGUg c291cmNlcyBzcGVjaWZpZWQ8YnI+CmluIE5TUyAoL2V0Yy9uc3N3aXRjaC5jb25mKSB3aGljaCBp cyBjb3JyZWN0LCBob3dldmVyIEkgd2FudCB0byBjcmVhdGU8YnI+CmEgdmVyc2lvbiB0aGF0IHVz ZXMgL2V0Yy9wYXNzd2QgZGlyZWN0bHkuIFdoeT8gV2UgaGF2ZSBtYW55PGJyPgoodGhvdXNhbmRz Pykgb2YgUkhFTCA1IGJhc2VkIHNlcnZlcnMgd2l0aCBMREFQIGludGVncmF0aW9uLCBhbmQgbWFu eTxicj4KKHRob3VzYW5kcz8pIG9mIGFjY291bnRzIGluIHRoZSBMREFQIHNlcnZlcnMuPGJyPgo8 YnI+ClNpbXBsZSB0ZXN0cyBsaWtlIFJIRUwvNS9pbnB1dC9vdmFsL2F0X3N5c3RlbV9hY2NvdW50 cy54bWwgYW5kPGJyPgpSSEVMLzUvaW5wdXQvb3ZhbC9jcm9uX3N5c3RlbV9hY2NvdW50cy54bWwg Y2FuIHRha2UgaG91cnMgdG8gcnVuPGJyPgpiZWNhdXNlIHRoZXkgcmV0cmlldmUgKmFsbCogdXNl cnMgaW5mb3JtYXRpb24gZnJvbSB0aGUgTERBUCBzZXJ2ZXJzPGJyPgphbmQgdGhleSBkbyBpdCAq Zm9yIGVhY2ggZW50cnkqIGluIC9ldGMvYXQuYWxsb3cgYW5kIC9ldGMvY3Jvbi5hbGxvdy48YnI+ CkFsc28sIGlmIHdlIHJ1biBPcGVuU0NBUCAob3NjYXApIGF0IHRoZSBzYW1lIHRpbWUgaW4gYSBm ZXcgc2VydmVyczxicj4KdGhleSBoaXQgdGhlIExEQVAgc2VydmVycyByZWFsbHkgYmFkLjxicj4K PGJyPgpJIGhhdmUgYmVlbiB0cnlpbmcgdG8gcmVwbGFjZSBwYXNzd29yZF90ZXN0IGFuZCBwYXNz d29yZF9vYmplY3QgYnk8YnI+CnRleHRmaWxlY29udGVudDU0X3Rlc3QgYW5kIHRleHRmaWxlY29u dGVudDU0X29iamVjdCB3aXRob3V0IGFueSBsdWNrLjxicj4KSWYgeW91IHdhbnQsIEkgY2FuIHNo YXJlIG15IGF0X3N5c3RlbV9hY2NvdW50cy54bWwgZmlsZSB0aGF0IEkgdGhvdWdodDxicj4KaXQg d2FzIGdvaW5nIHRvIHdvcmsuPGJyPgo8YnI+Ckkgd291bGQgcmVhbGx5IGFwcHJlY2lhdGUgYW55 IGhlbHAgb3IgaGludD88YnI+Cjxicj4KPGJyPgpSZWdhcmRzPGJyPgotLTxicj4KUm9kb2xmbyBN YXJ0w61uZXo8YnI+PC9kaXY+PC9kaXY+PHNwYW4gY2xhc3M9IiI+Ci0tPGJyPgpTQ0FQIFNlY3Vy aXR5IEd1aWRlIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHkt Z3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnNjYXAtc2VjdXJp dHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8v bGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxp c3RzLmZlZG9yYWhvc3RlZC5vcmciIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2dpdGh1 Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS8iIHJlbD0ibm9yZWZlcnJlciIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1 aWRlLzwvYT48YnI+Cjwvc3Bhbj48L2Jsb2NrcXVvdGU+PC9kaXY+PHNwYW4gY2xhc3M9IkhPRW5a YiI+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj48YnIgY2xlYXI9ImFsbCI+PGRpdj48YnI+PC9k aXY+LS0gPGJyPjxkaXYgZGF0YS1zbWFydG1haWw9ImdtYWlsX3NpZ25hdHVyZSI+QW5kcmV3IFNo ZXdtYWtlcjwvZGl2Pgo8L2ZvbnQ+PC9zcGFuPjwvZGl2Pgo8YnI+LS08YnI+ClNDQVAgU2VjdXJp dHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1n dWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZl ZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3Rl ZC5vcmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQu b3JnIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9y YWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFo b3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3Nj YXAtc2VjdXJpdHktZ3VpZGUvIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRw czovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS88L2E+PGJyPgo8YnI+ PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4K --===============5389906068769358802==-- From RHAYDEN at CERNER.COM Wed Jun 8 17:19:37 2016 Content-Type: multipart/mixed; boundary="===============3738877974036189252==" MIME-Version: 1.0 From: Hayden,Robert To: scap-security-guide at lists.fedorahosted.org Subject: RE: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 17:19:16 +0000 Message-ID: <5f506516eb314efd95b5219664ea9088@CERNMSGLS5EX01A.cerner.net> In-Reply-To: CAB6RzTtGn-P9t7GKFR8Mp9cRiT70kr+GvKEWqFdPWquASGYs1g@mail.gmail.com --===============3738877974036189252== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable If it helps, you can use the following type of command to pull lines from /= etc/passwd. awk -v UID=3D500 -F: '($3>=3DUID)' /etc/passwd Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.406= 8 | rhayden(a)cerner.com | www.cerner.com From: Rodolfo Mart=C3=ADnez [mailto:rmtzcx(a)gmail.com] Sent: Wednesday, June 08, 2016 12:10 PM To: SCAP Security Guide Subject: Re: Use /etc/passwd directly instead of sources in NSS Hi Andrew, I took a look at nsscache, it looks good. In fact, a combination of nsscach= e and nss_db might be a good solution, but not feasible at the moment. If I would be able to get a list of users from /etc/passwd with UID greater= or equal to 500 without using password_object (this is the one that pulls = all information from LDAP) it would be the best solution now. I will contin= ue trying to do it. I would appreciate any hint or someone that confirm tha= t it is not possible. Thanks -- Rodolfo Mart=C3=ADnez On Tue, Jun 7, 2016 at 3:50 PM, Andrew Shewmaker > wrote: A totally different approach to addressing your issue would be to use nss_d= b or http://code.google.com/p/nsscache/ to cache LDAP. On Tue, May 31, 2016 at 4:43 PM, Rodolfo Mart=C3=ADnez > wrote: Hi List, After many hours playing with SSG and OpenSCAP and not able to do what I want I need some help. Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to SSG and I am still getting familiar. The following OVAL test searches for system accounts (UID < 500) in /etc/at.allow (I am showing just the relevant parts of RHEL/5/input/oval/at_system_accounts.xml to explain my problem): state_at_system_accounts_at_allow_uid /etc/at.allow ^(.*)$ 0 500 The test above gets the users information from the sources specified in NSS (/etc/nsswitch.conf) which is correct, however I want to create a version that uses /etc/passwd directly. Why? We have many (thousands?) of RHEL 5 based servers with LDAP integration, and many (thousands?) of accounts in the LDAP servers. Simple tests like RHEL/5/input/oval/at_system_accounts.xml and RHEL/5/input/oval/cron_system_accounts.xml can take hours to run because they retrieve *all* users information from the LDAP servers and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. Also, if we run OpenSCAP (oscap) at the same time in a few servers they hit the LDAP servers really bad. I have been trying to replace password_test and password_object by textfilecontent54_test and textfilecontent54_object without any luck. If you want, I can share my at_system_accounts.xml file that I thought it was going to work. I would really appreciate any help or hint? Regards -- Rodolfo Mart=C3=ADnez -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fedo= rahosted.org https://github.com/OpenSCAP/scap-security-guide/ -- Andrew Shewmaker -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fedo= rahosted.org https://github.com/OpenSCAP/scap-security-guide/ CONFIDENTIALITY NOTICE This message and any included attachments are from C= erner Corporation and are intended only for the addressee. The information = contained in this message is confidential and may constitute inside or non-= public information under international, federal, or state securities laws. = Unauthorized forwarding, printing, copying, distribution, or use of such in= formation is strictly prohibited and may be unlawful. If you are not the ad= dressee, please promptly delete this message and notify the sender of the d= elivery error by e-mail or you may call Cerner's corporate offices in Kansa= s City, Missouri, U.S.A at (+1) (816)221-1024. --===============3738877974036189252== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4u aG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOmhvZW56Yjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2 OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZd LS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklmIGl0IGhlbHBzLCB5b3UgY2FuIHVzZSB0aGUg Zm9sbG93aW5nIHR5cGUgb2YgY29tbWFuZCB0byBwdWxsIGxpbmVzIGZyb20gL2V0Yy9wYXNzd2Qu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5hd2sgLXYgVUlEPTUw MCAtRjogJygkMyZndDs9VUlEKScgL2V0Yy9wYXNzd2Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQt YXV0b3NwYWNlOm5vbmUiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6bmF2eSI+Um9iZXJ0IEhheWRl bjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpuYXZ5Ij4gfCBTci4gVGVjaG5vbG9neSBB cmNoaXRlY3QgfCBDZXJuZXINCiBDb3Jwb3JhdGlvbiB8IDgxNi4yMDEuNDA2OCB8IDxhIGhyZWY9 Im1haWx0bzpyaGF5ZGVuQGNlcm5lci5jb20iPnJoYXlkZW5AY2VybmVyLmNvbTwvYT4gfA0KPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PGEgaHJlZj0id3d3LmNlcm5lci5jb20i Pnd3dy5jZXJuZXIuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBSb2RvbGZvIE1hcnTDrW5leiBbbWFpbHRvOnJt dHpjeEBnbWFpbC5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBKdW5lIDA4LCAy MDE2IDEyOjEwIFBNPGJyPg0KPGI+VG86PC9iPiBTQ0FQIFNlY3VyaXR5IEd1aWRlICZsdDtzY2Fw LXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVj dDo8L2I+IFJlOiBVc2UgL2V0Yy9wYXNzd2QgZGlyZWN0bHkgaW5zdGVhZCBvZiBzb3VyY2VzIGlu IE5TUzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhv bWEmcXVvdDssc2Fucy1zZXJpZiI+SGkgQW5kcmV3LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEy LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNl cmlmIj5JIHRvb2sgYSBsb29rIGF0IG5zc2NhY2hlLCBpdCBsb29rcyBnb29kLiBJbiBmYWN0LCBh IGNvbWJpbmF0aW9uIG9mIG5zc2NhY2hlIGFuZCBuc3NfZGIgbWlnaHQgYmUgYSBnb29kIHNvbHV0 aW9uLCBidXQgbm90IGZlYXNpYmxlIGF0IHRoZSBtb21lbnQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNh bnMtc2VyaWYiPklmIEkgd291bGQgYmUgYWJsZSB0byBnZXQgYSBsaXN0IG9mIHVzZXJzIGZyb20g L2V0Yy9wYXNzd2Qgd2l0aCBVSUQgZ3JlYXRlciBvciBlcXVhbCB0byA1MDAgd2l0aG91dCB1c2lu ZyBwYXNzd29yZF9vYmplY3QgKHRoaXMgaXMgdGhlIG9uZSB0aGF0IHB1bGxzIGFsbCBpbmZvcm1h dGlvbg0KIGZyb20gTERBUCkgaXQgd291bGQgYmUgdGhlIGJlc3Qgc29sdXRpb24gbm93LiBJIHdp bGwgY29udGludWUgdHJ5aW5nIHRvIGRvIGl0LiBJIHdvdWxkIGFwcHJlY2lhdGUgYW55IGhpbnQg b3Igc29tZW9uZSB0aGF0IGNvbmZpcm0gdGhhdCBpdCBpcyBub3QgcG9zc2libGUuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5UaGFua3M8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPi0tPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1 b3Q7LHNhbnMtc2VyaWYiPlJvZG9sZm8gTWFydMOtbmV6PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBKdW4g NywgMjAxNiBhdCAzOjUwIFBNLCBBbmRyZXcgU2hld21ha2VyICZsdDs8YSBocmVmPSJtYWlsdG86 YWdzaGV3QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmFnc2hld0BnbWFpbC5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7 bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmIj5BIHRvdGFsbHkgZGlmZmVyZW50IGFwcHJvYWNoIHRvIGFkZHJlc3Npbmcg eW91ciBpc3N1ZSB3b3VsZCBiZSB0byB1c2UgbnNzX2RiIG9yDQo8YSBocmVmPSJodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fY29kZS5nb29nbGUuY29t X3BfbnNzY2FjaGVfJmFtcDtkPUN3TUZhUSZhbXA7Yz1OUnR6VHpLTmFDQ21oTl85TjJZSlItWHJO VTFodUlnWVA5OXlEc0V6YUpvJmFtcDtyPXBjd3RoRkxTSWIxRnlQUFFMN1hYa1RlY29kS3pHNk1S M25KbzdRVkVybjAmYW1wO209UHRobGxZaGhKSlBKQ1RvX1lGNkJuSkdiYTBhOHQxV01JUU1OSldK ZnZZayZhbXA7cz1NSFNfS2FOZ2ItVFJzUlpXSlJTRDc4N0Q4SEk0Y2M0SWR6M0ZMbkpFVVpnJmFt cDtlPSIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cDovL2NvZGUuZ29vZ2xlLmNvbS9wL25zc2NhY2hl LzwvYT4gdG8gY2FjaGUgTERBUC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBNYXkgMzEsIDIw MTYgYXQgNDo0MyBQTSwgUm9kb2xmbyBNYXJ0w61uZXogJmx0OzxhIGhyZWY9Im1haWx0bzpybXR6 Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4QGdtYWlsLmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBp biAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIExpc3QsPGJyPg0KPGJyPg0KQWZ0ZXIgbWFu eSBob3VycyBwbGF5aW5nIHdpdGggU1NHIGFuZCBPcGVuU0NBUCBhbmQgbm90IGFibGUgdG8gZG8g d2hhdDxicj4NCkkgd2FudCBJIG5lZWQgc29tZSBoZWxwLjxicj4NCjxicj4NCkZvcmdpdmUgbWUg aWYgSSB1c2UgU0NBUCBvciBPcGVuU0NBUCB0ZXJtcyBpbmNvcnJlY3RseSwgSSBhbSBuZXcgdG88 YnI+DQpTU0cgYW5kIEkgYW0gc3RpbGwgZ2V0dGluZyBmYW1pbGlhci48YnI+DQo8YnI+DQpUaGUg Zm9sbG93aW5nIE9WQUwgdGVzdCBzZWFyY2hlcyBmb3Igc3lzdGVtIGFjY291bnRzIChVSUQgJmx0 OyA1MDApIGluPGJyPg0KL2V0Yy9hdC5hbGxvdyAoSSBhbSBzaG93aW5nIGp1c3QgdGhlIHJlbGV2 YW50IHBhcnRzIG9mPGJyPg0KUkhFTC81L2lucHV0L292YWwvYXRfc3lzdGVtX2FjY291bnRzLnht bCB0byBleHBsYWluIG15IHByb2JsZW0pOjxicj4NCjxicj4NCiZsdDtjcml0ZXJpYSZndDs8YnI+ DQombmJzcDsgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X2F0X3N5c3RlbV9hY2Nv dW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj4NCiZsdDsvY3JpdGVyaWEmZ3Q7PGJyPg0KPGJy Pg0KJmx0O3VuaXg6cGFzc3dvcmRfdGVzdCBjaGVjaz0mcXVvdDthbGwmcXVvdDsgY2hlY2tfZXhp c3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDs8YnI+DQpjb21tZW50PSZxdW90O1Rlc3Rpbmcg c3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+DQppZD0mcXVvdDt0ZXN0 X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsm Z3Q7PGJyPg0KJm5ic3A7ICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSZxdW90O29iamVjdF9h dF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgLyZndDs8YnI+DQombHQ7L3VuaXg6cGFz c3dvcmRfdGVzdCZndDs8YnI+DQo8YnI+DQombHQ7dW5peDpwYXNzd29yZF9vYmplY3QgaWQ9JnF1 b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90 OzEmcXVvdDsmZ3Q7PGJyPg0KJm5ic3A7ICZsdDt1bml4OnVzZXJuYW1lIG9wZXJhdGlvbj0mcXVv dDtlcXVhbHMmcXVvdDs8YnI+DQp2YXJfcmVmPSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNf YWxsb3dfbGlzdCZxdW90OyB2YXJfY2hlY2s9JnF1b3Q7YXQgbGVhc3Qgb25lJnF1b3Q7PGJyPg0K ZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IC8mZ3Q7PGJyPg0KJm5ic3A7ICZsdDtmaWx0ZXIg YWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0 X2FsbG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxicj4NCiZsdDsvdW5peDpwYXNzd29yZF9vYmplY3Qm Z3Q7PGJyPg0KPGJyPg0KJmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSZxdW90O3Zhcl9hdF9zeXN0ZW1f YWNjb3VudHNfYWxsb3dfbGlzdCZxdW90Ozxicj4NCmNvbW1lbnQ9JnF1b3Q7QWNjb3VudHMgQWxs b3dlZCZxdW90OyBkYXRhdHlwZT0mcXVvdDtzdHJpbmcmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1 b3Q7Jmd0Ozxicj4NCiZuYnNwOyAmbHQ7b2JqZWN0X2NvbXBvbmVudCBpdGVtX2ZpZWxkPSZxdW90 O3N1YmV4cHJlc3Npb24mcXVvdDs8YnI+DQpvYmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0 ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyAvJmd0Ozxicj4NCiZsdDsvbG9jYWxfdmFyaWFi bGUmZ3Q7PGJyPg0KPGJyPg0KJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QgY29tbWVu dD0mcXVvdDsvZXRjL2F0LmFsbG93JnF1b3Q7PGJyPg0KaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3Rl bV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+ DQombmJzcDsgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2F0LmFsbG93Jmx0Oy9pbmQ6ZmlsZXBh dGgmZ3Q7PGJyPg0KJm5ic3A7ICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVy biBtYXRjaCZxdW90OyZndDteKC4qKSQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj4NCiZuYnNwOyAm bHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVv dDs8YnI+DQpkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MCZsdDsvaW5kOmluc3RhbmNlJmd0 Ozxicj4NCiZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDs8YnI+DQo8YnI+DQom bHQ7dW5peDpwYXNzd29yZF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNf YXRfYWxsb3dfdWlkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+DQombmJzcDsg Jmx0O3VuaXg6dXNlcl9pZCBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsgb3BlcmF0aW9uPSZxdW90 O2xlc3MgdGhhbiZxdW90OyZndDs1MDAmbHQ7L3VuaXg6dXNlcl9pZCZndDs8YnI+DQombHQ7L3Vu aXg6cGFzc3dvcmRfc3RhdGUmZ3Q7PGJyPg0KPGJyPg0KPGJyPg0KVGhlIHRlc3QgYWJvdmUgZ2V0 cyB0aGUgdXNlcnMgaW5mb3JtYXRpb24gZnJvbSB0aGUgc291cmNlcyBzcGVjaWZpZWQ8YnI+DQpp biBOU1MgKC9ldGMvbnNzd2l0Y2guY29uZikgd2hpY2ggaXMgY29ycmVjdCwgaG93ZXZlciBJIHdh bnQgdG8gY3JlYXRlPGJyPg0KYSB2ZXJzaW9uIHRoYXQgdXNlcyAvZXRjL3Bhc3N3ZCBkaXJlY3Rs eS4gV2h5PyBXZSBoYXZlIG1hbnk8YnI+DQoodGhvdXNhbmRzPykgb2YgUkhFTCA1IGJhc2VkIHNl cnZlcnMgd2l0aCBMREFQIGludGVncmF0aW9uLCBhbmQgbWFueTxicj4NCih0aG91c2FuZHM/KSBv ZiBhY2NvdW50cyBpbiB0aGUgTERBUCBzZXJ2ZXJzLjxicj4NCjxicj4NClNpbXBsZSB0ZXN0cyBs aWtlIFJIRUwvNS9pbnB1dC9vdmFsL2F0X3N5c3RlbV9hY2NvdW50cy54bWwgYW5kPGJyPg0KUkhF TC81L2lucHV0L292YWwvY3Jvbl9zeXN0ZW1fYWNjb3VudHMueG1sIGNhbiB0YWtlIGhvdXJzIHRv IHJ1bjxicj4NCmJlY2F1c2UgdGhleSByZXRyaWV2ZSAqYWxsKiB1c2VycyBpbmZvcm1hdGlvbiBm cm9tIHRoZSBMREFQIHNlcnZlcnM8YnI+DQphbmQgdGhleSBkbyBpdCAqZm9yIGVhY2ggZW50cnkq IGluIC9ldGMvYXQuYWxsb3cgYW5kIC9ldGMvY3Jvbi5hbGxvdy48YnI+DQpBbHNvLCBpZiB3ZSBy dW4gT3BlblNDQVAgKG9zY2FwKSBhdCB0aGUgc2FtZSB0aW1lIGluIGEgZmV3IHNlcnZlcnM8YnI+ DQp0aGV5IGhpdCB0aGUgTERBUCBzZXJ2ZXJzIHJlYWxseSBiYWQuPGJyPg0KPGJyPg0KSSBoYXZl IGJlZW4gdHJ5aW5nIHRvIHJlcGxhY2UgcGFzc3dvcmRfdGVzdCBhbmQgcGFzc3dvcmRfb2JqZWN0 IGJ5PGJyPg0KdGV4dGZpbGVjb250ZW50NTRfdGVzdCBhbmQgdGV4dGZpbGVjb250ZW50NTRfb2Jq ZWN0IHdpdGhvdXQgYW55IGx1Y2suPGJyPg0KSWYgeW91IHdhbnQsIEkgY2FuIHNoYXJlIG15IGF0 X3N5c3RlbV9hY2NvdW50cy54bWwgZmlsZSB0aGF0IEkgdGhvdWdodDxicj4NCml0IHdhcyBnb2lu ZyB0byB3b3JrLjxicj4NCjxicj4NCkkgd291bGQgcmVhbGx5IGFwcHJlY2lhdGUgYW55IGhlbHAg b3IgaGludD88YnI+DQo8YnI+DQo8YnI+DQpSZWdhcmRzPGJyPg0KLS08YnI+DQpSb2RvbGZvIE1h cnTDrW5lejxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPi0tPGJyPg0KU0NBUCBTZWN1cml0eSBHdWlkZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVm PSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJn ZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h Pjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/ dT1odHRwcy0zQV9fbGlzdHMuZmVkb3JhaG9zdGVkLm9yZ19hZG1pbl9saXN0c19zY2FwLTJEc2Vj dXJpdHktMkRndWlkZS00MGxpc3RzLmZlZG9yYWhvc3RlZC5vcmcmYW1wO2Q9Q3dNRmFRJmFtcDtj PU5SdHpUektOYUNDbWhOXzlOMllKUi1Yck5VMWh1SWdZUDk5eURzRXphSm8mYW1wO3I9cGN3dGhG TFNJYjFGeVBQUUw3WFhrVGVjb2RLekc2TVIzbkpvN1FWRXJuMCZhbXA7bT1QdGhsbFloaEpKUEpD VG9fWUY2Qm5KR2JhMGE4dDFXTUlRTU5KV0pmdllrJmFtcDtzPUw3VUl3d1dvUHFXV0M0OWZ0YUJo QkpGOHpxVHZYblFHUVk4Rm9iY0s0RmcmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9s aXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlz dHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2Uu cHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2dpdGh1Yi5jb21fT3BlblNDQVBfc2Nh cC0yRHNlY3VyaXR5LTJEZ3VpZGVfJmFtcDtkPUN3TUZhUSZhbXA7Yz1OUnR6VHpLTmFDQ21oTl85 TjJZSlItWHJOVTFodUlnWVA5OXlEc0V6YUpvJmFtcDtyPXBjd3RoRkxTSWIxRnlQUFFMN1hYa1Rl Y29kS3pHNk1SM25KbzdRVkVybjAmYW1wO209UHRobGxZaGhKSlBKQ1RvX1lGNkJuSkdiYTBhOHQx V01JUU1OSldKZnZZayZhbXA7cz1vVkVaU1Fabl84QURCOW9DU1JXbU1TX003RFJTU0E4MjlZOXQz MWJINUVzJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NB UC9zY2FwLXNlY3VyaXR5LWd1aWRlLzwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgi Pjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxzcGFuIGNsYXNzPSJob2VuemIiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGNsYXNzPSJo b2VuemIiPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij4tLSA8L3NwYW4+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojODg4ODg4Ij5BbmRyZXcgU2hld21ha2VyPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBw dCI+PGJyPg0KLS08YnI+DQpTQ0FQIFNlY3VyaXR5IEd1aWRlIG1haWxpbmcgbGlzdDxicj4NCjxh IGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmci PnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+DQo8YSBo cmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X2xpc3RzLmZlZG9yYWhvc3RlZC5vcmdfYWRtaW5fbGlzdHNfc2NhcC0yRHNlY3VyaXR5LTJEZ3Vp ZGUtNDBsaXN0cy5mZWRvcmFob3N0ZWQub3JnJmFtcDtkPUN3TUZhUSZhbXA7Yz1OUnR6VHpLTmFD Q21oTl85TjJZSlItWHJOVTFodUlnWVA5OXlEc0V6YUpvJmFtcDtyPXBjd3RoRkxTSWIxRnlQUFFM N1hYa1RlY29kS3pHNk1SM25KbzdRVkVybjAmYW1wO209UHRobGxZaGhKSlBKQ1RvX1lGNkJuSkdi YTBhOHQxV01JUU1OSldKZnZZayZhbXA7cz1MN1VJd3dXb1BxV1dDNDlmdGFCaEJKRjh6cVR2WG5R R1FZOEZvYmNLNEZnJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX19naXRodWIuY29tX09wZW5TQ0FQX3NjYXAtMkRzZWN1cml0 eS0yRGd1aWRlXyZhbXA7ZD1Dd01GYVEmYW1wO2M9TlJ0elR6S05hQ0NtaE5fOU4yWUpSLVhyTlUx aHVJZ1lQOTl5RHNFemFKbyZhbXA7cj1wY3d0aEZMU0liMUZ5UFBRTDdYWGtUZWNvZEt6RzZNUjNu Sm83UVZFcm4wJmFtcDttPVB0aGxsWWhoSkpQSkNUb19ZRjZCbkpHYmEwYTh0MVdNSVFNTkpXSmZ2 WWsmYW1wO3M9b1ZFWlNRWm5fOEFEQjlvQ1NSV21NU19NN0RSU1NBODI5WTl0MzFiSDVFcyZhbXA7 ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1 cml0eS1ndWlkZS88L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N Cgo8RElWPgpDT05GSURFTlRJQUxJVFkgTk9USUNFIFRoaXMgbWVzc2FnZSBhbmQgYW55IGluY2x1 ZGVkIGF0dGFjaG1lbnRzIGFyZSBmcm9tIENlcm5lciBDb3Jwb3JhdGlvbiBhbmQgYXJlIGludGVu ZGVkIG9ubHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4g dGhpcyBtZXNzYWdlIGlzIGNvbmZpZGVudGlhbCBhbmQgbWF5IGNvbnN0aXR1dGUgaW5zaWRlIG9y IG5vbi1wdWJsaWMgaW5mb3JtYXRpb24gdW5kZXIgaW50ZXJuYXRpb25hbCwgZmVkZXJhbCwgb3Ig c3RhdGUgc2VjdXJpdGllcyBsYXdzLiBVbmF1dGhvcml6ZWQgZm9yd2FyZGluZywgcHJpbnRpbmcs IGNvcHlpbmcsIGRpc3RyaWJ1dGlvbiwgb3IgdXNlIG9mIHN1Y2ggaW5mb3JtYXRpb24gaXMgc3Ry aWN0bHkgcHJvaGliaXRlZCBhbmQgbWF5IGJlIHVubGF3ZnVsLiBJZiB5b3UgYXJlIG5vdCB0aGUg YWRkcmVzc2VlLCBwbGVhc2UgcHJvbXB0bHkgZGVsZXRlIHRoaXMgbWVzc2FnZSBhbmQgbm90aWZ5 IHRoZSBzZW5kZXIgb2YgdGhlIGRlbGl2ZXJ5IGVycm9yIGJ5IGUtbWFpbCBvciB5b3UgbWF5IGNh bGwgQ2VybmVyJiMzOTtzIGNvcnBvcmF0ZSBvZmZpY2VzIGluIEthbnNhcyBDaXR5LCBNaXNzb3Vy aSwgVS5TLkEgYXQgKCsxKSAoODE2KTIyMS0xMDI0LjxCUj4KPC9ESVY+PC9ib2R5Pg0KPC9odG1s Pg0K --===============3738877974036189252==-- From rmtzcx at gmail.com Wed Jun 8 18:04:20 2016 Content-Type: multipart/mixed; boundary="===============0415080695130622532==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 13:03:59 -0500 Message-ID: In-Reply-To: 5f506516eb314efd95b5219664ea9088@CERNMSGLS5EX01A.cerner.net --===============0415080695130622532== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Robert, Thanks for your reply. That perfectly works in a bash remediation script, but how do I do that with OVAL without using '' ? -- Rodolfo Mart=C3=ADnez On Wed, Jun 8, 2016 at 12:19 PM, Hayden,Robert wrote: > If it helps, you can use the following type of command to pull lines from > /etc/passwd. > > > > awk -v UID=3D500 -F: '($3>=3DUID)' /etc/passwd > > > > *Robert Hayden* | Sr. Technology Architect | Cerner Corporation | > 816.201.4068 | rhayden(a)cerner.com | www.cerner.com > > > > *From:* Rodolfo Mart=C3=ADnez [mailto:rmtzcx(a)gmail.com] > *Sent:* Wednesday, June 08, 2016 12:10 PM > *To:* SCAP Security Guide > *Subject:* Re: Use /etc/passwd directly instead of sources in NSS > > > > Hi Andrew, > > I took a look at nsscache, it looks good. In fact, a combination of > nsscache and nss_db might be a good solution, but not feasible at the > moment. > > If I would be able to get a list of users from /etc/passwd with UID > greater or equal to 500 without using password_object (this is the one th= at > pulls all information from LDAP) it would be the best solution now. I will > continue trying to do it. I would appreciate any hint or someone that > confirm that it is not possible. > > Thanks > > > -- > > Rodolfo Mart=C3=ADnez > > > > On Tue, Jun 7, 2016 at 3:50 PM, Andrew Shewmaker wro= te: > > A totally different approach to addressing your issue would be to use > nss_db or http://code.google.com/p/nsscache/ > > to cache LDAP. > > > > On Tue, May 31, 2016 at 4:43 PM, Rodolfo Mart=C3=ADnez > wrote: > > Hi List, > > After many hours playing with SSG and OpenSCAP and not able to do what > I want I need some help. > > Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to > SSG and I am still getting familiar. > > The following OVAL test searches for system accounts (UID < 500) in > /etc/at.allow (I am showing just the relevant parts of > RHEL/5/input/oval/at_system_accounts.xml to explain my problem): > > > > > > comment=3D"Testing system accounts in /etc/at.allow" > id=3D"test_at_system_accounts_at_allow" version=3D"1"> > > > > > var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least one" > datatype=3D"string" /> > state_at_system_accounts_at_allow_uid > > > comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> > object_ref=3D"object_at_system_accounts_allow_list" /> > > > id=3D"object_at_system_accounts_allow_list" version=3D"1"> > /etc/at.allow > ^(.*)$ > datatype=3D"int">0 > > > version=3D"1"> > 500 > > > > The test above gets the users information from the sources specified > in NSS (/etc/nsswitch.conf) which is correct, however I want to create > a version that uses /etc/passwd directly. Why? We have many > (thousands?) of RHEL 5 based servers with LDAP integration, and many > (thousands?) of accounts in the LDAP servers. > > Simple tests like RHEL/5/input/oval/at_system_accounts.xml and > RHEL/5/input/oval/cron_system_accounts.xml can take hours to run > because they retrieve *all* users information from the LDAP servers > and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. > Also, if we run OpenSCAP (oscap) at the same time in a few servers > they hit the LDAP servers really bad. > > I have been trying to replace password_test and password_object by > textfilecontent54_test and textfilecontent54_object without any luck. > If you want, I can share my at_system_accounts.xml file that I thought > it was going to work. > > I would really appreciate any help or hint? > > > Regards > -- > Rodolfo Mart=C3=ADnez > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > > https://github.com/OpenSCAP/scap-security-guide/ > > > > > > > -- > > Andrew Shewmaker > > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > > https://github.com/OpenSCAP/scap-security-guide/ > > > > CONFIDENTIALITY NOTICE This message and any included attachments are from > Cerner Corporation and are intended only for the addressee. The informati= on > contained in this message is confidential and may constitute inside or > non-public information under international, federal, or state securities > laws. Unauthorized forwarding, printing, copying, distribution, or use of > such information is strictly prohibited and may be unlawful. If you are n= ot > the addressee, please promptly delete this message and notify the sender = of > the delivery error by e-mail or you may call Cerner's corporate offices in > Kansas City, Missouri, U.S.A at (+1) (816)221-1024. > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============0415080695130622532== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgUm9iZXJ0LDxicj48YnI+ PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9t YSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhhbmtzIGZvciB5b3VyIHJlcGx5Ljxicj48 YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRh aG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhhdCBwZXJmZWN0bHkgd29ya3MgaW4g YSBiYXNoIHJlbWVkaWF0aW9uIHNjcmlwdCwgYnV0IGhvdyBkbyBJIGRvIHRoYXQgd2l0aCBPVkFM IHdpdGhvdXQgdXNpbmcgJiMzOTsmbHQ7dW5peDpwYXNzd29yZF9vYmplY3QmZ3Q7JiMzOTsgPzxi cj48YnI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxiciBjbGVhcj0iYWxs Ij48ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX3NpZ25hdHVyZSIgZGF0YS1zbWFydG1haWw9ImdtYWls X3NpZ25hdHVyZSI+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxm b250IHNpemU9IjIiPi0tPGJyPjwvZm9udD48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0 YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+Um9kb2xmbyBNYXJ0w61uZXo8L2ZvbnQ+ PC9kaXY+PC9kaXY+PC9kaXY+Cjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gV2VkLCBK dW4gOCwgMjAxNiBhdCAxMjoxOSBQTSwgSGF5ZGVuLFJvYmVydCA8c3BhbiBkaXI9Imx0ciI+Jmx0 OzxhIGhyZWY9Im1haWx0bzpSSEFZREVOQGNlcm5lci5jb20iIHRhcmdldD0iX2JsYW5rIj5SSEFZ REVOQGNlcm5lci5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNz PSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAj Y2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgoKCgoKCjxkaXYgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSIgbGFuZz0iRU4tVVMiPgo8ZGl2Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFmNDk3ZCI+SWYgaXQgaGVscHMsIHlvdSBjYW4gdXNlIHRoZSBmb2xs b3dpbmcgdHlwZSBvZiBjb21tYW5kIHRvIHB1bGwgbGluZXMgZnJvbSAvZXRjL3Bhc3N3ZC48dT48 L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMWY0OTdkIj48dT48L3U+wqA8dT48L3U+PC9zcGFuPjwvcD4KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5N2QiPmF3ayAtdiBVSUQ9NTAwIC1G OiAmIzM5OygkMyZndDs9VUlEKSYjMzk7IC9ldGMvcGFzc3dkPHU+PC91Pjx1PjwvdT48L3NwYW4+ PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFmNDk3ZCI+ PHU+PC91PsKgPHU+PC91Pjwvc3Bhbj48L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0 ZXh0LWF1dG9zcGFjZTpub25lIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOm5hdnkiPlJvYmVydCBI YXlkZW48L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6bmF2eSI+IHwgU3IuIFRlY2hub2xv Z3kgQXJjaGl0ZWN0IHwgQ2VybmVyCiBDb3Jwb3JhdGlvbiB8IDxhIGhyZWY9InRlbDo4MTYuMjAx LjQwNjgiIHZhbHVlPSIrMTgxNjIwMTQwNjgiIHRhcmdldD0iX2JsYW5rIj44MTYuMjAxLjQwNjg8 L2E+IHwgPGEgaHJlZj0ibWFpbHRvOnJoYXlkZW5AY2VybmVyLmNvbSIgdGFyZ2V0PSJfYmxhbmsi PnJoYXlkZW5AY2VybmVyLmNvbTwvYT4gfAo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMWY0 OTdkIj48YSBocmVmPSJodHRwOi8vd3d3LmNlcm5lci5jb20iIHRhcmdldD0iX2JsYW5rIj53d3cu Y2VybmVyLmNvbTwvYT48dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMWY0OTdkIj48dT48L3U+wqA8dT48L3U+PC9zcGFu PjwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gUm9kb2xmbyBNYXJ0w61uZXogW21haWx0bzo8YSBocmVm PSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5j b208L2E+XQo8YnI+CjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIEp1bmUgMDgsIDIwMTYgMTI6MTAg UE08YnI+CjxiPlRvOjwvYj4gU0NBUCBTZWN1cml0eSBHdWlkZSAmbHQ7PGEgaHJlZj0ibWFpbHRv OnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4mZ3Q7PGJy Pgo8Yj5TdWJqZWN0OjwvYj4gUmU6IFVzZSAvZXRjL3Bhc3N3ZCBkaXJlY3RseSBpbnN0ZWFkIG9m IHNvdXJjZXMgaW4gTlNTPHU+PC91Pjx1PjwvdT48L3NwYW4+PC9wPjxkaXY+PGRpdiBjbGFzcz0i aDUiPgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dT48L3U+wqA8dT48L3U+PC9wPgo8ZGl2Pgo8ZGl2 Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+SGkgQW5k cmV3LDx1PjwvdT48dT48L3U+PC9zcGFuPjwvcD4KPC9kaXY+CjxkaXY+CjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5JIHRvb2sgYSBsb29rIGF0IG5zc2Nh Y2hlLCBpdCBsb29rcyBnb29kLiBJbiBmYWN0LCBhIGNvbWJpbmF0aW9uIG9mIG5zc2NhY2hlIGFu ZCBuc3NfZGIgbWlnaHQgYmUgYSBnb29kIHNvbHV0aW9uLCBidXQgbm90IGZlYXNpYmxlIGF0IHRo ZSBtb21lbnQuPHU+PC91Pjx1PjwvdT48L3NwYW4+PC9wPgo8L2Rpdj4KPGRpdj4KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPklmIEkgd291bGQgYmUgYWJs ZSB0byBnZXQgYSBsaXN0IG9mIHVzZXJzIGZyb20gL2V0Yy9wYXNzd2Qgd2l0aCBVSUQgZ3JlYXRl ciBvciBlcXVhbCB0byA1MDAgd2l0aG91dCB1c2luZyBwYXNzd29yZF9vYmplY3QgKHRoaXMgaXMg dGhlIG9uZSB0aGF0IHB1bGxzIGFsbCBpbmZvcm1hdGlvbgogZnJvbSBMREFQKSBpdCB3b3VsZCBi ZSB0aGUgYmVzdCBzb2x1dGlvbiBub3cuIEkgd2lsbCBjb250aW51ZSB0cnlpbmcgdG8gZG8gaXQu IEkgd291bGQgYXBwcmVjaWF0ZSBhbnkgaGludCBvciBzb21lb25lIHRoYXQgY29uZmlybSB0aGF0 IGl0IGlzIG5vdCBwb3NzaWJsZS48dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjwvZGl2Pgo8ZGl2 Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VGFo b21hJnF1b3Q7LHNhbnMtc2VyaWYiPlRoYW5rczx1PjwvdT48dT48L3U+PC9zcGFuPjwvcD4KPC9k aXY+CjwvZGl2Pgo8ZGl2Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnIgY2xlYXI9ImFsbCI+Cjx1 PjwvdT48dT48L3U+PC9wPgo8ZGl2Pgo8ZGl2Pgo8ZGl2Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVv dDssc2Fucy1zZXJpZiI+LS08L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1Rh aG9tYSZxdW90OyxzYW5zLXNlcmlmIj48dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjwvZGl2Pgo8 ZGl2Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+Um9kb2xmbyBNYXJ0w61u ZXo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5z LXNlcmlmIj48dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjwvZGl2Pgo8L2Rpdj4KPC9kaXY+Cjxw IGNsYXNzPSJNc29Ob3JtYWwiPjx1PjwvdT7CoDx1PjwvdT48L3A+CjxkaXY+CjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIFR1ZSwgSnVuIDcsIDIwMTYgYXQgMzo1MCBQTSwgQW5kcmV3IFNoZXdtYWtl ciAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFnc2hld0BnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5h Z3NoZXdAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PHU+PC91Pjx1PjwvdT48L3A+CjxibG9ja3F1 b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjY2NjY2NjIDEuMHB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBp biI+CjxkaXY+CjxkaXY+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmIj5BIHRvdGFsbHkgZGlmZmVyZW50IGFw cHJvYWNoIHRvIGFkZHJlc3NpbmcgeW91ciBpc3N1ZSB3b3VsZCBiZSB0byB1c2UgbnNzX2RiIG9y CjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw LTNBX19jb2RlLmdvb2dsZS5jb21fcF9uc3NjYWNoZV8mYW1wO2Q9Q3dNRmFRJmFtcDtjPU5SdHpU ektOYUNDbWhOXzlOMllKUi1Yck5VMWh1SWdZUDk5eURzRXphSm8mYW1wO3I9cGN3dGhGTFNJYjFG eVBQUUw3WFhrVGVjb2RLekc2TVIzbkpvN1FWRXJuMCZhbXA7bT1QdGhsbFloaEpKUEpDVG9fWUY2 Qm5KR2JhMGE4dDFXTUlRTU5KV0pmdllrJmFtcDtzPU1IU19LYU5nYi1UUnNSWldKUlNENzg3RDhI STRjYzRJZHozRkxuSkVVWmcmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+Cmh0dHA6Ly9jb2RlLmdv b2dsZS5jb20vcC9uc3NjYWNoZS88L2E+IHRvIGNhY2hlIExEQVAuPC9zcGFuPjx1PjwvdT48dT48 L3U+PC9wPgo8L2Rpdj4KPC9kaXY+CjxkaXY+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx1PjwvdT7C oDx1PjwvdT48L3A+CjxkaXY+CjxkaXY+CjxkaXY+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1 ZSwgTWF5IDMxLCAyMDE2IGF0IDQ6NDMgUE0sIFJvZG9sZm8gTWFydMOtbmV6ICZsdDs8YSBocmVm PSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5j b208L2E+Jmd0OyB3cm90ZTo8dT48L3U+PHU+PC91PjwvcD4KPC9kaXY+CjwvZGl2Pgo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI2NjY2NjYyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDow aW4iPgo8ZGl2Pgo8ZGl2Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBMaXN0LDxicj4KPGJyPgpB ZnRlciBtYW55IGhvdXJzIHBsYXlpbmcgd2l0aCBTU0cgYW5kIE9wZW5TQ0FQIGFuZCBub3QgYWJs ZSB0byBkbyB3aGF0PGJyPgpJIHdhbnQgSSBuZWVkIHNvbWUgaGVscC48YnI+Cjxicj4KRm9yZ2l2 ZSBtZSBpZiBJIHVzZSBTQ0FQIG9yIE9wZW5TQ0FQIHRlcm1zIGluY29ycmVjdGx5LCBJIGFtIG5l dyB0bzxicj4KU1NHIGFuZCBJIGFtIHN0aWxsIGdldHRpbmcgZmFtaWxpYXIuPGJyPgo8YnI+ClRo ZSBmb2xsb3dpbmcgT1ZBTCB0ZXN0IHNlYXJjaGVzIGZvciBzeXN0ZW0gYWNjb3VudHMgKFVJRCAm bHQ7IDUwMCkgaW48YnI+Ci9ldGMvYXQuYWxsb3cgKEkgYW0gc2hvd2luZyBqdXN0IHRoZSByZWxl dmFudCBwYXJ0cyBvZjxicj4KUkhFTC81L2lucHV0L292YWwvYXRfc3lzdGVtX2FjY291bnRzLnht bCB0byBleHBsYWluIG15IHByb2JsZW0pOjxicj4KPGJyPgombHQ7Y3JpdGVyaWEmZ3Q7PGJyPgrC oCAmbHQ7Y3JpdGVyaW9uIHRlc3RfcmVmPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2FjY291bnRzX2F0 X2FsbG93JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L2NyaXRlcmlhJmd0Ozxicj4KPGJyPgombHQ7dW5p eDpwYXNzd29yZF90ZXN0IGNoZWNrPSZxdW90O2FsbCZxdW90OyBjaGVja19leGlzdGVuY2U9JnF1 b3Q7bm9uZV9leGlzdCZxdW90Ozxicj4KY29tbWVudD0mcXVvdDtUZXN0aW5nIHN5c3RlbSBhY2Nv dW50cyBpbiAvZXRjL2F0LmFsbG93JnF1b3Q7PGJyPgppZD0mcXVvdDt0ZXN0X2F0X3N5c3RlbV9h Y2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAm bHQ7dW5peDpvYmplY3Qgb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRz X2F0X2FsbG93JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfdGVzdCZndDs8YnI+ Cjxicj4KJmx0O3VuaXg6cGFzc3dvcmRfb2JqZWN0IGlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1f YWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KwqAg Jmx0O3VuaXg6dXNlcm5hbWUgb3BlcmF0aW9uPSZxdW90O2VxdWFscyZxdW90Ozxicj4KdmFyX3Jl Zj0mcXVvdDt2YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsgdmFyX2NoZWNr PSZxdW90O2F0IGxlYXN0IG9uZSZxdW90Ozxicj4KZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7 IC8mZ3Q7PGJyPgrCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1b3Q7Jmd0O3N0 YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmbHQ7L2ZpbHRlciZndDs8YnI+CiZs dDsvdW5peDpwYXNzd29yZF9vYmplY3QmZ3Q7PGJyPgo8YnI+CiZsdDtsb2NhbF92YXJpYWJsZSBp ZD0mcXVvdDt2YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDs8YnI+CmNvbW1l bnQ9JnF1b3Q7QWNjb3VudHMgQWxsb3dlZCZxdW90OyBkYXRhdHlwZT0mcXVvdDtzdHJpbmcmcXVv dDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KwqAgJmx0O29iamVjdF9jb21wb25lbnQg aXRlbV9maWVsZD0mcXVvdDtzdWJleHByZXNzaW9uJnF1b3Q7PGJyPgpvYmplY3RfcmVmPSZxdW90 O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyAvJmd0Ozxicj4KJmx0 Oy9sb2NhbF92YXJpYWJsZSZndDs8YnI+Cjxicj4KJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9v YmplY3QgY29tbWVudD0mcXVvdDsvZXRjL2F0LmFsbG93JnF1b3Q7PGJyPgppZD0mcXVvdDtvYmpl Y3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1 b3Q7Jmd0Ozxicj4KwqAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2F0LmFsbG93Jmx0Oy9pbmQ6 ZmlsZXBhdGgmZ3Q7PGJyPgrCoCAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRl cm4gbWF0Y2gmcXVvdDsmZ3Q7XiguKikkJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+CsKgICZsdDtp bmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90Ozxi cj4KZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzAmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+ CiZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDs8YnI+Cjxicj4KJmx0O3VuaXg6 cGFzc3dvcmRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93 X3VpZCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7dW5peDp1c2Vy X2lkIGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyBvcGVyYXRpb249JnF1b3Q7bGVzcyB0aGFuJnF1 b3Q7Jmd0OzUwMCZsdDsvdW5peDp1c2VyX2lkJmd0Ozxicj4KJmx0Oy91bml4OnBhc3N3b3JkX3N0 YXRlJmd0Ozxicj4KPGJyPgo8YnI+ClRoZSB0ZXN0IGFib3ZlIGdldHMgdGhlIHVzZXJzIGluZm9y bWF0aW9uIGZyb20gdGhlIHNvdXJjZXMgc3BlY2lmaWVkPGJyPgppbiBOU1MgKC9ldGMvbnNzd2l0 Y2guY29uZikgd2hpY2ggaXMgY29ycmVjdCwgaG93ZXZlciBJIHdhbnQgdG8gY3JlYXRlPGJyPgph IHZlcnNpb24gdGhhdCB1c2VzIC9ldGMvcGFzc3dkIGRpcmVjdGx5LiBXaHk/IFdlIGhhdmUgbWFu eTxicj4KKHRob3VzYW5kcz8pIG9mIFJIRUwgNSBiYXNlZCBzZXJ2ZXJzIHdpdGggTERBUCBpbnRl Z3JhdGlvbiwgYW5kIG1hbnk8YnI+Cih0aG91c2FuZHM/KSBvZiBhY2NvdW50cyBpbiB0aGUgTERB UCBzZXJ2ZXJzLjxicj4KPGJyPgpTaW1wbGUgdGVzdHMgbGlrZSBSSEVMLzUvaW5wdXQvb3ZhbC9h dF9zeXN0ZW1fYWNjb3VudHMueG1sIGFuZDxicj4KUkhFTC81L2lucHV0L292YWwvY3Jvbl9zeXN0 ZW1fYWNjb3VudHMueG1sIGNhbiB0YWtlIGhvdXJzIHRvIHJ1bjxicj4KYmVjYXVzZSB0aGV5IHJl dHJpZXZlICphbGwqIHVzZXJzIGluZm9ybWF0aW9uIGZyb20gdGhlIExEQVAgc2VydmVyczxicj4K YW5kIHRoZXkgZG8gaXQgKmZvciBlYWNoIGVudHJ5KiBpbiAvZXRjL2F0LmFsbG93IGFuZCAvZXRj L2Nyb24uYWxsb3cuPGJyPgpBbHNvLCBpZiB3ZSBydW4gT3BlblNDQVAgKG9zY2FwKSBhdCB0aGUg c2FtZSB0aW1lIGluIGEgZmV3IHNlcnZlcnM8YnI+CnRoZXkgaGl0IHRoZSBMREFQIHNlcnZlcnMg cmVhbGx5IGJhZC48YnI+Cjxicj4KSSBoYXZlIGJlZW4gdHJ5aW5nIHRvIHJlcGxhY2UgcGFzc3dv cmRfdGVzdCBhbmQgcGFzc3dvcmRfb2JqZWN0IGJ5PGJyPgp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0 IGFuZCB0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3Qgd2l0aG91dCBhbnkgbHVjay48YnI+CklmIHlv dSB3YW50LCBJIGNhbiBzaGFyZSBteSBhdF9zeXN0ZW1fYWNjb3VudHMueG1sIGZpbGUgdGhhdCBJ IHRob3VnaHQ8YnI+Cml0IHdhcyBnb2luZyB0byB3b3JrLjxicj4KPGJyPgpJIHdvdWxkIHJlYWxs eSBhcHByZWNpYXRlIGFueSBoZWxwIG9yIGhpbnQ/PGJyPgo8YnI+Cjxicj4KUmVnYXJkczxicj4K LS08YnI+ClJvZG9sZm8gTWFydMOtbmV6PHU+PC91Pjx1PjwvdT48L3A+CjwvZGl2Pgo8L2Rpdj4K PHAgY2xhc3M9Ik1zb05vcm1hbCI+LS08YnI+ClNDQVAgU2VjdXJpdHkgR3VpZGUgbWFpbGluZyBs aXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFo b3N0ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRv cmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19saXN0cy5mZWRvcmFob3N0ZWQub3JnX2FkbWluX2xp c3RzX3NjYXAtMkRzZWN1cml0eS0yRGd1aWRlLTQwbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyZhbXA7 ZD1Dd01GYVEmYW1wO2M9TlJ0elR6S05hQ0NtaE5fOU4yWUpSLVhyTlUxaHVJZ1lQOTl5RHNFemFK byZhbXA7cj1wY3d0aEZMU0liMUZ5UFBRTDdYWGtUZWNvZEt6RzZNUjNuSm83UVZFcm4wJmFtcDtt PVB0aGxsWWhoSkpQSkNUb19ZRjZCbkpHYmEwYTh0MVdNSVFNTkpXSmZ2WWsmYW1wO3M9TDdVSXd3 V29QcVdXQzQ5ZnRhQmhCSkY4enFUdlhuUUdRWThGb2JjSzRGZyZhbXA7ZT0iIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1 cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19naXRodWIuY29t X09wZW5TQ0FQX3NjYXAtMkRzZWN1cml0eS0yRGd1aWRlXyZhbXA7ZD1Dd01GYVEmYW1wO2M9TlJ0 elR6S05hQ0NtaE5fOU4yWUpSLVhyTlUxaHVJZ1lQOTl5RHNFemFKbyZhbXA7cj1wY3d0aEZMU0li MUZ5UFBRTDdYWGtUZWNvZEt6RzZNUjNuSm83UVZFcm4wJmFtcDttPVB0aGxsWWhoSkpQSkNUb19Z RjZCbkpHYmEwYTh0MVdNSVFNTkpXSmZ2WWsmYW1wO3M9b1ZFWlNRWm5fOEFEQjlvQ1NSV21NU19N N0RSU1NBODI5WTl0MzFiSDVFcyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1 Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS88L2E+PHU+PC91Pjx1PjwvdT48L3A+ CjwvYmxvY2txdW90ZT4KPC9kaXY+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojODg4ODg4Ij48YnI+CjxiciBjbGVhcj0iYWxsIj4KPHNwYW4+PHU+PC91Pjx1PjwvdT48 L3NwYW4+PC9zcGFuPjwvcD4KPGRpdj4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+PC91PsKgPHU+ PC91PjwvcD4KPC9kaXY+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuPjxzcGFuIHN0eWxlPSJj b2xvcjojODg4ODg4Ij4tLSA8L3NwYW4+PHU+PC91Pjx1PjwvdT48L3NwYW4+PC9wPgo8ZGl2Pgo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+QW5kcmV3IFNo ZXdtYWtlcjwvc3Bhbj48dT48L3U+PHU+PC91PjwvcD4KPC9kaXY+CjwvZGl2Pgo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4KLS08YnI+ClNDQVAg U2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1 cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1z ZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19saXN0cy5m ZWRvcmFob3N0ZWQub3JnX2FkbWluX2xpc3RzX3NjYXAtMkRzZWN1cml0eS0yRGd1aWRlLTQwbGlz dHMuZmVkb3JhaG9zdGVkLm9yZyZhbXA7ZD1Dd01GYVEmYW1wO2M9TlJ0elR6S05hQ0NtaE5fOU4y WUpSLVhyTlUxaHVJZ1lQOTl5RHNFemFKbyZhbXA7cj1wY3d0aEZMU0liMUZ5UFBRTDdYWGtUZWNv ZEt6RzZNUjNuSm83UVZFcm4wJmFtcDttPVB0aGxsWWhoSkpQSkNUb19ZRjZCbkpHYmEwYTh0MVdN SVFNTkpXSmZ2WWsmYW1wO3M9TDdVSXd3V29QcVdXQzQ5ZnRhQmhCSkY4enFUdlhuUUdRWThGb2Jj SzRGZyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5v cmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn PC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHBzLTNBX19naXRodWIuY29tX09wZW5TQ0FQX3NjYXAtMkRzZWN1cml0eS0yRGd1aWRl XyZhbXA7ZD1Dd01GYVEmYW1wO2M9TlJ0elR6S05hQ0NtaE5fOU4yWUpSLVhyTlUxaHVJZ1lQOTl5 RHNFemFKbyZhbXA7cj1wY3d0aEZMU0liMUZ5UFBRTDdYWGtUZWNvZEt6RzZNUjNuSm83UVZFcm4w JmFtcDttPVB0aGxsWWhoSkpQSkNUb19ZRjZCbkpHYmEwYTh0MVdNSVFNTkpXSmZ2WWsmYW1wO3M9 b1ZFWlNRWm5fOEFEQjlvQ1NSV21NU19NN0RSU1NBODI5WTl0MzFiSDVFcyZhbXA7ZT0iIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlk ZS88L2E+PHU+PC91Pjx1PjwvdT48L3A+CjwvYmxvY2txdW90ZT4KPC9kaXY+CjxwIGNsYXNzPSJN c29Ob3JtYWwiPjx1PjwvdT7CoDx1PjwvdT48L3A+CjwvZGl2Pgo8L2Rpdj48L2Rpdj48L2Rpdj4K CjxkaXY+CkNPTkZJREVOVElBTElUWSBOT1RJQ0UgVGhpcyBtZXNzYWdlIGFuZCBhbnkgaW5jbHVk ZWQgYXR0YWNobWVudHMgYXJlIGZyb20gQ2VybmVyIENvcnBvcmF0aW9uIGFuZCBhcmUgaW50ZW5k ZWQgb25seSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0 aGlzIG1lc3NhZ2UgaXMgY29uZmlkZW50aWFsIGFuZCBtYXkgY29uc3RpdHV0ZSBpbnNpZGUgb3Ig bm9uLXB1YmxpYyBpbmZvcm1hdGlvbiB1bmRlciBpbnRlcm5hdGlvbmFsLCBmZWRlcmFsLCBvciBz dGF0ZSBzZWN1cml0aWVzIGxhd3MuIFVuYXV0aG9yaXplZCBmb3J3YXJkaW5nLCBwcmludGluZywg Y29weWluZywgZGlzdHJpYnV0aW9uLCBvciB1c2Ugb2Ygc3VjaCBpbmZvcm1hdGlvbiBpcyBzdHJp Y3RseSBwcm9oaWJpdGVkIGFuZCBtYXkgYmUgdW5sYXdmdWwuIElmIHlvdSBhcmUgbm90IHRoZSBh ZGRyZXNzZWUsIHBsZWFzZSBwcm9tcHRseSBkZWxldGUgdGhpcyBtZXNzYWdlIGFuZCBub3RpZnkg dGhlIHNlbmRlciBvZiB0aGUgZGVsaXZlcnkgZXJyb3IgYnkgZS1tYWlsIG9yIHlvdSBtYXkgY2Fs bCBDZXJuZXImIzM5O3MgY29ycG9yYXRlIG9mZmljZXMgaW4gS2Fuc2FzIENpdHksIE1pc3NvdXJp LCBVLlMuQSBhdCA8YSBocmVmPSJ0ZWw6JTI4JTJCMSUyOSUyMCUyODgxNiUyOTIyMS0xMDI0IiB2 YWx1ZT0iKzE4MTYyMjExMDI0IiB0YXJnZXQ9Il9ibGFuayI+KCsxKSAoODE2KTIyMS0xMDI0PC9h Pi48YnI+CjwvZGl2PjwvZGl2PgoKPGJyPi0tPGJyPgpTQ0FQIFNlY3VyaXR5IEd1aWRlIG1haWxp bmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZyI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn PC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xp c3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgcmVsPSJub3Jl ZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2Fk bWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48 YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1 aWRlLyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29t L09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9hPjxicj4KPGJyPjwvYmxvY2txdW90ZT48 L2Rpdj48YnI+PC9kaXY+Cg== --===============0415080695130622532==-- From redhatrises at gmail.com Wed Jun 8 18:12:30 2016 Content-Type: multipart/mixed; boundary="===============4028741505052918602==" MIME-Version: 1.0 From: Gabe Alford To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 12:12:10 -0600 Message-ID: In-Reply-To: CAB6RzTtCtZsYNBXGtGiFav_LUcUmSROLtizW=V0ESf2Yo3=1xA@mail.gmail.com --===============4028741505052918602== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Rodolfo, What about this? /etc/passwd ^([^:]+):[^:]+:([5-9][\d][\d]|[1-9][\d]{3,}):[\d]+:[^:]*:[^:]+:[^:]*= $ 1 Is that what you are after? It should get the usernames that are greater than or equal to 500. Gabe On Wed, Jun 8, 2016 at 10:32 AM, Rodolfo Mart=C3=ADnez = wrote: > Hi Gabe, > > Yes, I am more familiar with OVAL syntax now and I understand why it is > not working. > > The problem in my OVAL test is in this part: > > version=3D"1"> > /etc/passwd > match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ > datatype=3D"int">1 > state_at_system_accounts_etc_passwd > > > version=3D"1"> > /etc/passwd > match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ > datatype=3D"int">1 > datatype=3D"int">500 > > > > '' in block in'' is > getting the subexpression pattern from '' > which contains the username; so comparing a username to be an integer > 'greater or equal to 500' is not valid. > > > My question is much simpler now: > > How can get all usernames from /etc/passwd that have UID greater or equal > to 500 without using password_object? I have been trying to do this for > many days now without any luck. > > Thanks for your time > > -- > Rodolfo Mart=C3=ADnez > > On Tue, Jun 7, 2016 at 1:03 PM, Gabe Alford wro= te: > >> Hello Rodolfo, >> >> I just did a quick glance as I currently don't have the cycles to look >> into this but the "state_at_system_accounts_at_allow_uid" exclude filter= is >> where this is not working. It is not filtering UIDs greater than 1 or 500 >> for that matter. >> Specifically this subexpression is what is failing: >> >> > datatype=3D"int">500 >> >> Gabe >> >> On Thu, Jun 2, 2016 at 8:52 PM, Rodolfo Mart=C3=ADnez >> wrote: >> >>> Hi mpreisler, >>> >>> Thanks for you suggestion in IRC. >>> >>> This what I have so far, but it is still not working. I feel I am close, >>> but it is not working yet. I would appreciate any suggestion >>> >>> >>> >>> >>> No system accounts in /etc/at.allow >>> >>> CentOS 5 >>> Red Hat Enterprise Linux 5 >>> >>> Group owner for /etc/at.allow and /etc/at.deny must >>> exist. >>> >>> >>> >>> >>> >>> >>> >>> >> comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >>> >> object_ref=3D"object_at_system_accounts_allow_list" /> >>> >>> >>> >> id=3D"object_at_system_accounts_allow_list" version=3D"1"> >>> /etc/passwd >>> >> match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ >>> >> datatype=3D"int">1 >>> state_at_system_accounts_etc_passwd >>> >>> >>> >> version=3D"1"> >>> /etc/passwd >>> >> match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ >>> >> datatype=3D"int">1 >>> >> datatype=3D"int">500 >>> >> >>> >>> >>> >>> >> id=3D"test_at_system_accounts_at_allow" comment=3D"Testing /etc/at.allo= w for >>> system accounts" version=3D"1"> >>> >>> >>> >>> >> id=3D"object_at_system_accounts_allow" version=3D"1"> >>> >>> /etc/at.allow >>> ^(.+)$ >>> >> datatype=3D"int">1 >>> >>> >> action=3D"exclude">state_at_system_accounts_at_allow_root >>> >>> >> action=3D"exclude">state_at_system_accounts_at_allow_uid >>> >>> >>> >> id=3D"state_at_system_accounts_at_allow_root" version=3D"1"> >>> root >>> >>> >>> >> version=3D"1"> >>> >> var_check=3D"at least one" /> >>> >>> >>> >>> >>> -- >>> Rodolfo >>> >>> -- >>> Rodolfo Mart=C3=ADnez >>> >>> On Tue, May 31, 2016 at 5:43 PM, Rodolfo Mart=C3=ADnez >>> wrote: >>> >>>> Hi List, >>>> >>>> After many hours playing with SSG and OpenSCAP and not able to do what >>>> I want I need some help. >>>> >>>> Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to >>>> SSG and I am still getting familiar. >>>> >>>> The following OVAL test searches for system accounts (UID < 500) in >>>> /etc/at.allow (I am showing just the relevant parts of >>>> RHEL/5/input/oval/at_system_accounts.xml to explain my problem): >>>> >>>> >>>> >>>> >>>> >>>> >>> comment=3D"Testing system accounts in /etc/at.allow" >>>> id=3D"test_at_system_accounts_at_allow" version=3D"1"> >>>> >>>> >>>> >>>> >>> version=3D"1"> >>>> >>> var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least on= e" >>>> datatype=3D"string" /> >>>> >>> action=3D"include">state_at_system_accounts_at_allow_uid >>>> >>>> >>>> >>> comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >>>> >>> object_ref=3D"object_at_system_accounts_allow_list" /> >>>> >>>> >>>> >>> id=3D"object_at_system_accounts_allow_list" version=3D"1"> >>>> /etc/at.allow >>>> ^(.*)$ >>>> >>> datatype=3D"int">0 >>>> >>>> >>>> >>> version=3D"1"> >>>> 500 >>>> >>>> >>>> >>>> The test above gets the users information from the sources specified >>>> in NSS (/etc/nsswitch.conf) which is correct, however I want to create >>>> a version that uses /etc/passwd directly. Why? We have many >>>> (thousands?) of RHEL 5 based servers with LDAP integration, and many >>>> (thousands?) of accounts in the LDAP servers. >>>> >>>> Simple tests like RHEL/5/input/oval/at_system_accounts.xml and >>>> RHEL/5/input/oval/cron_system_accounts.xml can take hours to run >>>> because they retrieve *all* users information from the LDAP servers >>>> and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. >>>> Also, if we run OpenSCAP (oscap) at the same time in a few servers >>>> they hit the LDAP servers really bad. >>>> >>>> I have been trying to replace password_test and password_object by >>>> textfilecontent54_test and textfilecontent54_object without any luck. >>>> If you want, I can share my at_system_accounts.xml file that I thought >>>> it was going to work. >>>> >>>> I would really appreciate any help or hint? >>>> >>>> >>>> Regards >>>> -- >>>> Rodolfo Mart=C3=ADnez >>>> >>> >>> >>> -- >>> SCAP Security Guide mailing list >>> scap-security-guide(a)lists.fedorahosted.org >>> >>> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.= fedorahosted.org >>> https://github.com/OpenSCAP/scap-security-guide/ >>> >>> >> >> -- >> SCAP Security Guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> >> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.f= edorahosted.org >> https://github.com/OpenSCAP/scap-security-guide/ >> >> > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============4028741505052918602== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdj48ZGl2PkhpIDxmb250IHNpemU9IjIiPlJvZG9sZm8sPGJyPjxi cj48L2ZvbnQ+PC9kaXY+PGZvbnQgc2l6ZT0iMiI+V2hhdCBhYm91dCB0aGlzPzxicj48L2ZvbnQ+ PGJyPjxmb250IHNpemU9IjIiPjxzcGFuIGNsYXNzPSJpbSI+wqAgJmx0O2luZDp0ZXh0ZmlsZWNv bnRlbnQ1NF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19s aXN0JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDtpbmQ6Zmls ZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+wqDCoMKgICZsdDtp bmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteKFteOl0r KTpbXjpdKzooWzUtOV1bXGRdW1xkXXxbMS05XVtcZF17Myx9KTpbXGRdKzpbXjpdKjpbXjpdKzpb XjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVy YXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2lu dCZxdW90OyZndDsxJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxl Y29udGVudDU0X29iamVjdCZndDs8YnI+PC9zcGFuPjxicj48L2ZvbnQ+PC9kaXY+PGRpdj48Zm9u dCBzaXplPSIyIj5JcyB0aGF0IHdoYXQgeW91IGFyZSBhZnRlcj8gSXQgc2hvdWxkIGdldCB0aGUg dXNlcm5hbWVzIHRoYXQgYXJlIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCB0byA1MDAuPGJyPjwvZm9u dD48L2Rpdj48ZGl2Pjxmb250IHNpemU9IjIiPjxicj48L2ZvbnQ+PC9kaXY+PGZvbnQgc2l6ZT0i MiI+R2FiZTwvZm9udD48YnI+PGRpdj48Zm9udCBzaXplPSIyIj48YnI+PGJyPiA8L2ZvbnQ+PC9k aXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9x dW90ZSI+T24gV2VkLCBKdW4gOCwgMjAxNiBhdCAxMDozMiBBTSwgUm9kb2xmbyBNYXJ0w61uZXog PHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxi bG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2Jv cmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgZGlyPSJsdHIi PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZjtmb250LXNpemU6c21hbGwiPkhpIEdhYmUsPGJyPjxicj48L2Rpdj48ZGl2IGNsYXNz PSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9u dC1zaXplOnNtYWxsIj5ZZXMsIEkgYW0gbW9yZSBmYW1pbGlhciB3aXRoIE9WQUwgc3ludGF4IG5v dyBhbmQgSSB1bmRlcnN0YW5kIHdoeSBpdCBpcyBub3Qgd29ya2luZy48YnI+PGJyPjwvZGl2Pjxk aXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1z ZXJpZjtmb250LXNpemU6c21hbGwiPlRoZSBwcm9ibGVtIGluIG15IE9WQUwgdGVzdCBpcyBpbiB0 aGlzIHBhcnQ6PHNwYW4gY2xhc3M9IiI+PGJyPjxicj7CoCAmbHQ7aW5kOnRleHRmaWxlY29udGVu dDU0X29iamVjdCBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3Qm cXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDpmaWxlcGF0 aCZndDsvZXRjL3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpw YXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O14oW146XSspOlte Ol0rOltcZF0rOltcZF0rOlteOl0qOlteOl0rOlteOl0qJCZsdDsvaW5kOnBhdHRlcm4mZ3Q7PGJy PsKgwqDCoCAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3Ig ZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5j ZSZndDs8YnI+wqDCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsmZ3Q7 c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2V0Y19wYXNzd2QmbHQ7L2ZpbHRlciZndDs8YnI+wqAg Jmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj48YnI+wqAgJmx0O2luZDp0 ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNf ZXRjX3Bhc3N3ZCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7 aW5kOmZpbGVwYXRoJmd0Oy9ldGMvcGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPsKgwqDC oCAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7 XlteOl0rOlteOl0rOihbXGRdKyk6W1xkXSs6W146XSo6W146XSs6W146XSokJmx0Oy9pbmQ6cGF0 dGVybiZndDs8YnI+wqDCoMKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0 ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsv aW5kOmluc3RhbmNlJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpzdWJleHByZXNzaW9uIG9wZXJhdGlv bj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1 b3Q7Jmd0OzUwMCZsdDsvaW5kOnN1YmV4cHJlc3Npb24mZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRm aWxlY29udGVudDU0X3N0YXRlJmd0Ozxicj48YnI+PGJyPjwvc3Bhbj48L2Rpdj48ZGl2IGNsYXNz PSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9u dC1zaXplOnNtYWxsIj4mIzM5OyZsdDtpbmQ6c3ViZXhwcmVzc2lvbiZndDsmIzM5OyBpbiBibG9j ayBpbiYjMzk7Jmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0ZSZndDsmIzM5OyBpcyBnZXR0 aW5nIHRoZSBzdWJleHByZXNzaW9uIHBhdHRlcm4gZnJvbSAmIzM5OyZsdDtpbmQ6dGV4dGZpbGVj b250ZW50NTRfb2JqZWN0Jmd0OyYjMzk7IHdoaWNoIGNvbnRhaW5zIHRoZSB1c2VybmFtZTsgc28g Y29tcGFyaW5nIGEgdXNlcm5hbWUgdG8gYmUgYW4gaW50ZWdlciAmIzM5O2dyZWF0ZXIgb3IgZXF1 YWwgdG8gNTAwJiMzOTsgaXMgbm90IHZhbGlkLjxicj48YnI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9 ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250 LXNpemU6c21hbGwiPk15IHF1ZXN0aW9uIGlzIG11Y2ggc2ltcGxlciBub3c6PGJyPjxicj48L2Rp dj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5Ib3cgY2FuIGdldCBhbGwgdXNlcm5hbWVzIGZyb20g L2V0Yy9wYXNzd2QgdGhhdCBoYXZlIFVJRCBncmVhdGVyIG9yIGVxdWFsIHRvIDUwMCB3aXRob3V0 IHVzaW5nIHBhc3N3b3JkX29iamVjdD8gSSBoYXZlIGJlZW4gdHJ5aW5nIHRvIGRvIHRoaXMgZm9y IG1hbnkgZGF5cyBub3cgd2l0aG91dCBhbnkgbHVjay48YnI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9 ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250 LXNpemU6c21hbGwiPlRoYW5rcyBmb3IgeW91ciB0aW1lPGJyPjwvZGl2PjwvZGl2PjxkaXYgY2xh c3M9ImdtYWlsX2V4dHJhIj48YnIgY2xlYXI9ImFsbCI+PGRpdj48ZGl2IGRhdGEtc21hcnRtYWls PSJnbWFpbF9zaWduYXR1cmUiPjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNl cmlmIj48Zm9udCBzaXplPSIyIj4tLTxicj48L2ZvbnQ+PC9kaXY+PGRpdiBzdHlsZT0iZm9udC1m YW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxmb250IHNpemU9IjIiPlJvZG9sZm8gTWFydMOtbmV6 PC9mb250PjwvZGl2PjwvZGl2PjwvZGl2PjxkaXY+PGRpdiBjbGFzcz0iaDUiPgo8YnI+PGRpdiBj bGFzcz0iZ21haWxfcXVvdGUiPk9uIFR1ZSwgSnVuIDcsIDIwMTYgYXQgMTowMyBQTSwgR2FiZSBB bGZvcmQgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cmVkaGF0cmlzZXNAZ21h aWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cmVkaGF0cmlzZXNAZ21haWwuY29tPC9hPiZndDs8L3Nw YW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn aW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4 Ij48ZGl2IGRpcj0ibHRyIj48ZGl2PjxkaXY+PGRpdj5IZWxsbyBSb2RvbGZvLDxicj48YnI+PC9k aXY+SSBqdXN0IGRpZCBhIHF1aWNrIGdsYW5jZSBhcyBJIGN1cnJlbnRseSBkb24mIzM5O3QgaGF2 ZSB0aGUgY3ljbGVzIHRvIGxvb2sgaW50byB0aGlzIGJ1dCB0aGUgJnF1b3Q7c3RhdGVfYXRfc3lz dGVtX2FjY291bnRzX2F0X2FsbG93X3VpZCZxdW90OyBleGNsdWRlIGZpbHRlciBpcyB3aGVyZSB0 aGlzIGlzIG5vdCB3b3JraW5nLiBJdCBpcyBub3QgZmlsdGVyaW5nIFVJRHMgZ3JlYXRlciB0aGFu IDEgb3IgNTAwIGZvciB0aGF0IG1hdHRlci48YnI+PC9kaXY+U3BlY2lmaWNhbGx5IHRoaXMgc3Vi ZXhwcmVzc2lvbiBpcyB3aGF0IGlzIGZhaWxpbmc6PHNwYW4+PGJyPjxicj4mbHQ7aW5kOnN1YmV4 cHJlc3Npb24gb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRh dHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7NTAwJmx0Oy9pbmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+ PC9zcGFuPjwvZGl2PjxkaXY+PGJyPkdhYmU8YnI+PGRpdj48ZGl2PjxkaXY+PGRpdiBjbGFzcz0i Z21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+PGRpdj48ZGl2Pk9uIFRo dSwgSnVuIDIsIDIwMTYgYXQgODo1MiBQTSwgUm9kb2xmbyBNYXJ0w61uZXogPHNwYW4gZGlyPSJs dHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsi PnJtdHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNs YXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDtib3JkZXIt bGVmdDoxcHggc29saWQgcmdiKDIwNCwyMDQsMjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2IGRp cj0ibHRyIj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNp emU6c21hbGwiPkhpIG1wcmVpc2xlciw8YnI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhhbmtzIGZvciB5b3Ugc3Vn Z2VzdGlvbiBpbiBJUkMuPGJyPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPlRoaXMgd2hhdCBJIGhhdmUgc28gZmFyLCBi dXQgaXQgaXMgc3RpbGwgbm90IHdvcmtpbmcuIEkgZmVlbCBJIGFtIGNsb3NlLCBidXQgaXQgaXMg bm90IHdvcmtpbmcgeWV0LiBJIHdvdWxkIGFwcHJlY2lhdGUgYW55IHN1Z2dlc3Rpb248YnI+PGJy PiZsdDtkZWYtZ3JvdXAmZ3Q7PGJyPsKgICZsdDtkZWZpbml0aW9uIGNsYXNzPSZxdW90O2NvbXBs aWFuY2UmcXVvdDsgaWQ9JnF1b3Q7YXRfc3lzdGVtX2FjY291bnRzJnF1b3Q7IHZlcnNpb249JnF1 b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDttZXRhZGF0YSZndDs8YnI+wqDCoMKgwqDCoCAm bHQ7dGl0bGUmZ3Q7Tm8gc3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQuYWxsb3cmbHQ7L3RpdGxl Jmd0Ozxicj7CoMKgwqDCoMKgICZsdDthZmZlY3RlZCBmYW1pbHk9JnF1b3Q7dW5peCZxdW90OyZn dDs8YnI+wqDCoMKgwqDCoMKgwqAgJmx0O3BsYXRmb3JtJmd0O0NlbnRPUyA1Jmx0Oy9wbGF0Zm9y bSZndDs8YnI+wqDCoMKgwqDCoMKgwqAgJmx0O3BsYXRmb3JtJmd0O1JlZCBIYXQgRW50ZXJwcmlz ZSBMaW51eCA1Jmx0Oy9wbGF0Zm9ybSZndDs8YnI+wqDCoMKgwqDCoCAmbHQ7L2FmZmVjdGVkJmd0 Ozxicj7CoMKgwqDCoMKgICZsdDtkZXNjcmlwdGlvbiZndDtHcm91cCBvd25lciBmb3IgL2V0Yy9h dC5hbGxvdyBhbmQgL2V0Yy9hdC5kZW55IG11c3QgZXhpc3QuJmx0Oy9kZXNjcmlwdGlvbiZndDs8 YnI+wqDCoMKgICZsdDsvbWV0YWRhdGEmZ3Q7PGJyPsKgwqDCoCAmbHQ7Y3JpdGVyaWEmZ3Q7PGJy PsKgwqDCoMKgwqAgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X2F0X3N5c3RlbV9h Y2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj7CoMKgwqAgJmx0Oy9jcml0ZXJpYSZndDs8 YnI+wqAgJmx0Oy9kZWZpbml0aW9uJmd0Ozxicj48YnI+wqAgJmx0OyEtLSBUaGlzIHZhcmlhYmxl IHNob3VsZCBnZXQgYWxsIHVzZXJzIGZyb20gL2V0Yy9wYXNzd2QgdGhhdCBoYXMgVUlEICZndDs9 IDUwMCAtLSZndDs8YnI+wqAgJmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSZxdW90O3Zhcl9hdF9zeXN0 ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyBjb21tZW50PSZxdW90O0FjY291bnRzIEFsbG93 ZWQmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90 OyZndDs8YnI+wqDCoMKgICZsdDtvYmplY3RfY29tcG9uZW50IGl0ZW1fZmllbGQ9JnF1b3Q7c3Vi ZXhwcmVzc2lvbiZxdW90OyBvYmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3Vu dHNfYWxsb3dfbGlzdCZxdW90OyAvJmd0Ozxicj7CoCAmbHQ7L2xvY2FsX3ZhcmlhYmxlJmd0Ozxi cj48YnI+wqAgJmx0O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0 X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90 OyZndDs8YnI+wqDCoMKgICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpm aWxlcGF0aCZndDs8YnI+wqDCoMKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0 dGVybiBtYXRjaCZxdW90OyZndDteKFteOl0rKTpbXjpdKzpbXGRdKzpbXGRdKzpbXjpdKjpbXjpd KzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBv cGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90 O2ludCZxdW90OyZndDsxJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7ZmlsdGVy IGFjdGlvbj0mcXVvdDtpbmNsdWRlJnF1b3Q7Jmd0O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19l dGNfcGFzc3dkJmx0Oy9maWx0ZXImZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0 X29iamVjdCZndDs8YnI+PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUgaWQ9 JnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2V0Y19wYXNzd2QmcXVvdDsgdmVyc2lvbj0m cXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL3Bhc3N3 ZCZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlv bj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O15bXjpdKzpbXjpdKzooW1xkXSspOltcZF0r OlteOl0qOlteOl0rOlteOl0qJCZsdDsvaW5kOnBhdHRlcm4mZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5k Omluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0 YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+wqDCoMKg ICZsdDtpbmQ6c3ViZXhwcmVzc2lvbiBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVx dWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDs1MDAmbHQ7L2luZDpzdWJleHBy ZXNzaW9uJmd0Ozxicj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PC9kaXY+PGJsb2Nr cXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4IDAuOGV4 O2JvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmctbGVmdDoxZXgi PjxkaXY+PGRpdj48ZGl2IGRpcj0ibHRyIj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEs c2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0 X3N0YXRlJmd0Ozxicj48YnI+PGJyPsKgICZsdDshLS0gVGVzdCB0byBjaGVjayB0aGF0IHRoZXJl IGlzIG5vIHN5c3RlbSBhY2NvdW50cyBpbiAvZXRjL2F0LmFsbG93IC0tJmd0Ozxicj7CoCAmbHQ7 aW5kOnRleHRmaWxlY29udGVudDU0X3Rlc3QgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4 aXN0ZW5jZT0mcXVvdDtub25lX2V4aXN0JnF1b3Q7IGlkPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2Fj Y291bnRzX2F0X2FsbG93JnF1b3Q7IGNvbW1lbnQ9JnF1b3Q7VGVzdGluZyAvZXRjL2F0LmFsbG93 IGZvciBzeXN0ZW0gYWNjb3VudHMmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7C oMKgwqAgJmx0O2luZDpvYmplY3Qgb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2Fj Y291bnRzX2FsbG93JnF1b3Q7IC8mZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0 X3Rlc3QmZ3Q7PGJyPjxicj7CoCAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBjb21t ZW50PSZxdW90Oy9ldGMvYXQuYWxsb3cmcXVvdDsgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9h Y2NvdW50c19hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAm bHQ7IS0tIEdldCBhbGwgdXNlcnMgZnJvbSAvZXRjL2F0LmFsbG93IC0tJmd0Ozxicj7CoMKgwqAg Jmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2F0LmFsbG93Jmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJy PsKgwqDCoCAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVv dDsmZ3Q7XiguKykkJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+wqDCoMKgICZsdDtpbmQ6aW5zdGFu Y2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0m cXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj7CoMKgwqAgJmx0OyEt LSBFeGNsdWRlIHJvb3QgLS0mZ3Q7PGJyPsKgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtl eGNsdWRlJnF1b3Q7Jmd0O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd19yb290Jmx0 Oy9maWx0ZXImZ3Q7PGJyPsKgwqDCoCAmbHQ7IS0tIEV4Y2x1ZGUgYWxsIHVzZXIgYWNjb3VudHMg LS0mZ3Q7PGJyPsKgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtleGNsdWRlJnF1b3Q7Jmd0 O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmbHQ7L2ZpbHRlciZndDs8YnI+ wqAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj7CoMKgwqAgPGJyPsKg ICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lzdGVt X2FjY291bnRzX2F0X2FsbG93X3Jvb3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxi cj7CoMKgwqAgJmx0O2luZDp0ZXh0Jmd0O3Jvb3QmbHQ7L2luZDp0ZXh0Jmd0Ozxicj7CoCAmbHQ7 L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9zdGF0ZSZndDs8YnI+PGJyPsKgICZsdDt1bml4OnBhc3N3 b3JkX3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQm cXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O3VuaXg6dXNlcm5h bWUgdmFyX3JlZj0mcXVvdDt2YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsg dmFyX2NoZWNrPSZxdW90O2F0IGxlYXN0IG9uZSZxdW90OyAvJmd0Ozxicj7CoCAmbHQ7L3VuaXg6 cGFzc3dvcmRfc3RhdGUmZ3Q7PGJyPjxicj4mbHQ7L2RlZi1ncm91cCZndDs8YnI+PGJyPi0tPGJy PjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6 ZTpzbWFsbCI+Um9kb2xmbzxicj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+ PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGRpdiBkYXRhLXNtYXJ0bWFpbD0iZ21haWxfc2lnbmF0dXJl Ij48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0i MiI+LS08YnI+PC9mb250PjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5z LXNlcmlmIj48Zm9udCBzaXplPSIyIj5Sb2RvbGZvIE1hcnTDrW5lejwvZm9udD48L2Rpdj48L2Rp dj48L2Rpdj4KPGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBUdWUsIE1heSAzMSwgMjAx NiBhdCA1OjQzIFBNLCBSb2RvbGZvIE1hcnTDrW5leiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhy ZWY9Im1haWx0bzpybXR6Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4QGdtYWls LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1 b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xp ZCByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmctbGVmdDoxZXgiPkhpIExpc3QsPGJyPgo8YnI+CkFm dGVyIG1hbnkgaG91cnMgcGxheWluZyB3aXRoIFNTRyBhbmQgT3BlblNDQVAgYW5kIG5vdCBhYmxl IHRvIGRvIHdoYXQ8YnI+Ckkgd2FudCBJIG5lZWQgc29tZSBoZWxwLjxicj4KPGJyPgpGb3JnaXZl IG1lIGlmIEkgdXNlIFNDQVAgb3IgT3BlblNDQVAgdGVybXMgaW5jb3JyZWN0bHksIEkgYW0gbmV3 IHRvPGJyPgpTU0cgYW5kIEkgYW0gc3RpbGwgZ2V0dGluZyBmYW1pbGlhci48YnI+Cjxicj4KVGhl IGZvbGxvd2luZyBPVkFMIHRlc3Qgc2VhcmNoZXMgZm9yIHN5c3RlbSBhY2NvdW50cyAoVUlEICZs dDsgNTAwKSBpbjxicj4KL2V0Yy9hdC5hbGxvdyAoSSBhbSBzaG93aW5nIGp1c3QgdGhlIHJlbGV2 YW50IHBhcnRzIG9mPGJyPgpSSEVMLzUvaW5wdXQvb3ZhbC9hdF9zeXN0ZW1fYWNjb3VudHMueG1s IHRvIGV4cGxhaW4gbXkgcHJvYmxlbSk6PGJyPgo8YnI+CiZsdDtjcml0ZXJpYSZndDs8YnI+CsKg ICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRf YWxsb3cmcXVvdDsgLyZndDs8YnI+CiZsdDsvY3JpdGVyaWEmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4 OnBhc3N3b3JkX3Rlc3QgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVv dDtub25lX2V4aXN0JnF1b3Q7PGJyPgpjb21tZW50PSZxdW90O1Rlc3Rpbmcgc3lzdGVtIGFjY291 bnRzIGluIC9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2Fj Y291bnRzX2F0X2FsbG93JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZs dDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNf YXRfYWxsb3cmcXVvdDsgLyZndDs8YnI+CiZsdDsvdW5peDpwYXNzd29yZF90ZXN0Jmd0Ozxicj4K PGJyPgombHQ7dW5peDpwYXNzd29yZF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9h Y2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAm bHQ7dW5peDp1c2VybmFtZSBvcGVyYXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7PGJyPgp2YXJfcmVm PSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2YXJfY2hlY2s9 JnF1b3Q7YXQgbGVhc3Qgb25lJnF1b3Q7PGJyPgpkYXRhdHlwZT0mcXVvdDtzdHJpbmcmcXVvdDsg LyZndDs8YnI+CsKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsmZ3Q7c3Rh dGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxicj4KJmx0 Oy91bml4OnBhc3N3b3JkX29iamVjdCZndDs8YnI+Cjxicj4KJmx0O2xvY2FsX3ZhcmlhYmxlIGlk PSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90Ozxicj4KY29tbWVu dD0mcXVvdDtBY2NvdW50cyBBbGxvd2VkJnF1b3Q7IGRhdGF0eXBlPSZxdW90O3N0cmluZyZxdW90 OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7b2JqZWN0X2NvbXBvbmVudCBp dGVtX2ZpZWxkPSZxdW90O3N1YmV4cHJlc3Npb24mcXVvdDs8YnI+Cm9iamVjdF9yZWY9JnF1b3Q7 b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7 L2xvY2FsX3ZhcmlhYmxlJmd0Ozxicj4KPGJyPgombHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29i amVjdCBjb21tZW50PSZxdW90Oy9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O29iamVj dF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVv dDsmZ3Q7PGJyPgrCoCAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9ldGMvYXQuYWxsb3cmbHQ7L2luZDpm aWxlcGF0aCZndDs8YnI+CsKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVy biBtYXRjaCZxdW90OyZndDteKC4qKSQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj4KwqAgJmx0O2lu ZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7PGJy PgpkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MCZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj4K Jmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpw YXNzd29yZF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3df dWlkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4OnVzZXJf aWQgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7IG9wZXJhdGlvbj0mcXVvdDtsZXNzIHRoYW4mcXVv dDsmZ3Q7NTAwJmx0Oy91bml4OnVzZXJfaWQmZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfc3Rh dGUmZ3Q7PGJyPgo8YnI+Cjxicj4KVGhlIHRlc3QgYWJvdmUgZ2V0cyB0aGUgdXNlcnMgaW5mb3Jt YXRpb24gZnJvbSB0aGUgc291cmNlcyBzcGVjaWZpZWQ8YnI+CmluIE5TUyAoL2V0Yy9uc3N3aXRj aC5jb25mKSB3aGljaCBpcyBjb3JyZWN0LCBob3dldmVyIEkgd2FudCB0byBjcmVhdGU8YnI+CmEg dmVyc2lvbiB0aGF0IHVzZXMgL2V0Yy9wYXNzd2QgZGlyZWN0bHkuIFdoeT8gV2UgaGF2ZSBtYW55 PGJyPgoodGhvdXNhbmRzPykgb2YgUkhFTCA1IGJhc2VkIHNlcnZlcnMgd2l0aCBMREFQIGludGVn cmF0aW9uLCBhbmQgbWFueTxicj4KKHRob3VzYW5kcz8pIG9mIGFjY291bnRzIGluIHRoZSBMREFQ IHNlcnZlcnMuPGJyPgo8YnI+ClNpbXBsZSB0ZXN0cyBsaWtlIFJIRUwvNS9pbnB1dC9vdmFsL2F0 X3N5c3RlbV9hY2NvdW50cy54bWwgYW5kPGJyPgpSSEVMLzUvaW5wdXQvb3ZhbC9jcm9uX3N5c3Rl bV9hY2NvdW50cy54bWwgY2FuIHRha2UgaG91cnMgdG8gcnVuPGJyPgpiZWNhdXNlIHRoZXkgcmV0 cmlldmUgKmFsbCogdXNlcnMgaW5mb3JtYXRpb24gZnJvbSB0aGUgTERBUCBzZXJ2ZXJzPGJyPgph bmQgdGhleSBkbyBpdCAqZm9yIGVhY2ggZW50cnkqIGluIC9ldGMvYXQuYWxsb3cgYW5kIC9ldGMv Y3Jvbi5hbGxvdy48YnI+CkFsc28sIGlmIHdlIHJ1biBPcGVuU0NBUCAob3NjYXApIGF0IHRoZSBz YW1lIHRpbWUgaW4gYSBmZXcgc2VydmVyczxicj4KdGhleSBoaXQgdGhlIExEQVAgc2VydmVycyBy ZWFsbHkgYmFkLjxicj4KPGJyPgpJIGhhdmUgYmVlbiB0cnlpbmcgdG8gcmVwbGFjZSBwYXNzd29y ZF90ZXN0IGFuZCBwYXNzd29yZF9vYmplY3QgYnk8YnI+CnRleHRmaWxlY29udGVudDU0X3Rlc3Qg YW5kIHRleHRmaWxlY29udGVudDU0X29iamVjdCB3aXRob3V0IGFueSBsdWNrLjxicj4KSWYgeW91 IHdhbnQsIEkgY2FuIHNoYXJlIG15IGF0X3N5c3RlbV9hY2NvdW50cy54bWwgZmlsZSB0aGF0IEkg dGhvdWdodDxicj4KaXQgd2FzIGdvaW5nIHRvIHdvcmsuPGJyPgo8YnI+Ckkgd291bGQgcmVhbGx5 IGFwcHJlY2lhdGUgYW55IGhlbHAgb3IgaGludD88YnI+Cjxicj4KPGJyPgpSZWdhcmRzPHNwYW4+ PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj4KLS08YnI+ClJvZG9sZm8gTWFydMOtbmV6PGJyPgo8 L2ZvbnQ+PC9zcGFuPjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+Cjxicj48L2Rpdj48L2Rp dj48c3Bhbj48Zm9udCBjb2xvcj0iIzg4ODg4OCI+LS08YnI+ClNDQVAgU2VjdXJpdHkgR3VpZGUg bWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0 cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBs aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRv cmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0 cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVu U0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFu ayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9hPjxi cj4KPGJyPjwvZm9udD48L3NwYW4+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj48L2Rpdj48 L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj4KPGJyPi0tPGJyPgpTQ0FQIFNlY3VyaXR5IEd1aWRlIG1h aWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlz dHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmciIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZl ZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3BlblND QVAvc2NhcC1zZWN1cml0eS1ndWlkZS8iIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLzwvYT48YnI+ Cjxicj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2PjwvZGl2PjwvZGl2Pgo8YnI+LS08YnI+ ClNDQVAgU2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2Nh cC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5zY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2xpc3Rz LmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5m ZWRvcmFob3N0ZWQub3JnIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2NhcC1zZWN1cml0eS1ndWlkZUBs aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29t L09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS88 L2E+PGJyPgo8YnI+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4K --===============4028741505052918602==-- From rmtzcx at gmail.com Wed Jun 8 18:51:00 2016 Content-Type: multipart/mixed; boundary="===============1502017585442157382==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 13:50:47 -0500 Message-ID: In-Reply-To: CAGLxfGwqrvuNz4YVE++q=YA1rtbehfsux2v1PS5f8rtua15ZMg@mail.gmail.com --===============1502017585442157382== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable =E2=80=8BHi Gabe. Thanks for your suggestion! I believe it could work! I will do some testing. I will prefix the second subexpression with '?:' to avoid capture and just get the usernames. ^([^:]+):[^:]+:(?:[5-9][\d][\d]|[1-9][\d]{3,}):[\d]+:[^:]*:[^:]+:[^:= ]*$ =E2=80=8BThanks again=E2=80=8B -- Rodolfo Mart=C3=ADnez On Wed, Jun 8, 2016 at 1:12 PM, Gabe Alford wrote: > Hi Rodolfo, > > What about this? > > version=3D"1"> > /etc/passwd > match">^([^:]+):[^:]+:([5-9][\d][\d]|[1-9][\d]{3,}):[\d]+:[^:]*:[^:]+:[^:= ]*$ > datatype=3D"int">1 > > > Is that what you are after? It should get the usernames that are greater > than or equal to 500. > > Gabe > > > > On Wed, Jun 8, 2016 at 10:32 AM, Rodolfo Mart=C3=ADnez > wrote: > >> Hi Gabe, >> >> Yes, I am more familiar with OVAL syntax now and I understand why it is >> not working. >> >> The problem in my OVAL test is in this part: >> >> > version=3D"1"> >> /etc/passwd >> > match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ >> > datatype=3D"int">1 >> state_at_system_accounts_etc_passwd >> >> >> > version=3D"1"> >> /etc/passwd >> > match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ >> > datatype=3D"int">1 >> > datatype=3D"int">500 >> >> >> >> '' in block in'' is >> getting the subexpression pattern from '' >> which contains the username; so comparing a username to be an integer >> 'greater or equal to 500' is not valid. >> >> >> My question is much simpler now: >> >> How can get all usernames from /etc/passwd that have UID greater or equal >> to 500 without using password_object? I have been trying to do this for >> many days now without any luck. >> >> Thanks for your time >> >> -- >> Rodolfo Mart=C3=ADnez >> >> On Tue, Jun 7, 2016 at 1:03 PM, Gabe Alford >> wrote: >> >>> Hello Rodolfo, >>> >>> I just did a quick glance as I currently don't have the cycles to look >>> into this but the "state_at_system_accounts_at_allow_uid" exclude filte= r is >>> where this is not working. It is not filtering UIDs greater than 1 or 5= 00 >>> for that matter. >>> Specifically this subexpression is what is failing: >>> >>> >> datatype=3D"int">500 >>> >>> Gabe >>> >>> On Thu, Jun 2, 2016 at 8:52 PM, Rodolfo Mart=C3=ADnez >>> wrote: >>> >>>> Hi mpreisler, >>>> >>>> Thanks for you suggestion in IRC. >>>> >>>> This what I have so far, but it is still not working. I feel I am >>>> close, but it is not working yet. I would appreciate any suggestion >>>> >>>> >>>> >>>> >>>> No system accounts in /etc/at.allow >>>> >>>> CentOS 5 >>>> Red Hat Enterprise Linux 5 >>>> >>>> Group owner for /etc/at.allow and /etc/at.deny must >>>> exist. >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>> comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >>>> >>> object_ref=3D"object_at_system_accounts_allow_list" /> >>>> >>>> >>>> >>> id=3D"object_at_system_accounts_allow_list" version=3D"1"> >>>> /etc/passwd >>>> >>> match">^([^:]+):[^:]+:[\d]+:[\d]+:[^:]*:[^:]+:[^:]*$ >>>> >>> datatype=3D"int">1 >>>> >>> action=3D"include">state_at_system_accounts_etc_passwd >>>> >>>> >>>> >>> version=3D"1"> >>>> /etc/passwd >>>> >>> match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ >>>> >>> datatype=3D"int">1 >>>> >>> datatype=3D"int">500 >>>> >>> >>>> >>>> >>>> >>>> >>> id=3D"test_at_system_accounts_at_allow" comment=3D"Testing /etc/at.all= ow for >>>> system accounts" version=3D"1"> >>>> >>>> >>>> >>>> >>> id=3D"object_at_system_accounts_allow" version=3D"1"> >>>> >>>> /etc/at.allow >>>> ^(.+)$ >>>> >>> datatype=3D"int">1 >>>> >>>> >>> action=3D"exclude">state_at_system_accounts_at_allow_root >>>> >>>> >>> action=3D"exclude">state_at_system_accounts_at_allow_uid >>>> >>>> >>>> >>> id=3D"state_at_system_accounts_at_allow_root" version=3D"1"> >>>> root >>>> >>>> >>>> >>> version=3D"1"> >>>> >>> var_check=3D"at least one" /> >>>> >>>> >>>> >>>> >>>> -- >>>> Rodolfo >>>> >>>> -- >>>> Rodolfo Mart=C3=ADnez >>>> >>>> On Tue, May 31, 2016 at 5:43 PM, Rodolfo Mart=C3=ADnez >>>> wrote: >>>> >>>>> Hi List, >>>>> >>>>> After many hours playing with SSG and OpenSCAP and not able to do what >>>>> I want I need some help. >>>>> >>>>> Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to >>>>> SSG and I am still getting familiar. >>>>> >>>>> The following OVAL test searches for system accounts (UID < 500) in >>>>> /etc/at.allow (I am showing just the relevant parts of >>>>> RHEL/5/input/oval/at_system_accounts.xml to explain my problem): >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>> comment=3D"Testing system accounts in /etc/at.allow" >>>>> id=3D"test_at_system_accounts_at_allow" version=3D"1"> >>>>> >>>>> >>>>> >>>>> >>>> version=3D"1"> >>>>> >>>> var_ref=3D"var_at_system_accounts_allow_list" var_check=3D"at least o= ne" >>>>> datatype=3D"string" /> >>>>> >>>> action=3D"include">state_at_system_accounts_at_allow_uid >>>>> >>>>> >>>>> >>>> comment=3D"Accounts Allowed" datatype=3D"string" version=3D"1"> >>>>> >>>> object_ref=3D"object_at_system_accounts_allow_list" /> >>>>> >>>>> >>>>> >>>> id=3D"object_at_system_accounts_allow_list" version=3D"1"> >>>>> /etc/at.allow >>>>> ^(.*)$ >>>>> >>>> datatype=3D"int">0 >>>>> >>>>> >>>>> >>>> version=3D"1"> >>>>> 500 >>>>> >>>>> >>>>> >>>>> The test above gets the users information from the sources specified >>>>> in NSS (/etc/nsswitch.conf) which is correct, however I want to create >>>>> a version that uses /etc/passwd directly. Why? We have many >>>>> (thousands?) of RHEL 5 based servers with LDAP integration, and many >>>>> (thousands?) of accounts in the LDAP servers. >>>>> >>>>> Simple tests like RHEL/5/input/oval/at_system_accounts.xml and >>>>> RHEL/5/input/oval/cron_system_accounts.xml can take hours to run >>>>> because they retrieve *all* users information from the LDAP servers >>>>> and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. >>>>> Also, if we run OpenSCAP (oscap) at the same time in a few servers >>>>> they hit the LDAP servers really bad. >>>>> >>>>> I have been trying to replace password_test and password_object by >>>>> textfilecontent54_test and textfilecontent54_object without any luck. >>>>> If you want, I can share my at_system_accounts.xml file that I thought >>>>> it was going to work. >>>>> >>>>> I would really appreciate any help or hint? >>>>> >>>>> >>>>> Regards >>>>> -- >>>>> Rodolfo Mart=C3=ADnez >>>>> >>>> >>>> >>>> -- >>>> SCAP Security Guide mailing list >>>> scap-security-guide(a)lists.fedorahosted.org >>>> >>>> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists= .fedorahosted.org >>>> https://github.com/OpenSCAP/scap-security-guide/ >>>> >>>> >>> >>> -- >>> SCAP Security Guide mailing list >>> scap-security-guide(a)lists.fedorahosted.org >>> >>> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.= fedorahosted.org >>> https://github.com/OpenSCAP/scap-security-guide/ >>> >>> >> >> -- >> SCAP Security Guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> >> https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.f= edorahosted.org >> https://github.com/OpenSCAP/scap-security-guide/ >> >> > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============1502017585442157382== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxkaXYgY2xhc3M9ImdtYWls X2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6 c21hbGw7ZGlzcGxheTppbmxpbmUiPuKAi0hpIEdhYmUuPGJyPjxicj48L2Rpdj48ZGl2IGNsYXNz PSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9u dC1zaXplOnNtYWxsIj5UaGFua3MgZm9yIHlvdXIgc3VnZ2VzdGlvbiEgSSBiZWxpZXZlIGl0IGNv dWxkIHdvcmshIEkgd2lsbCBkbyBzb21lIHRlc3RpbmcuIEkgd2lsbCBwcmVmaXggdGhlIHNlY29u ZCBzdWJleHByZXNzaW9uIHdpdGggJiMzOTs/OiYjMzk7IHRvIGF2b2lkIGNhcHR1cmUgYW5kIGp1 c3QgZ2V0IHRoZSB1c2VybmFtZXMuPGJyPjxicj48Zm9udCBzaXplPSIyIj48c3Bhbj4mbHQ7aW5k OnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XihbXjpdKyk6 W146XSs6KD86WzUtOV1bXGRdW1xkXXxbMS05XVtcZF17Myx9KTpbXGRdKzpbXjpdKjpbXjpdKzpb XjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0OzxzcGFuIGNsYXNzPSJpbSI+PGJyPjwvc3Bhbj48L3Nw YW4+PC9mb250Pjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9u dC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsO2Rpc3BsYXk6aW5saW5l Ij48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5 OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+4oCLVGhhbmtzIGFnYWlu4oCLPC9k aXY+PGJyIGNsZWFyPSJhbGwiPjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfc2lnbmF0dXJlIiBkYXRh LXNtYXJ0bWFpbD0iZ21haWxfc2lnbmF0dXJlIj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+LS08YnI+PC9mb250PjwvZGl2PjxkaXYgc3R5 bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj5Sb2RvbGZv IE1hcnTDrW5lejwvZm9udD48L2Rpdj48L2Rpdj48L2Rpdj4KPGJyPjxkaXYgY2xhc3M9ImdtYWls X3F1b3RlIj5PbiBXZWQsIEp1biA4LCAyMDE2IGF0IDE6MTIgUE0sIEdhYmUgQWxmb3JkIDxzcGFu IGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnJlZGhhdHJpc2VzQGdtYWlsLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPnJlZGhhdHJpc2VzQGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8 YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHgg MHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmct bGVmdDoxZXgiPjxkaXYgZGlyPSJsdHIiPjxkaXY+PGRpdj5IaSA8Zm9udCBzaXplPSIyIj5Sb2Rv bGZvLDxicj48YnI+PC9mb250PjwvZGl2Pjxmb250IHNpemU9IjIiPldoYXQgYWJvdXQgdGhpcz88 YnI+PC9mb250Pjxicj48Zm9udCBzaXplPSIyIj48c3Bhbj48c3BhbiBjbGFzcz0iIj7CoCAmbHQ7 aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2Fj Y291bnRzX2FsbG93X2xpc3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKg wqAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxi cj48L3NwYW4+wqDCoMKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBt YXRjaCZxdW90OyZndDteKFteOl0rKTpbXjpdKzooWzUtOV1bXGRdW1xkXXxbMS05XVtcZF17Myx9 KTpbXGRdKzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0OzxzcGFuIGNsYXNz PSIiPjxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0 aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsxJmx0Oy9pbmQ6 aW5zdGFuY2UmZ3Q7PGJyPjwvc3Bhbj7CoCAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmpl Y3QmZ3Q7PGJyPjwvc3Bhbj48YnI+PC9mb250PjwvZGl2PjxkaXY+PGZvbnQgc2l6ZT0iMiI+SXMg dGhhdCB3aGF0IHlvdSBhcmUgYWZ0ZXI/IEl0IHNob3VsZCBnZXQgdGhlIHVzZXJuYW1lcyB0aGF0 IGFyZSBncmVhdGVyIHRoYW4gb3IgZXF1YWwgdG8gNTAwLjxzcGFuIGNsYXNzPSIiPjxmb250IGNv bG9yPSIjODg4ODg4Ij48YnI+PC9mb250Pjwvc3Bhbj48L2ZvbnQ+PC9kaXY+PHNwYW4gY2xhc3M9 IiI+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxkaXY+PGZvbnQgc2l6ZT0iMiI+PGJyPjwvZm9udD48 L2Rpdj48Zm9udCBzaXplPSIyIj5HYWJlPC9mb250Pjxicj48ZGl2Pjxmb250IHNpemU9IjIiPjxi cj48YnI+IDwvZm9udD48L2Rpdj48L2ZvbnQ+PC9zcGFuPjwvZGl2PjxkaXYgY2xhc3M9IiI+PGRp diBjbGFzcz0iaDUiPjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0iZ21h aWxfcXVvdGUiPk9uIFdlZCwgSnVuIDgsIDIwMTYgYXQgMTA6MzIgQU0sIFJvZG9sZm8gTWFydMOt bmV6IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnJtdHpjeEBnbWFpbC5jb20i IHRhcmdldD0iX2JsYW5rIj5ybXR6Y3hAZ21haWwuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxi cj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MHB4IDBweCAw cHggMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIwNCk7cGFkZGluZy1s ZWZ0OjFleCI+PGRpdiBkaXI9Imx0ciI+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5IaSBHYWJlLDxicj48YnI+PC9kaXY+PGRpdiBzdHls ZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5ZZXMsIEkg YW0gbW9yZSBmYW1pbGlhciB3aXRoIE9WQUwgc3ludGF4IG5vdyBhbmQgSSB1bmRlcnN0YW5kIHdo eSBpdCBpcyBub3Qgd29ya2luZy48YnI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5 OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhlIHByb2JsZW0gaW4gbXkgT1ZB TCB0ZXN0IGlzIGluIHRoaXMgcGFydDo8c3Bhbj48YnI+PGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVj b250ZW50NTRfb2JqZWN0IGlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3df bGlzdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOmZp bGVwYXRoJmd0Oy9ldGMvcGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPsKgwqDCoCAmbHQ7 aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XihbXjpd Kyk6W146XSs6W1xkXSs6W1xkXSs6W146XSo6W146XSs6W146XSokJmx0Oy9pbmQ6cGF0dGVybiZn dDs8YnI+wqDCoMKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhh biBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsvaW5kOmlu c3RhbmNlJmd0Ozxicj7CoMKgwqAgJmx0O2ZpbHRlciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90 OyZndDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfZXRjX3Bhc3N3ZCZsdDsvZmlsdGVyJmd0Ozxi cj7CoCAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QmZ3Q7PGJyPjxicj7CoCAmbHQ7 aW5kOnRleHRmaWxlY29udGVudDU0X3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0X3N5c3RlbV9hY2Nv dW50c19ldGNfcGFzc3dkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKg ICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+ wqDCoMKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90 OyZndDteW146XSs6W146XSs6KFtcZF0rKTpbXGRdKzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2lu ZDpwYXR0ZXJuJmd0Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7 Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsx Jmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnN1YmV4cHJlc3Npb24gb3Bl cmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtp bnQmcXVvdDsmZ3Q7NTAwJmx0Oy9pbmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+wqAgJmx0Oy9pbmQ6 dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7PGJyPjxicj48YnI+PC9zcGFuPjwvZGl2PjxkaXYg c3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+JiMz OTsmbHQ7aW5kOnN1YmV4cHJlc3Npb24mZ3Q7JiMzOTsgaW4gYmxvY2sgaW4mIzM5OyZsdDtpbmQ6 dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7JiMzOTsgaXMgZ2V0dGluZyB0aGUgc3ViZXhwcmVz c2lvbiBwYXR0ZXJuIGZyb20gJiMzOTsmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZn dDsmIzM5OyB3aGljaCBjb250YWlucyB0aGUgdXNlcm5hbWU7IHNvIGNvbXBhcmluZyBhIHVzZXJu YW1lIHRvIGJlIGFuIGludGVnZXIgJiMzOTtncmVhdGVyIG9yIGVxdWFsIHRvIDUwMCYjMzk7IGlz IG5vdCB2YWxpZC48YnI+PGJyPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPk15IHF1ZXN0aW9uIGlzIG11Y2ggc2ltcGxl ciBub3c6PGJyPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1z ZXJpZjtmb250LXNpemU6c21hbGwiPkhvdyBjYW4gZ2V0IGFsbCB1c2VybmFtZXMgZnJvbSAvZXRj L3Bhc3N3ZCB0aGF0IGhhdmUgVUlEIGdyZWF0ZXIgb3IgZXF1YWwgdG8gNTAwIHdpdGhvdXQgdXNp bmcgcGFzc3dvcmRfb2JqZWN0PyBJIGhhdmUgYmVlbiB0cnlpbmcgdG8gZG8gdGhpcyBmb3IgbWFu eSBkYXlzIG5vdyB3aXRob3V0IGFueSBsdWNrLjxicj48YnI+PC9kaXY+PGRpdiBzdHlsZT0iZm9u dC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5UaGFua3MgZm9yIHlv dXIgdGltZTxicj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyIGNsZWFy PSJhbGwiPjxkaXY+PGRpdiBkYXRhLXNtYXJ0bWFpbD0iZ21haWxfc2lnbmF0dXJlIj48ZGl2IHN0 eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+LS08YnI+ PC9mb250PjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48 Zm9udCBzaXplPSIyIj5Sb2RvbGZvIE1hcnTDrW5lejwvZm9udD48L2Rpdj48L2Rpdj48L2Rpdj48 ZGl2PjxkaXY+Cjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gVHVlLCBKdW4gNywgMjAx NiBhdCAxOjAzIFBNLCBHYWJlIEFsZm9yZCA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1h aWx0bzpyZWRoYXRyaXNlc0BnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5yZWRoYXRyaXNlc0Bn bWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFp bF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDtib3JkZXItbGVmdDoxcHgg c29saWQgcmdiKDIwNCwyMDQsMjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2IGRpcj0ibHRyIj48 ZGl2PjxkaXY+PGRpdj5IZWxsbyBSb2RvbGZvLDxicj48YnI+PC9kaXY+SSBqdXN0IGRpZCBhIHF1 aWNrIGdsYW5jZSBhcyBJIGN1cnJlbnRseSBkb24mIzM5O3QgaGF2ZSB0aGUgY3ljbGVzIHRvIGxv b2sgaW50byB0aGlzIGJ1dCB0aGUgJnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2Fs bG93X3VpZCZxdW90OyBleGNsdWRlIGZpbHRlciBpcyB3aGVyZSB0aGlzIGlzIG5vdCB3b3JraW5n LiBJdCBpcyBub3QgZmlsdGVyaW5nIFVJRHMgZ3JlYXRlciB0aGFuIDEgb3IgNTAwIGZvciB0aGF0 IG1hdHRlci48YnI+PC9kaXY+U3BlY2lmaWNhbGx5IHRoaXMgc3ViZXhwcmVzc2lvbiBpcyB3aGF0 IGlzIGZhaWxpbmc6PHNwYW4+PGJyPjxicj4mbHQ7aW5kOnN1YmV4cHJlc3Npb24gb3BlcmF0aW9u PSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVv dDsmZ3Q7NTAwJmx0Oy9pbmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+PC9zcGFuPjwvZGl2PjxkaXY+ PGJyPkdhYmU8YnI+PGRpdj48ZGl2PjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48 ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+PGRpdj48ZGl2Pk9uIFRodSwgSnVuIDIsIDIwMTYgYXQg ODo1MiBQTSwgUm9kb2xmbyBNYXJ0w61uZXogPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJt YWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJtdHpjeEBnbWFpbC5jb208 L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQgcmdi KDIwNCwyMDQsMjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2IGRpcj0ibHRyIj48ZGl2IHN0eWxl PSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPkhpIG1wcmVp c2xlciw8YnI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNl cmlmO2ZvbnQtc2l6ZTpzbWFsbCI+VGhhbmtzIGZvciB5b3Ugc3VnZ2VzdGlvbiBpbiBJUkMuPGJy Pjxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250 LXNpemU6c21hbGwiPlRoaXMgd2hhdCBJIGhhdmUgc28gZmFyLCBidXQgaXQgaXMgc3RpbGwgbm90 IHdvcmtpbmcuIEkgZmVlbCBJIGFtIGNsb3NlLCBidXQgaXQgaXMgbm90IHdvcmtpbmcgeWV0LiBJ IHdvdWxkIGFwcHJlY2lhdGUgYW55IHN1Z2dlc3Rpb248YnI+PGJyPiZsdDtkZWYtZ3JvdXAmZ3Q7 PGJyPsKgICZsdDtkZWZpbml0aW9uIGNsYXNzPSZxdW90O2NvbXBsaWFuY2UmcXVvdDsgaWQ9JnF1 b3Q7YXRfc3lzdGVtX2FjY291bnRzJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+ wqDCoMKgICZsdDttZXRhZGF0YSZndDs8YnI+wqDCoMKgwqDCoCAmbHQ7dGl0bGUmZ3Q7Tm8gc3lz dGVtIGFjY291bnRzIGluIC9ldGMvYXQuYWxsb3cmbHQ7L3RpdGxlJmd0Ozxicj7CoMKgwqDCoMKg ICZsdDthZmZlY3RlZCBmYW1pbHk9JnF1b3Q7dW5peCZxdW90OyZndDs8YnI+wqDCoMKgwqDCoMKg wqAgJmx0O3BsYXRmb3JtJmd0O0NlbnRPUyA1Jmx0Oy9wbGF0Zm9ybSZndDs8YnI+wqDCoMKgwqDC oMKgwqAgJmx0O3BsYXRmb3JtJmd0O1JlZCBIYXQgRW50ZXJwcmlzZSBMaW51eCA1Jmx0Oy9wbGF0 Zm9ybSZndDs8YnI+wqDCoMKgwqDCoCAmbHQ7L2FmZmVjdGVkJmd0Ozxicj7CoMKgwqDCoMKgICZs dDtkZXNjcmlwdGlvbiZndDtHcm91cCBvd25lciBmb3IgL2V0Yy9hdC5hbGxvdyBhbmQgL2V0Yy9h dC5kZW55IG11c3QgZXhpc3QuJmx0Oy9kZXNjcmlwdGlvbiZndDs8YnI+wqDCoMKgICZsdDsvbWV0 YWRhdGEmZ3Q7PGJyPsKgwqDCoCAmbHQ7Y3JpdGVyaWEmZ3Q7PGJyPsKgwqDCoMKgwqAgJmx0O2Ny aXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZx dW90OyAvJmd0Ozxicj7CoMKgwqAgJmx0Oy9jcml0ZXJpYSZndDs8YnI+wqAgJmx0Oy9kZWZpbml0 aW9uJmd0Ozxicj48YnI+wqAgJmx0OyEtLSBUaGlzIHZhcmlhYmxlIHNob3VsZCBnZXQgYWxsIHVz ZXJzIGZyb20gL2V0Yy9wYXNzd2QgdGhhdCBoYXMgVUlEICZndDs9IDUwMCAtLSZndDs8YnI+wqAg Jmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSZxdW90O3Zhcl9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3df bGlzdCZxdW90OyBjb21tZW50PSZxdW90O0FjY291bnRzIEFsbG93ZWQmcXVvdDsgZGF0YXR5cGU9 JnF1b3Q7c3RyaW5nJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZs dDtvYmplY3RfY29tcG9uZW50IGl0ZW1fZmllbGQ9JnF1b3Q7c3ViZXhwcmVzc2lvbiZxdW90OyBv YmplY3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90 OyAvJmd0Ozxicj7CoCAmbHQ7L2xvY2FsX3ZhcmlhYmxlJmd0Ozxicj48YnI+wqAgJmx0O2luZDp0 ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50 c19hbGxvd19saXN0JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZs dDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+wqDC oMKgICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZn dDteKFteOl0rKTpbXjpdKzpbXGRdKzpbXGRdKzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2luZDpw YXR0ZXJuJmd0Ozxicj7CoMKgwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3Jl YXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDsxJmx0 Oy9pbmQ6aW5zdGFuY2UmZ3Q7PGJyPsKgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtpbmNs dWRlJnF1b3Q7Jmd0O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19ldGNfcGFzc3dkJmx0Oy9maWx0 ZXImZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDs8YnI+PGJy PsKgICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lz dGVtX2FjY291bnRzX2V0Y19wYXNzd2QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxi cj7CoMKgwqAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRo Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1h dGNoJnF1b3Q7Jmd0O15bXjpdKzpbXjpdKzooW1xkXSspOltcZF0rOlteOl0qOlteOl0rOlteOl0q JCZsdDsvaW5kOnBhdHRlcm4mZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlv bj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1 b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+wqDCoMKgICZsdDtpbmQ6c3ViZXhwcmVz c2lvbiBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBl PSZxdW90O2ludCZxdW90OyZndDs1MDAmbHQ7L2luZDpzdWJleHByZXNzaW9uJmd0Ozxicj48L2Rp dj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PC9kaXY+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWls X3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBz b2xpZCByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmctbGVmdDoxZXgiPjxkaXY+PGRpdj48ZGl2IGRp cj0ibHRyIj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNp emU6c21hbGwiPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X3N0YXRlJmd0Ozxicj48YnI+ PGJyPsKgICZsdDshLS0gVGVzdCB0byBjaGVjayB0aGF0IHRoZXJlIGlzIG5vIHN5c3RlbSBhY2Nv dW50cyBpbiAvZXRjL2F0LmFsbG93IC0tJmd0Ozxicj7CoCAmbHQ7aW5kOnRleHRmaWxlY29udGVu dDU0X3Rlc3QgY2hlY2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVvdDtub25l X2V4aXN0JnF1b3Q7IGlkPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93JnF1 b3Q7IGNvbW1lbnQ9JnF1b3Q7VGVzdGluZyAvZXRjL2F0LmFsbG93IGZvciBzeXN0ZW0gYWNjb3Vu dHMmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDpvYmpl Y3Qgb2JqZWN0X3JlZj0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93JnF1b3Q7 IC8mZ3Q7PGJyPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVudDU0X3Rlc3QmZ3Q7PGJyPjxicj7C oCAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBjb21tZW50PSZxdW90Oy9ldGMvYXQu YWxsb3cmcXVvdDsgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hbGxvdyZxdW90 OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7IS0tIEdldCBhbGwgdXNl cnMgZnJvbSAvZXRjL2F0LmFsbG93IC0tJmd0Ozxicj7CoMKgwqAgJmx0O2luZDpmaWxlcGF0aCZn dDsvZXRjL2F0LmFsbG93Jmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPsKgwqDCoCAmbHQ7aW5kOnBh dHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XiguKykkJmx0Oy9p bmQ6cGF0dGVybiZndDs8YnI+wqDCoMKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90 O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7 MSZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj7CoMKgwqAgJmx0OyEtLSBFeGNsdWRlIHJvb3QgLS0m Z3Q7PGJyPsKgwqDCoCAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtleGNsdWRlJnF1b3Q7Jmd0O3N0 YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd19yb290Jmx0Oy9maWx0ZXImZ3Q7PGJyPsKg wqDCoCAmbHQ7IS0tIEV4Y2x1ZGUgYWxsIHVzZXIgYWNjb3VudHMgLS0mZ3Q7PGJyPsKgwqDCoCAm bHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtleGNsdWRlJnF1b3Q7Jmd0O3N0YXRlX2F0X3N5c3RlbV9h Y2NvdW50c19hdF9hbGxvd191aWQmbHQ7L2ZpbHRlciZndDs8YnI+wqAgJmx0Oy9pbmQ6dGV4dGZp bGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj7CoMKgwqAgPGJyPsKgICZsdDtpbmQ6dGV4dGZpbGVj b250ZW50NTRfc3RhdGUgaWQ9JnF1b3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93 X3Jvb3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O2luZDp0 ZXh0Jmd0O3Jvb3QmbHQ7L2luZDp0ZXh0Jmd0Ozxicj7CoCAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRl bnQ1NF9zdGF0ZSZndDs8YnI+PGJyPsKgICZsdDt1bml4OnBhc3N3b3JkX3N0YXRlIGlkPSZxdW90 O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmcXVvdDsgdmVyc2lvbj0mcXVv dDsxJnF1b3Q7Jmd0Ozxicj7CoMKgwqAgJmx0O3VuaXg6dXNlcm5hbWUgdmFyX3JlZj0mcXVvdDt2 YXJfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3QmcXVvdDsgdmFyX2NoZWNrPSZxdW90O2F0 IGxlYXN0IG9uZSZxdW90OyAvJmd0Ozxicj7CoCAmbHQ7L3VuaXg6cGFzc3dvcmRfc3RhdGUmZ3Q7 PGJyPjxicj4mbHQ7L2RlZi1ncm91cCZndDs8YnI+PGJyPi0tPGJyPjwvZGl2PjxkaXYgc3R5bGU9 ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+Um9kb2xmbzxi cj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyIGNsZWFyPSJhbGwiPjxk aXY+PGRpdiBkYXRhLXNtYXJ0bWFpbD0iZ21haWxfc2lnbmF0dXJlIj48ZGl2IHN0eWxlPSJmb250 LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+LS08YnI+PC9mb250Pjwv ZGl2PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBzaXpl PSIyIj5Sb2RvbGZvIE1hcnTDrW5lejwvZm9udD48L2Rpdj48L2Rpdj48L2Rpdj4KPGJyPjxkaXYg Y2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBUdWUsIE1heSAzMSwgMjAxNiBhdCA1OjQzIFBNLCBSb2Rv bGZvIE1hcnTDrW5leiA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpybXR6Y3hA Z21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4QGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFu PiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2lu OjBweCAwcHggMHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIwNCwyMDQp O3BhZGRpbmctbGVmdDoxZXgiPkhpIExpc3QsPGJyPgo8YnI+CkFmdGVyIG1hbnkgaG91cnMgcGxh eWluZyB3aXRoIFNTRyBhbmQgT3BlblNDQVAgYW5kIG5vdCBhYmxlIHRvIGRvIHdoYXQ8YnI+Ckkg d2FudCBJIG5lZWQgc29tZSBoZWxwLjxicj4KPGJyPgpGb3JnaXZlIG1lIGlmIEkgdXNlIFNDQVAg b3IgT3BlblNDQVAgdGVybXMgaW5jb3JyZWN0bHksIEkgYW0gbmV3IHRvPGJyPgpTU0cgYW5kIEkg YW0gc3RpbGwgZ2V0dGluZyBmYW1pbGlhci48YnI+Cjxicj4KVGhlIGZvbGxvd2luZyBPVkFMIHRl c3Qgc2VhcmNoZXMgZm9yIHN5c3RlbSBhY2NvdW50cyAoVUlEICZsdDsgNTAwKSBpbjxicj4KL2V0 Yy9hdC5hbGxvdyAoSSBhbSBzaG93aW5nIGp1c3QgdGhlIHJlbGV2YW50IHBhcnRzIG9mPGJyPgpS SEVMLzUvaW5wdXQvb3ZhbC9hdF9zeXN0ZW1fYWNjb3VudHMueG1sIHRvIGV4cGxhaW4gbXkgcHJv YmxlbSk6PGJyPgo8YnI+CiZsdDtjcml0ZXJpYSZndDs8YnI+CsKgICZsdDtjcml0ZXJpb24gdGVz dF9yZWY9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgLyZndDs8 YnI+CiZsdDsvY3JpdGVyaWEmZ3Q7PGJyPgo8YnI+CiZsdDt1bml4OnBhc3N3b3JkX3Rlc3QgY2hl Y2s9JnF1b3Q7YWxsJnF1b3Q7IGNoZWNrX2V4aXN0ZW5jZT0mcXVvdDtub25lX2V4aXN0JnF1b3Q7 PGJyPgpjb21tZW50PSZxdW90O1Rlc3Rpbmcgc3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQuYWxs b3cmcXVvdDs8YnI+CmlkPSZxdW90O3Rlc3RfYXRfc3lzdGVtX2FjY291bnRzX2F0X2FsbG93JnF1 b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4Om9iamVjdCBvYmpl Y3RfcmVmPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgLyZn dDs8YnI+CiZsdDsvdW5peDpwYXNzd29yZF90ZXN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpwYXNz d29yZF9vYmplY3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZx dW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7dW5peDp1c2VybmFtZSBv cGVyYXRpb249JnF1b3Q7ZXF1YWxzJnF1b3Q7PGJyPgp2YXJfcmVmPSZxdW90O3Zhcl9hdF9zeXN0 ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2YXJfY2hlY2s9JnF1b3Q7YXQgbGVhc3Qgb25l JnF1b3Q7PGJyPgpkYXRhdHlwZT0mcXVvdDtzdHJpbmcmcXVvdDsgLyZndDs8YnI+CsKgICZsdDtm aWx0ZXIgYWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291 bnRzX2F0X2FsbG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxicj4KJmx0Oy91bml4OnBhc3N3b3JkX29i amVjdCZndDs8YnI+Cjxicj4KJmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSZxdW90O3Zhcl9hdF9zeXN0 ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90Ozxicj4KY29tbWVudD0mcXVvdDtBY2NvdW50cyBB bGxvd2VkJnF1b3Q7IGRhdGF0eXBlPSZxdW90O3N0cmluZyZxdW90OyB2ZXJzaW9uPSZxdW90OzEm cXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7b2JqZWN0X2NvbXBvbmVudCBpdGVtX2ZpZWxkPSZxdW90O3N1 YmV4cHJlc3Npb24mcXVvdDs8YnI+Cm9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9h Y2NvdW50c19hbGxvd19saXN0JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L2xvY2FsX3ZhcmlhYmxlJmd0 Ozxicj4KPGJyPgombHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBjb21tZW50PSZxdW90 Oy9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3Vu dHNfYWxsb3dfbGlzdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgrCoCAmbHQ7 aW5kOmZpbGVwYXRoJmd0Oy9ldGMvYXQuYWxsb3cmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+CsKg ICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDte KC4qKSQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj4KwqAgJmx0O2luZDppbnN0YW5jZSBvcGVyYXRp b249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7PGJyPgpkYXRhdHlwZT0mcXVvdDtp bnQmcXVvdDsmZ3Q7MCZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj4KJmx0Oy9pbmQ6dGV4dGZpbGVj b250ZW50NTRfb2JqZWN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpwYXNzd29yZF9zdGF0ZSBpZD0m cXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3dfdWlkJnF1b3Q7IHZlcnNpb249 JnF1b3Q7MSZxdW90OyZndDs8YnI+CsKgICZsdDt1bml4OnVzZXJfaWQgZGF0YXR5cGU9JnF1b3Q7 aW50JnF1b3Q7IG9wZXJhdGlvbj0mcXVvdDtsZXNzIHRoYW4mcXVvdDsmZ3Q7NTAwJmx0Oy91bml4 OnVzZXJfaWQmZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfc3RhdGUmZ3Q7PGJyPgo8YnI+Cjxi cj4KVGhlIHRlc3QgYWJvdmUgZ2V0cyB0aGUgdXNlcnMgaW5mb3JtYXRpb24gZnJvbSB0aGUgc291 cmNlcyBzcGVjaWZpZWQ8YnI+CmluIE5TUyAoL2V0Yy9uc3N3aXRjaC5jb25mKSB3aGljaCBpcyBj b3JyZWN0LCBob3dldmVyIEkgd2FudCB0byBjcmVhdGU8YnI+CmEgdmVyc2lvbiB0aGF0IHVzZXMg L2V0Yy9wYXNzd2QgZGlyZWN0bHkuIFdoeT8gV2UgaGF2ZSBtYW55PGJyPgoodGhvdXNhbmRzPykg b2YgUkhFTCA1IGJhc2VkIHNlcnZlcnMgd2l0aCBMREFQIGludGVncmF0aW9uLCBhbmQgbWFueTxi cj4KKHRob3VzYW5kcz8pIG9mIGFjY291bnRzIGluIHRoZSBMREFQIHNlcnZlcnMuPGJyPgo8YnI+ ClNpbXBsZSB0ZXN0cyBsaWtlIFJIRUwvNS9pbnB1dC9vdmFsL2F0X3N5c3RlbV9hY2NvdW50cy54 bWwgYW5kPGJyPgpSSEVMLzUvaW5wdXQvb3ZhbC9jcm9uX3N5c3RlbV9hY2NvdW50cy54bWwgY2Fu IHRha2UgaG91cnMgdG8gcnVuPGJyPgpiZWNhdXNlIHRoZXkgcmV0cmlldmUgKmFsbCogdXNlcnMg aW5mb3JtYXRpb24gZnJvbSB0aGUgTERBUCBzZXJ2ZXJzPGJyPgphbmQgdGhleSBkbyBpdCAqZm9y IGVhY2ggZW50cnkqIGluIC9ldGMvYXQuYWxsb3cgYW5kIC9ldGMvY3Jvbi5hbGxvdy48YnI+CkFs c28sIGlmIHdlIHJ1biBPcGVuU0NBUCAob3NjYXApIGF0IHRoZSBzYW1lIHRpbWUgaW4gYSBmZXcg c2VydmVyczxicj4KdGhleSBoaXQgdGhlIExEQVAgc2VydmVycyByZWFsbHkgYmFkLjxicj4KPGJy PgpJIGhhdmUgYmVlbiB0cnlpbmcgdG8gcmVwbGFjZSBwYXNzd29yZF90ZXN0IGFuZCBwYXNzd29y ZF9vYmplY3QgYnk8YnI+CnRleHRmaWxlY29udGVudDU0X3Rlc3QgYW5kIHRleHRmaWxlY29udGVu dDU0X29iamVjdCB3aXRob3V0IGFueSBsdWNrLjxicj4KSWYgeW91IHdhbnQsIEkgY2FuIHNoYXJl IG15IGF0X3N5c3RlbV9hY2NvdW50cy54bWwgZmlsZSB0aGF0IEkgdGhvdWdodDxicj4KaXQgd2Fz IGdvaW5nIHRvIHdvcmsuPGJyPgo8YnI+Ckkgd291bGQgcmVhbGx5IGFwcHJlY2lhdGUgYW55IGhl bHAgb3IgaGludD88YnI+Cjxicj4KPGJyPgpSZWdhcmRzPHNwYW4+PGZvbnQgY29sb3I9IiM4ODg4 ODgiPjxicj4KLS08YnI+ClJvZG9sZm8gTWFydMOtbmV6PGJyPgo8L2ZvbnQ+PC9zcGFuPjwvYmxv Y2txdW90ZT48L2Rpdj48YnI+PC9kaXY+Cjxicj48L2Rpdj48L2Rpdj48c3Bhbj48Zm9udCBjb2xv cj0iIzg4ODg4OCI+LS08YnI+ClNDQVAgU2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8 YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn IiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQu b3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWlu L2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgcmVsPSJu b3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3Jn L2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwv YT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5 LWd1aWRlLyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIu Y29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9hPjxicj4KPGJyPjwvZm9udD48L3Nw YW4+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48 L2Rpdj4KPGJyPi0tPGJyPgpTQ0FQIFNlY3VyaXR5IEd1aWRlIG1haWxpbmcgbGlzdDxicj4KPGEg aHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hZG1pbi9s aXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIHJlbD0ibm9y ZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9h ZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ PGJyPgo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1n dWlkZS8iIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNv bS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLzwvYT48YnI+Cjxicj48L2Jsb2NrcXVvdGU+ PC9kaXY+PGJyPjwvZGl2PjwvZGl2PjwvZGl2Pgo8YnI+LS08YnI+ClNDQVAgU2VjdXJpdHkgR3Vp ZGUgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2NhcC1zZWN1cml0eS1ndWlkZUBs aXN0cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+c2NhcC1zZWN1cml0eS1ndWlk ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9saXN0cy5m ZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9s aXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJpdHktZ3VpZGVAbGlz dHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9P cGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9h Pjxicj4KPGJyPjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+CjwvZGl2PjwvZGl2Pjxicj4t LTxicj4KU0NBUCBTZWN1cml0eSBHdWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0 bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJp dHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8v bGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxp c3RzLmZlZG9yYWhvc3RlZC5vcmciIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2dpdGh1 Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS8iIHJlbD0ibm9yZWZlcnJlciIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1 aWRlLzwvYT48YnI+Cjxicj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2PjwvZGl2Pgo= --===============1502017585442157382==-- From Brent.Kimberley at Durham.ca Wed Jun 8 20:15:06 2016 Content-Type: multipart/mixed; boundary="===============1137311561033547242==" MIME-Version: 1.0 From: Brent Kimberley To: scap-security-guide at lists.fedorahosted.org Subject: RE: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 20:14:53 +0000 Message-ID: <7DB89AC54DA85B40923B4374126FF07C07ACA17C@exmb01.region.durham.local> In-Reply-To: CAB6RzTtCtZsYNBXGtGiFav_LUcUmSROLtizW=V0ESf2Yo3=1xA@mail.gmail.com --===============1137311561033547242== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable awk -F : '$3 > 500 {print $1}' /etc/passwd https://www.gnu.org/software/gawk/manual/html_node/Passwd-Functions.html From: Rodolfo Mart=C3=ADnez [mailto:rmtzcx(a)gmail.com] My question is much simpler now: How can get all usernames from /etc/passwd that have UID greater or equal t= o 500 without using password_object? I have been trying to do this for many= days now without any luck. Thanks for your time THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTA= IN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT= FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any p= rivilege have been waived. If you are not the intended recipient, you are h= ereby notified that any review, retransmission, dissemination, distribution= , copying, conversion to hard copy, taking of action in reliance on or othe= r use of this communication is strictly prohibited. If you are not the inte= nded recipient and have received this message in error, please notify me by= return e-mail and delete or destroy all copies of this message. --===============1137311561033547242== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLmhv ZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5hd2sgLUYgOiAnJDMgJmd0OyA1MDAge3ByaW50ICQx fScgL2V0Yy9wYXNzd2Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi Pmh0dHBzOi8vd3d3LmdudS5vcmcvc29mdHdhcmUvZ2F3ay9tYW51YWwvaHRtbF9ub2RlL1Bhc3N3 ZC1GdW5jdGlvbnMuaHRtbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ IFJvZG9sZm8gTWFydMOtbmV6IFttYWlsdG86cm10emN4QGdtYWlsLmNvbV0NCjxicj4NCjxicj4N CjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPk15IHF1ZXN0aW9uIGlzIG11Y2ggc2ltcGxl ciBub3c6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPkhvdyBjYW4gZ2V0IGFsbCB1c2Vy bmFtZXMgZnJvbSAvZXRjL3Bhc3N3ZCB0aGF0IGhhdmUgVUlEIGdyZWF0ZXIgb3IgZXF1YWwgdG8g NTAwIHdpdGhvdXQgdXNpbmcgcGFzc3dvcmRfb2JqZWN0PyBJIGhhdmUgYmVlbiB0cnlpbmcgdG8g ZG8gdGhpcyBmb3IgbWFueSBkYXlzIG5vdyB3aXRob3V0DQogYW55IGx1Y2suPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5UaGFua3MgZm9y IHlvdXIgdGltZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQpUSElTIE1FU1NBR0UgSVMgRk9SIFRIRSBVU0UgT0YgVEhFIElOVEVOREVEIFJFQ0lQSUVOVChT KSBPTkxZIEFORCBNQVkgQ09OVEFJTiBJTkZPUk1BVElPTiBUSEFUIElTIFBSSVZJTEVHRUQsIFBS T1BSSUVUQVJZLCBDT05GSURFTlRJQUwsIEFORC9PUiBFWEVNUFQgRlJPTSBESVNDTE9TVVJFIFVO REVSIEFOWSBSRUxFVkFOVCBQUklWQUNZIExFR0lTTEFUSU9OLiBObyByaWdodHMgdG8gYW55IHBy aXZpbGVnZSBoYXZlIGJlZW4gd2FpdmVkLiBJZiB5b3UNCiBhcmUgbm90IHRoZSBpbnRlbmRlZCBy ZWNpcGllbnQsIHlvdSBhcmUgaGVyZWJ5IG5vdGlmaWVkIHRoYXQgYW55IHJldmlldywgcmV0cmFu c21pc3Npb24sIGRpc3NlbWluYXRpb24sIGRpc3RyaWJ1dGlvbiwgY29weWluZywgY29udmVyc2lv biB0byBoYXJkIGNvcHksIHRha2luZyBvZiBhY3Rpb24gaW4gcmVsaWFuY2Ugb24gb3Igb3RoZXIg dXNlIG9mIHRoaXMgY29tbXVuaWNhdGlvbiBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLiBJZiB5b3Ug YXJlIG5vdA0KIHRoZSBpbnRlbmRlZCByZWNpcGllbnQgYW5kIGhhdmUgcmVjZWl2ZWQgdGhpcyBt ZXNzYWdlIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IG1lIGJ5IHJldHVybiBlLW1haWwgYW5kIGRl bGV0ZSBvciBkZXN0cm95IGFsbCBjb3BpZXMgb2YgdGhpcyBtZXNzYWdlLg0KPC9ib2R5Pg0KPC9o dG1sPg0K --===============1137311561033547242==-- From Brent.Kimberley at Durham.ca Wed Jun 8 20:18:23 2016 Content-Type: multipart/mixed; boundary="===============0921710204894264544==" MIME-Version: 1.0 From: Brent Kimberley To: scap-security-guide at lists.fedorahosted.org Subject: RE: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 20:18:11 +0000 Message-ID: <7DB89AC54DA85B40923B4374126FF07C07ACA19A@exmb01.region.durham.local> In-Reply-To: 7DB89AC54DA85B40923B4374126FF07C07ACA17C@exmb01.region.durham.local --===============0921710204894264544== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable awk -F : '$3 >=3D 500 {print $1}' /etc/passwd Works as well ;-) From: Brent Kimberley From: Rodolfo Mart=C3=ADnez [mailto:rmtzcx(a)gmail.com] My question is much simpler now: How can get all usernames from /etc/passwd that have UID greater or equal t= o 500 without using password_object? I have been trying to do this for many= days now without any luck. Thanks for your time THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTA= IN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT= FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any p= rivilege have been waived. If you are not the intended recipient, you are h= ereby notified that any review, retransmission, dissemination, distribution= , copying, conversion to hard copy, taking of action in reliance on or othe= r use of this communication is strictly prohibited. If you are not the inte= nded recipient and have received this message in error, please notify me by= return e-mail and delete or destroy all copies of this message. --===============0921710204894264544== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLmhv ZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5 Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDld Pjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0K PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91 dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpz aGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVT IiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+YXdr IC1GIDogJyQzICZndDs9IDUwMCB7cHJpbnQgJDF9JyAvZXRjL3Bhc3N3ZA0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5Xb3JrcyBhcyB3ZWxsIDstKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4w cHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQnJlbnQgS2ltYmVybGV5DQo8YnI+ DQo8YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+IFJvZG9sZm8gTWFydMOtbmV6IFs8YSBocmVmPSJtYWlsdG86cm10 emN4QGdtYWlsLmNvbSI+bWFpbHRvOnJtdHpjeEBnbWFpbC5jb208L2E+XQ0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhvbWEm cXVvdDssc2Fucy1zZXJpZiI+TXkgcXVlc3Rpb24gaXMgbXVjaCBzaW1wbGVyIG5vdzo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtU YWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+SG93IGNhbiBnZXQgYWxsIHVzZXJuYW1lcyBmcm9tIC9l dGMvcGFzc3dkIHRoYXQgaGF2ZSBVSUQgZ3JlYXRlciBvciBlcXVhbCB0byA1MDAgd2l0aG91dCB1 c2luZyBwYXNzd29yZF9vYmplY3Q/IEkgaGF2ZSBiZWVuIHRyeWluZyB0byBkbyB0aGlzIGZvciBt YW55IGRheXMgbm93IHdpdGhvdXQNCiBhbnkgbHVjay48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7VGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPlRoYW5rcyBmb3IgeW91ciB0aW1lPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NClRISVMgTUVTU0FH RSBJUyBGT1IgVEhFIFVTRSBPRiBUSEUgSU5URU5ERUQgUkVDSVBJRU5UKFMpIE9OTFkgQU5EIE1B WSBDT05UQUlOIElORk9STUFUSU9OIFRIQVQgSVMgUFJJVklMRUdFRCwgUFJPUFJJRVRBUlksIENP TkZJREVOVElBTCwgQU5EL09SIEVYRU1QVCBGUk9NIERJU0NMT1NVUkUgVU5ERVIgQU5ZIFJFTEVW QU5UIFBSSVZBQ1kgTEVHSVNMQVRJT04uIE5vIHJpZ2h0cyB0byBhbnkgcHJpdmlsZWdlIGhhdmUg YmVlbiB3YWl2ZWQuIElmIHlvdQ0KIGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91 IGFyZSBoZXJlYnkgbm90aWZpZWQgdGhhdCBhbnkgcmV2aWV3LCByZXRyYW5zbWlzc2lvbiwgZGlz c2VtaW5hdGlvbiwgZGlzdHJpYnV0aW9uLCBjb3B5aW5nLCBjb252ZXJzaW9uIHRvIGhhcmQgY29w eSwgdGFraW5nIG9mIGFjdGlvbiBpbiByZWxpYW5jZSBvbiBvciBvdGhlciB1c2Ugb2YgdGhpcyBj b21tdW5pY2F0aW9uIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90DQogdGhl IGludGVuZGVkIHJlY2lwaWVudCBhbmQgaGF2ZSByZWNlaXZlZCB0aGlzIG1lc3NhZ2UgaW4gZXJy b3IsIHBsZWFzZSBub3RpZnkgbWUgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIG9yIGRlc3Ry b3kgYWxsIGNvcGllcyBvZiB0aGlzIG1lc3NhZ2UuDQo8L2JvZHk+DQo8L2h0bWw+DQo= --===============0921710204894264544==-- From rmtzcx at gmail.com Wed Jun 8 20:28:07 2016 Content-Type: multipart/mixed; boundary="===============0299240126287876873==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 15:27:53 -0500 Message-ID: In-Reply-To: 7DB89AC54DA85B40923B4374126FF07C07ACA19A@exmb01.region.durham.local --===============0299240126287876873== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Brent, Thanks for your suggestion, but I am not looking for a bash/awk command. I was looking for an OVAL definition, and with the help of Gabe I was able to do it. -- Rodolfo Mart=C3=ADnez On Wed, Jun 8, 2016 at 3:18 PM, Brent Kimberley wrote: > awk -F : '$3 >=3D 500 {print $1}' /etc/passwd > > > > Works as well ;-) > > > > *From:* Brent Kimberley > > *From:* Rodolfo Mart=C3=ADnez [mailto:rmtzcx(a)gmail.com ] > > My question is much simpler now: > > How can get all usernames from /etc/passwd that have UID greater or equal > to 500 without using password_object? I have been trying to do this for > many days now without any luck. > > Thanks for your time > > > > THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY > CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR > EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights = to > any privilege have been waived. If you are not the intended recipient, you > are hereby notified that any review, retransmission, dissemination, > distribution, copying, conversion to hard copy, taking of action in > reliance on or other use of this communication is strictly prohibited. If > you are not the intended recipient and have received this message in erro= r, > please notify me by return e-mail and delete or destroy all copies of this > message. > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > --===============0299240126287876873== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgQnJlbnQsPGJyPjxicj48 L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21h LHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5UaGFua3MgZm9yIHlvdXIgc3VnZ2VzdGlvbiwg YnV0IEkgYW0gbm90IGxvb2tpbmcgZm9yIGEgYmFzaC9hd2sgY29tbWFuZC4gSSB3YXMgbG9va2lu ZyBmb3IgYW4gT1ZBTCBkZWZpbml0aW9uLCBhbmQgd2l0aCB0aGUgaGVscCBvZiBHYWJlIEkgd2Fz IGFibGUgdG8gZG8gaXQuPGJyPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48 YnIgY2xlYXI9ImFsbCI+PGRpdj48ZGl2IGNsYXNzPSJnbWFpbF9zaWduYXR1cmUiIGRhdGEtc21h cnRtYWlsPSJnbWFpbF9zaWduYXR1cmUiPjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxz YW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj4tLTxicj48L2ZvbnQ+PC9kaXY+PGRpdiBzdHlsZT0i Zm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxmb250IHNpemU9IjIiPlJvZG9sZm8gTWFy dMOtbmV6PC9mb250PjwvZGl2PjwvZGl2PjwvZGl2Pgo8YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVv dGUiPk9uIFdlZCwgSnVuIDgsIDIwMTYgYXQgMzoxOCBQTSwgQnJlbnQgS2ltYmVybGV5IDxzcGFu IGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOkJyZW50LktpbWJlcmxleUBkdXJoYW0uY2Ei IHRhcmdldD0iX2JsYW5rIj5CcmVudC5LaW1iZXJsZXlAZHVyaGFtLmNhPC9hPiZndDs8L3NwYW4+ IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46 MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4K CgoKCgo8ZGl2IGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiIGxhbmc9IkVOLVVTIj4KPGRpdj4K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5N2QiPmF3ayAt RiA6ICYjMzk7JDMgJmd0Oz0gNTAwIHtwcmludCAkMX0mIzM5OyAvZXRjL3Bhc3N3ZAo8dT48L3U+ PHU+PC91Pjwvc3Bhbj48L3A+CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMWY0OTdkIj48dT48L3U+wqA8dT48L3U+PC9zcGFuPjwvcD4KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5N2QiPldvcmtzIGFzIHdlbGwgOy0pPHU+ PC91Pjx1PjwvdT48L3NwYW4+PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFmNDk3ZCI+PHU+PC91PsKgPHU+PC91Pjwvc3Bhbj48L3A+CjxkaXY+CjxkaXYg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI2UxZTFlMSAxLjBwdDtwYWRkaW5n OjMuMHB0IDBpbiAwaW4gMGluIj4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQnJlbnQgS2ltYmVybGV5Cjxi cj4KPGJyPgo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxZjQ5N2QiPjx1PjwvdT48dT48 L3U+PC9zcGFuPjwvcD4KPC9kaXY+CjwvZGl2PjxzcGFuIGNsYXNzPSIiPgo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFJvZG9sZm8gTWFydMOtbmV6IFs8YSBo cmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1haWx0bzpybXR6 Y3hAZ21haWwuY29tPC9hPl0KPHU+PC91Pjx1PjwvdT48L3NwYW4+PC9wPgo8ZGl2Pgo8ZGl2Pgo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+TXkgcXVlc3Rp b24gaXMgbXVjaCBzaW1wbGVyIG5vdzo8dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjwvZGl2Pgo8 ZGl2Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+SG93 IGNhbiBnZXQgYWxsIHVzZXJuYW1lcyBmcm9tIC9ldGMvcGFzc3dkIHRoYXQgaGF2ZSBVSUQgZ3Jl YXRlciBvciBlcXVhbCB0byA1MDAgd2l0aG91dCB1c2luZyBwYXNzd29yZF9vYmplY3Q/IEkgaGF2 ZSBiZWVuIHRyeWluZyB0byBkbyB0aGlzIGZvciBtYW55IGRheXMgbm93IHdpdGhvdXQKIGFueSBs dWNrLjx1PjwvdT48dT48L3U+PC9zcGFuPjwvcD4KPC9kaXY+CjxkaXY+CjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssc2Fucy1z ZXJpZiI+VGhhbmtzIGZvciB5b3VyIHRpbWU8dT48L3U+PHU+PC91Pjwvc3Bhbj48L3A+CjwvZGl2 Pgo8L2Rpdj4KPGRpdj4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyIGNsZWFyPSJhbGwiPgo8dT48 L3U+PHU+PC91PjwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHU+PC91PsKgPHU+PC91PjwvcD4K PC9kaXY+Cjwvc3Bhbj48L2Rpdj48c3BhbiBjbGFzcz0iIj4KVEhJUyBNRVNTQUdFIElTIEZPUiBU SEUgVVNFIE9GIFRIRSBJTlRFTkRFRCBSRUNJUElFTlQoUykgT05MWSBBTkQgTUFZIENPTlRBSU4g SU5GT1JNQVRJT04gVEhBVCBJUyBQUklWSUxFR0VELCBQUk9QUklFVEFSWSwgQ09ORklERU5USUFM LCBBTkQvT1IgRVhFTVBUIEZST00gRElTQ0xPU1VSRSBVTkRFUiBBTlkgUkVMRVZBTlQgUFJJVkFD WSBMRUdJU0xBVElPTi4gTm8gcmlnaHRzIHRvIGFueSBwcml2aWxlZ2UgaGF2ZSBiZWVuIHdhaXZl ZC4gSWYgeW91CiBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHlvdSBhcmUgaGVyZWJ5 IG5vdGlmaWVkIHRoYXQgYW55IHJldmlldywgcmV0cmFuc21pc3Npb24sIGRpc3NlbWluYXRpb24s IGRpc3RyaWJ1dGlvbiwgY29weWluZywgY29udmVyc2lvbiB0byBoYXJkIGNvcHksIHRha2luZyBv ZiBhY3Rpb24gaW4gcmVsaWFuY2Ugb24gb3Igb3RoZXIgdXNlIG9mIHRoaXMgY29tbXVuaWNhdGlv biBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdAogdGhlIGludGVuZGVkIHJl Y2lwaWVudCBhbmQgaGF2ZSByZWNlaXZlZCB0aGlzIG1lc3NhZ2UgaW4gZXJyb3IsIHBsZWFzZSBu b3RpZnkgbWUgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIG9yIGRlc3Ryb3kgYWxsIGNvcGll cyBvZiB0aGlzIG1lc3NhZ2UuCjwvc3Bhbj48L2Rpdj4KCjxicj4tLTxicj4KU0NBUCBTZWN1cml0 eSBHdWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVk Lm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmciIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2Nh cC1zZWN1cml0eS1ndWlkZS8iIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLzwvYT48YnI+Cjxicj48 L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pgo= --===============0299240126287876873==-- From rsanders at forcepoint.com Thu Jun 9 08:59:16 2016 Content-Type: multipart/mixed; boundary="===============5275806459614119073==" MIME-Version: 1.0 From: Robert Sanders To: scap-security-guide at lists.fedorahosted.org Subject: RE: Re: Use /etc/passwd directly instead of sources in NSS Date: Wed, 08 Jun 2016 17:10:02 +0000 Message-ID: <848FB1215E2AD643A5E10D906091D3FB956E72F2@TCSEXCH1.tcs-sec.com> In-Reply-To: CAB6RzTtCtZsYNBXGtGiFav_LUcUmSROLtizW=V0ESf2Yo3=1xA@mail.gmail.com --===============5275806459614119073== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable One extra comment - should the UID of 500 be hardcoded here or should it be= pulled from /etc/login.defs, or the equivalent file for other distros? I k= now the breakpoint between system and regular user ids has changed over the= years. -Rob ________________________________ From: Rodolfo Mart=C3=ADnez [rmtzcx(a)gmail.com] Sent: Wednesday, June 08, 2016 12:32 PM To: SCAP Security Guide Subject: EXTERNAL: Re: Use /etc/passwd directly instead of sources in NSS Hi Gabe, Yes, I am more familiar with OVAL syntax now and I understand why it is not= working. The problem in my OVAL test is in this part: /etc/passwd ^([^:]+):[^:]+:[\d]+:[\d]+:[^:= ]*:[^:]+:[^:]*$ 1 state_at_system_accounts_etc_passwd /etc/passwd ^[^:]+:[^:]+:([\d]+):[\d]+:[^:= ]*:[^:]+:[^:]*$ 1 500 '' in block in'' is getting= the subexpression pattern from '' which cont= ains the username; so comparing a username to be an integer 'greater or equ= al to 500' is not valid. My question is much simpler now: How can get all usernames from /etc/passwd that have UID greater or equal t= o 500 without using password_object? I have been trying to do this for many= days now without any luck. Thanks for your time -- Rodolfo Mart=C3=ADnez On Tue, Jun 7, 2016 at 1:03 PM, Gabe Alford > wrote: Hello Rodolfo, I just did a quick glance as I currently don't have the cycles to look into= this but the "state_at_system_accounts_at_allow_uid" exclude filter is whe= re this is not working. It is not filtering UIDs greater than 1 or 500 for = that matter. Specifically this subexpression is what is failing: 500= Gabe On Thu, Jun 2, 2016 at 8:52 PM, Rodolfo Mart=C3=ADnez > wrote: Hi mpreisler, Thanks for you suggestion in IRC. This what I have so far, but it is still not working. I feel I am close, bu= t it is not working yet. I would appreciate any suggestion No system accounts in /etc/at.allow CentOS 5 Red Hat Enterprise Linux 5 Group owner for /etc/at.allow and /etc/at.deny must exis= t. /etc/passwd ^([^:]+):[^:]+:[\d]+:[\d]+:[^:= ]*:[^:]+:[^:]*$ 1 state_at_system_accounts_etc_passwd /etc/passwd ^[^:]+:[^:]+:([\d]+):[\d]+:[^:= ]*:[^:]+:[^:]*$ 1 500 /etc/at.allow ^(.+)$ 1 state_at_system_accounts_at_allow_root state_at_system_accounts_at_allow_uid root -- Rodolfo -- Rodolfo Mart=C3=ADnez On Tue, May 31, 2016 at 5:43 PM, Rodolfo Mart=C3=ADnez > wrote: Hi List, After many hours playing with SSG and OpenSCAP and not able to do what I want I need some help. Forgive me if I use SCAP or OpenSCAP terms incorrectly, I am new to SSG and I am still getting familiar. The following OVAL test searches for system accounts (UID < 500) in /etc/at.allow (I am showing just the relevant parts of RHEL/5/input/oval/at_system_accounts.xml to explain my problem): state_at_system_accounts_at_allow_uid /etc/at.allow ^(.*)$ 0 500 The test above gets the users information from the sources specified in NSS (/etc/nsswitch.conf) which is correct, however I want to create a version that uses /etc/passwd directly. Why? We have many (thousands?) of RHEL 5 based servers with LDAP integration, and many (thousands?) of accounts in the LDAP servers. Simple tests like RHEL/5/input/oval/at_system_accounts.xml and RHEL/5/input/oval/cron_system_accounts.xml can take hours to run because they retrieve *all* users information from the LDAP servers and they do it *for each entry* in /etc/at.allow and /etc/cron.allow. Also, if we run OpenSCAP (oscap) at the same time in a few servers they hit the LDAP servers really bad. I have been trying to replace password_test and password_object by textfilecontent54_test and textfilecontent54_object without any luck. If you want, I can share my at_system_accounts.xml file that I thought it was going to work. I would really appreciate any help or hint? Regards -- Rodolfo Mart=C3=ADnez -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fedo= rahosted.org https://github.com/OpenSCAP/scap-security-guide/ -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fedo= rahosted.org https://github.com/OpenSCAP/scap-security-guide/ Scanned by Forcepoint Email Security Gateway Click here to report this email as spam --===============5275806459614119073== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgZGlyPSJsdHIiPgo8aGVhZD4KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBj b250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9aXNvLTg4NTktMSI+CjxzdHlsZSBpZD0ib3dhUGFy YVN0eWxlIiB0eXBlPSJ0ZXh0L2NzcyI+UCB7bWFyZ2luLXRvcDowO21hcmdpbi1ib3R0b206MDt9 PC9zdHlsZT4KPC9oZWFkPgo8Ym9keSBvY3NpPSIwIiBmcHN0eWxlPSIxIj4KPGRpdiBzdHlsZT0i ZGlyZWN0aW9uOiBsdHI7Zm9udC1mYW1pbHk6IFRhaG9tYTtjb2xvcjogIzAwMDAwMDtmb250LXNp emU6IDEwcHQ7Ij5PbmUgZXh0cmEgY29tbWVudCAtIHNob3VsZCB0aGUgVUlEIG9mIDUwMCBiZSBo YXJkY29kZWQgaGVyZSBvciBzaG91bGQgaXQgYmUgcHVsbGVkIGZyb20gL2V0Yy9sb2dpbi5kZWZz LCBvciB0aGUgZXF1aXZhbGVudCBmaWxlIGZvciBvdGhlciBkaXN0cm9zPyBJIGtub3cgdGhlIGJy ZWFrcG9pbnQgYmV0d2Vlbgogc3lzdGVtIGFuZCByZWd1bGFyIHVzZXIgaWRzIGhhcyBjaGFuZ2Vk IG92ZXIgdGhlIHllYXJzLiZuYnNwOyA8YnI+Cjxicj4KLVJvYjxicj4KPGJyPgo8ZGl2IHN0eWxl PSJmb250LWZhbWlseTogVGltZXMgTmV3IFJvbWFuOyBjb2xvcjogIzAwMDAwMDsgZm9udC1zaXpl OiAxNnB4Ij4KPGhyIHRhYmluZGV4PSItMSI+CjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRyOyIg aWQ9ImRpdlJwRjcwMjMyOSI+PGZvbnQgY29sb3I9IiMwMDAwMDAiIGZhY2U9IlRhaG9tYSIgc2l6 ZT0iMiI+PGI+RnJvbTo8L2I+IFJvZG9sZm8gTWFydO1uZXogW3JtdHpjeEBnbWFpbC5jb21dPGJy Pgo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBKdW5lIDA4LCAyMDE2IDEyOjMyIFBNPGJyPgo8Yj5U bzo8L2I+IFNDQVAgU2VjdXJpdHkgR3VpZGU8YnI+CjxiPlN1YmplY3Q6PC9iPiBFWFRFUk5BTDog UmU6IFVzZSAvZXRjL3Bhc3N3ZCBkaXJlY3RseSBpbnN0ZWFkIG9mIHNvdXJjZXMgaW4gTlNTPGJy Pgo8L2ZvbnQ+PGJyPgo8L2Rpdj4KPGRpdj48L2Rpdj4KPGRpdj4KPGRpdiBkaXI9Imx0ciI+Cjxk aXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1z ZXJpZjsgZm9udC1zaXplOnNtYWxsIj4KSGkgR2FiZSw8YnI+Cjxicj4KPC9kaXY+CjxkaXYgY2xh c3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjsg Zm9udC1zaXplOnNtYWxsIj4KWWVzLCBJIGFtIG1vcmUgZmFtaWxpYXIgd2l0aCBPVkFMIHN5bnRh eCBub3cgYW5kIEkgdW5kZXJzdGFuZCB3aHkgaXQgaXMgbm90IHdvcmtpbmcuPGJyPgo8YnI+Cjwv ZGl2Pgo8ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21h LHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTpzbWFsbCI+ClRoZSBwcm9ibGVtIGluIG15IE9WQUwgdGVz dCBpcyBpbiB0aGlzIHBhcnQ6PGJyPgo8YnI+CiZuYnNwOyAmbHQ7aW5kOnRleHRmaWxlY29udGVu dDU0X29iamVjdCBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93X2xpc3Qm cXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZs dDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDs8YnI+CiZu YnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9uPSZxdW90O3BhdHRlcm4g bWF0Y2gmcXVvdDsmZ3Q7XihbXjpdJiM0MzspOlteOl0mIzQzOzpbXGRdJiM0Mzs6W1xkXSYjNDM7 OlteOl0qOlteOl0mIzQzOzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0Ozxicj4KJm5ic3A7Jm5i c3A7Jm5ic3A7ICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBv ciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsvaW5kOmluc3Rh bmNlJmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2lu Y2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2V0Y19wYXNzd2QmbHQ7L2Zp bHRlciZndDs8YnI+CiZuYnNwOyAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QmZ3Q7 PGJyPgo8YnI+CiZuYnNwOyAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X3N0YXRlIGlkPSZxdW90 O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19ldGNfcGFzc3dkJnF1b3Q7IHZlcnNpb249JnF1b3Q7 MSZxdW90OyZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5kOmZpbGVwYXRoJmd0Oy9l dGMvcGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPgombmJzcDsmbmJzcDsmbmJzcDsgJmx0 O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O15bXjpd JiM0Mzs6W146XSYjNDM7OihbXGRdJiM0MzspOltcZF0mIzQzOzpbXjpdKjpbXjpdJiM0Mzs6W146 XSokJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5kOmlu c3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5 cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5jZSZndDs8YnI+CiZuYnNwOyZu YnNwOyZuYnNwOyAmbHQ7aW5kOnN1YmV4cHJlc3Npb24gb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIg dGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7NTAwJmx0Oy9p bmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+CiZuYnNwOyAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRlbnQ1 NF9zdGF0ZSZndDs8YnI+Cjxicj4KPGJyPgo8L2Rpdj4KPGRpdiBjbGFzcz0iZ21haWxfZGVmYXVs dCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmOyBmb250LXNpemU6c21hbGwi PgonJmx0O2luZDpzdWJleHByZXNzaW9uJmd0OycgaW4gYmxvY2sgaW4nJmx0O2luZDp0ZXh0Zmls ZWNvbnRlbnQ1NF9zdGF0ZSZndDsnIGlzIGdldHRpbmcgdGhlIHN1YmV4cHJlc3Npb24gcGF0dGVy biBmcm9tICcmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCZndDsnIHdoaWNoIGNvbnRh aW5zIHRoZSB1c2VybmFtZTsgc28gY29tcGFyaW5nIGEgdXNlcm5hbWUgdG8gYmUgYW4gaW50ZWdl ciAnZ3JlYXRlciBvciBlcXVhbCB0byA1MDAnIGlzIG5vdCB2YWxpZC48YnI+Cjxicj4KPGJyPgo8 L2Rpdj4KPGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9t YSxzYW5zLXNlcmlmOyBmb250LXNpemU6c21hbGwiPgpNeSBxdWVzdGlvbiBpcyBtdWNoIHNpbXBs ZXIgbm93Ojxicj4KPGJyPgo8L2Rpdj4KPGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9 ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmOyBmb250LXNpemU6c21hbGwiPgpIb3cgY2Fu IGdldCBhbGwgdXNlcm5hbWVzIGZyb20gL2V0Yy9wYXNzd2QgdGhhdCBoYXZlIFVJRCBncmVhdGVy IG9yIGVxdWFsIHRvIDUwMCB3aXRob3V0IHVzaW5nIHBhc3N3b3JkX29iamVjdD8gSSBoYXZlIGJl ZW4gdHJ5aW5nIHRvIGRvIHRoaXMgZm9yIG1hbnkgZGF5cyBub3cgd2l0aG91dCBhbnkgbHVjay48 YnI+Cjxicj4KPC9kaXY+CjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZh bWlseTp0YWhvbWEsc2Fucy1zZXJpZjsgZm9udC1zaXplOnNtYWxsIj4KVGhhbmtzIGZvciB5b3Vy IHRpbWU8YnI+CjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxiciBjbGVh cj0iYWxsIj4KPGRpdj4KPGRpdiBjbGFzcz0iZ21haWxfc2lnbmF0dXJlIj4KPGRpdiBzdHlsZT0i Zm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxmb250IHNpemU9IjIiPi0tPGJyPgo8L2Zv bnQ+PC9kaXY+CjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9u dCBzaXplPSIyIj5Sb2RvbGZvIE1hcnTtbmV6PC9mb250PjwvZGl2Pgo8L2Rpdj4KPC9kaXY+Cjxi cj4KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFR1ZSwgSnVuIDcsIDIwMTYgYXQgMTowMyBQ TSwgR2FiZSBBbGZvcmQgPHNwYW4gZGlyPSJsdHIiPgombHQ7PGEgaHJlZj0ibWFpbHRvOnJlZGhh dHJpc2VzQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJlZGhhdHJpc2VzQGdtYWlsLmNvbTwv YT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4OyBib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDsgcGFk ZGluZy1sZWZ0OjFleCI+CjxkaXYgZGlyPSJsdHIiPgo8ZGl2Pgo8ZGl2Pgo8ZGl2PkhlbGxvIFJv ZG9sZm8sPGJyPgo8YnI+CjwvZGl2PgpJIGp1c3QgZGlkIGEgcXVpY2sgZ2xhbmNlIGFzIEkgY3Vy cmVudGx5IGRvbid0IGhhdmUgdGhlIGN5Y2xlcyB0byBsb29rIGludG8gdGhpcyBidXQgdGhlICZx dW90O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd191aWQmcXVvdDsgZXhjbHVkZSBm aWx0ZXIgaXMgd2hlcmUgdGhpcyBpcyBub3Qgd29ya2luZy4gSXQgaXMgbm90IGZpbHRlcmluZyBV SURzIGdyZWF0ZXIgdGhhbiAxIG9yIDUwMCBmb3IgdGhhdCBtYXR0ZXIuPGJyPgo8L2Rpdj4KU3Bl Y2lmaWNhbGx5IHRoaXMgc3ViZXhwcmVzc2lvbiBpcyB3aGF0IGlzIGZhaWxpbmc6PHNwYW4gY2xh c3M9IiI+PGJyPgo8YnI+CiZsdDtpbmQ6c3ViZXhwcmVzc2lvbiBvcGVyYXRpb249JnF1b3Q7Z3Jl YXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyZndDs1MDAm bHQ7L2luZDpzdWJleHByZXNzaW9uJmd0Ozxicj4KPC9zcGFuPjwvZGl2Pgo8ZGl2Pjxicj4KR2Fi ZTxicj4KPGRpdj4KPGRpdj4KPGRpdj4KPGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj4KPGRp diBjbGFzcz0iZ21haWxfcXVvdGUiPgo8ZGl2Pgo8ZGl2IGNsYXNzPSJoNSI+T24gVGh1LCBKdW4g MiwgMjAxNiBhdCA4OjUyIFBNLCBSb2RvbGZvIE1hcnTtbmV6IDxzcGFuIGRpcj0ibHRyIj4KJmx0 OzxhIGhyZWY9Im1haWx0bzpybXR6Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4 QGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJn bWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDsgYm9yZGVyLWxlZnQ6 MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIwNCk7IHBhZGRpbmctbGVmdDoxZXgiPgo8ZGl2IGRpcj0i bHRyIj4KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7IGZvbnQtc2l6 ZTpzbWFsbCI+SGkgbXByZWlzbGVyLDxicj4KPGJyPgo8L2Rpdj4KPGRpdiBzdHlsZT0iZm9udC1m YW1pbHk6dGFob21hLHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTpzbWFsbCI+VGhhbmtzIGZvciB5b3Ug c3VnZ2VzdGlvbiBpbiBJUkMuPGJyPgo8YnI+CjwvZGl2Pgo8ZGl2IHN0eWxlPSJmb250LWZhbWls eTp0YWhvbWEsc2Fucy1zZXJpZjsgZm9udC1zaXplOnNtYWxsIj5UaGlzIHdoYXQgSSBoYXZlIHNv IGZhciwgYnV0IGl0IGlzIHN0aWxsIG5vdCB3b3JraW5nLiBJIGZlZWwgSSBhbSBjbG9zZSwgYnV0 IGl0IGlzIG5vdCB3b3JraW5nIHlldC4gSSB3b3VsZCBhcHByZWNpYXRlIGFueSBzdWdnZXN0aW9u PGJyPgo8YnI+CiZsdDtkZWYtZ3JvdXAmZ3Q7PGJyPgombmJzcDsgJmx0O2RlZmluaXRpb24gY2xh c3M9JnF1b3Q7Y29tcGxpYW5jZSZxdW90OyBpZD0mcXVvdDthdF9zeXN0ZW1fYWNjb3VudHMmcXVv dDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtt ZXRhZGF0YSZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7dGl0bGUm Z3Q7Tm8gc3lzdGVtIGFjY291bnRzIGluIC9ldGMvYXQuYWxsb3cmbHQ7L3RpdGxlJmd0Ozxicj4K Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDthZmZlY3RlZCBmYW1pbHk9JnF1b3Q7 dW5peCZxdW90OyZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyAmbHQ7cGxhdGZvcm0mZ3Q7Q2VudE9TIDUmbHQ7L3BsYXRmb3JtJmd0Ozxicj4KJm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtwbGF0Zm9ybSZndDtSZWQg SGF0IEVudGVycHJpc2UgTGludXggNSZsdDsvcGxhdGZvcm0mZ3Q7PGJyPgombmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgJmx0Oy9hZmZlY3RlZCZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAmbHQ7ZGVzY3JpcHRpb24mZ3Q7R3JvdXAgb3duZXIgZm9yIC9ldGMvYXQu YWxsb3cgYW5kIC9ldGMvYXQuZGVueSBtdXN0IGV4aXN0LiZsdDsvZGVzY3JpcHRpb24mZ3Q7PGJy PgombmJzcDsmbmJzcDsmbmJzcDsgJmx0Oy9tZXRhZGF0YSZndDs8YnI+CiZuYnNwOyZuYnNwOyZu YnNwOyAmbHQ7Y3JpdGVyaWEmZ3Q7PGJyPgombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg Jmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0ZXN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9h bGxvdyZxdW90OyAvJmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDsvY3JpdGVyaWEmZ3Q7 PGJyPgombmJzcDsgJmx0Oy9kZWZpbml0aW9uJmd0Ozxicj4KPGJyPgombmJzcDsgJmx0OyEtLSBU aGlzIHZhcmlhYmxlIHNob3VsZCBnZXQgYWxsIHVzZXJzIGZyb20gL2V0Yy9wYXNzd2QgdGhhdCBo YXMgVUlEICZndDs9IDUwMCAtLSZndDs8YnI+CiZuYnNwOyAmbHQ7bG9jYWxfdmFyaWFibGUgaWQ9 JnF1b3Q7dmFyX2F0X3N5c3RlbV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IGNvbW1lbnQ9JnF1 b3Q7QWNjb3VudHMgQWxsb3dlZCZxdW90OyBkYXRhdHlwZT0mcXVvdDtzdHJpbmcmcXVvdDsgdmVy c2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtvYmplY3Rf Y29tcG9uZW50IGl0ZW1fZmllbGQ9JnF1b3Q7c3ViZXhwcmVzc2lvbiZxdW90OyBvYmplY3RfcmVm PSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyAvJmd0Ozxi cj4KJm5ic3A7ICZsdDsvbG9jYWxfdmFyaWFibGUmZ3Q7PGJyPgo8YnI+CiZuYnNwOyAmbHQ7aW5k OnRleHRmaWxlY29udGVudDU0X29iamVjdCBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291 bnRzX2FsbG93X2xpc3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJm5ic3A7 Jm5ic3A7Jm5ic3A7ICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxl cGF0aCZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5kOnBhdHRlcm4gb3BlcmF0aW9u PSZxdW90O3BhdHRlcm4gbWF0Y2gmcXVvdDsmZ3Q7XihbXjpdJiM0MzspOlteOl0mIzQzOzpbXGRd JiM0Mzs6W1xkXSYjNDM7OlteOl0qOlteOl0mIzQzOzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0 Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90 O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7 MSZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtmaWx0ZXIg YWN0aW9uPSZxdW90O2luY2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2V0 Y19wYXNzd2QmbHQ7L2ZpbHRlciZndDs8YnI+CiZuYnNwOyAmbHQ7L2luZDp0ZXh0ZmlsZWNvbnRl bnQ1NF9vYmplY3QmZ3Q7PGJyPgo8YnI+CiZuYnNwOyAmbHQ7aW5kOnRleHRmaWxlY29udGVudDU0 X3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19ldGNfcGFzc3dkJnF1b3Q7 IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5k OmZpbGVwYXRoJmd0Oy9ldGMvcGFzc3dkJmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7PGJyPgombmJzcDsm bmJzcDsmbmJzcDsgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNo JnF1b3Q7Jmd0O15bXjpdJiM0Mzs6W146XSYjNDM7OihbXGRdJiM0MzspOltcZF0mIzQzOzpbXjpd KjpbXjpdJiM0Mzs6W146XSokJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+CiZuYnNwOyZuYnNwOyZu YnNwOyAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVyIHRoYW4gb3IgZXF1 YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2luZDppbnN0YW5jZSZn dDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5kOnN1YmV4cHJlc3Npb24gb3BlcmF0aW9u PSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVhbCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVv dDsmZ3Q7NTAwJmx0Oy9pbmQ6c3ViZXhwcmVzc2lvbiZndDs8YnI+CjwvZGl2Pgo8L2Rpdj4KPC9i bG9ja3F1b3RlPgo8L2Rpdj4KPC9kaXY+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDsgYm9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJn YigyMDQsMjA0LDIwNCk7IHBhZGRpbmctbGVmdDoxZXgiPgo8ZGl2Pgo8ZGl2IGNsYXNzPSJoNSI+ CjxkaXYgZGlyPSJsdHIiPgo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJp ZjsgZm9udC1zaXplOnNtYWxsIj4mbmJzcDsgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfc3Rh dGUmZ3Q7PGJyPgo8YnI+Cjxicj4KJm5ic3A7ICZsdDshLS0gVGVzdCB0byBjaGVjayB0aGF0IHRo ZXJlIGlzIG5vIHN5c3RlbSBhY2NvdW50cyBpbiAvZXRjL2F0LmFsbG93IC0tJmd0Ozxicj4KJm5i c3A7ICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCBjaGVjaz0mcXVvdDthbGwmcXVvdDsg Y2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDsgaWQ9JnF1b3Q7dGVzdF9hdF9z eXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgY29tbWVudD0mcXVvdDtUZXN0aW5nIC9ldGMv YXQuYWxsb3cgZm9yIHN5c3RlbSBhY2NvdW50cyZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsm Z3Q7PGJyPgombmJzcDsmbmJzcDsmbmJzcDsgJmx0O2luZDpvYmplY3Qgb2JqZWN0X3JlZj0mcXVv dDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93JnF1b3Q7IC8mZ3Q7PGJyPgombmJzcDsg Jmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfdGVzdCZndDs8YnI+Cjxicj4KJm5ic3A7ICZsdDtp bmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0IGNvbW1lbnQ9JnF1b3Q7L2V0Yy9hdC5hbGxvdyZx dW90OyBpZD0mcXVvdDtvYmplY3RfYXRfc3lzdGVtX2FjY291bnRzX2FsbG93JnF1b3Q7IHZlcnNp b249JnF1b3Q7MSZxdW90OyZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7IS0tIEdldCBh bGwgdXNlcnMgZnJvbSAvZXRjL2F0LmFsbG93IC0tJmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7 ICZsdDtpbmQ6ZmlsZXBhdGgmZ3Q7L2V0Yy9hdC5hbGxvdyZsdDsvaW5kOmZpbGVwYXRoJmd0Ozxi cj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtpbmQ6cGF0dGVybiBvcGVyYXRpb249JnF1b3Q7cGF0 dGVybiBtYXRjaCZxdW90OyZndDteKC4mIzQzOykkJmx0Oy9pbmQ6cGF0dGVybiZndDs8YnI+CiZu YnNwOyZuYnNwOyZuYnNwOyAmbHQ7aW5kOmluc3RhbmNlIG9wZXJhdGlvbj0mcXVvdDtncmVhdGVy IHRoYW4gb3IgZXF1YWwmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7aW50JnF1b3Q7Jmd0OzEmbHQ7L2lu ZDppbnN0YW5jZSZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7IS0tIEV4Y2x1ZGUgcm9v dCAtLSZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtl eGNsdWRlJnF1b3Q7Jmd0O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvd19yb290Jmx0 Oy9maWx0ZXImZ3Q7PGJyPgombmJzcDsmbmJzcDsmbmJzcDsgJmx0OyEtLSBFeGNsdWRlIGFsbCB1 c2VyIGFjY291bnRzIC0tJmd0Ozxicj4KJm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtmaWx0ZXIgYWN0 aW9uPSZxdW90O2V4Y2x1ZGUmcXVvdDsmZ3Q7c3RhdGVfYXRfc3lzdGVtX2FjY291bnRzX2F0X2Fs bG93X3VpZCZsdDsvZmlsdGVyJmd0Ozxicj4KJm5ic3A7ICZsdDsvaW5kOnRleHRmaWxlY29udGVu dDU0X29iamVjdCZndDs8YnI+CiZuYnNwOyZuYnNwOyZuYnNwOyA8YnI+CiZuYnNwOyAmbHQ7aW5k OnRleHRmaWxlY29udGVudDU0X3N0YXRlIGlkPSZxdW90O3N0YXRlX2F0X3N5c3RlbV9hY2NvdW50 c19hdF9hbGxvd19yb290JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CiZuYnNw OyZuYnNwOyZuYnNwOyAmbHQ7aW5kOnRleHQmZ3Q7cm9vdCZsdDsvaW5kOnRleHQmZ3Q7PGJyPgom bmJzcDsgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfc3RhdGUmZ3Q7PGJyPgo8YnI+CiZuYnNw OyAmbHQ7dW5peDpwYXNzd29yZF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3Vu dHNfYXRfYWxsb3dfdWlkJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CiZuYnNw OyZuYnNwOyZuYnNwOyAmbHQ7dW5peDp1c2VybmFtZSB2YXJfcmVmPSZxdW90O3Zhcl9hdF9zeXN0 ZW1fYWNjb3VudHNfYWxsb3dfbGlzdCZxdW90OyB2YXJfY2hlY2s9JnF1b3Q7YXQgbGVhc3Qgb25l JnF1b3Q7IC8mZ3Q7PGJyPgombmJzcDsgJmx0Oy91bml4OnBhc3N3b3JkX3N0YXRlJmd0Ozxicj4K PGJyPgombHQ7L2RlZi1ncm91cCZndDs8YnI+Cjxicj4KLS08YnI+CjwvZGl2Pgo8ZGl2IHN0eWxl PSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjsgZm9udC1zaXplOnNtYWxsIj5Sb2RvbGZv PGJyPgo8L2Rpdj4KPC9kaXY+CjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnIgY2xlYXI9ImFs bCI+CjxkaXY+CjxkaXY+CjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlm Ij48Zm9udCBzaXplPSIyIj4tLTxicj4KPC9mb250PjwvZGl2Pgo8ZGl2IHN0eWxlPSJmb250LWZh bWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+Um9kb2xmbyBNYXJ07W5lejwv Zm9udD48L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8YnI+CjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5P biBUdWUsIE1heSAzMSwgMjAxNiBhdCA1OjQzIFBNLCBSb2RvbGZvIE1hcnTtbmV6IDxzcGFuIGRp cj0ibHRyIj4KJmx0OzxhIGhyZWY9Im1haWx0bzpybXR6Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9i bGFuayI+cm10emN4QGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1 b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBweCAwLjhleDsg Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIwNCk7IHBhZGRpbmctbGVmdDoxZXgi PgpIaSBMaXN0LDxicj4KPGJyPgpBZnRlciBtYW55IGhvdXJzIHBsYXlpbmcgd2l0aCBTU0cgYW5k IE9wZW5TQ0FQIGFuZCBub3QgYWJsZSB0byBkbyB3aGF0PGJyPgpJIHdhbnQgSSBuZWVkIHNvbWUg aGVscC48YnI+Cjxicj4KRm9yZ2l2ZSBtZSBpZiBJIHVzZSBTQ0FQIG9yIE9wZW5TQ0FQIHRlcm1z IGluY29ycmVjdGx5LCBJIGFtIG5ldyB0bzxicj4KU1NHIGFuZCBJIGFtIHN0aWxsIGdldHRpbmcg ZmFtaWxpYXIuPGJyPgo8YnI+ClRoZSBmb2xsb3dpbmcgT1ZBTCB0ZXN0IHNlYXJjaGVzIGZvciBz eXN0ZW0gYWNjb3VudHMgKFVJRCAmbHQ7IDUwMCkgaW48YnI+Ci9ldGMvYXQuYWxsb3cgKEkgYW0g c2hvd2luZyBqdXN0IHRoZSByZWxldmFudCBwYXJ0cyBvZjxicj4KUkhFTC81L2lucHV0L292YWwv YXRfc3lzdGVtX2FjY291bnRzLnhtbCB0byBleHBsYWluIG15IHByb2JsZW0pOjxicj4KPGJyPgom bHQ7Y3JpdGVyaWEmZ3Q7PGJyPgombmJzcDsgJmx0O2NyaXRlcmlvbiB0ZXN0X3JlZj0mcXVvdDt0 ZXN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyAvJmd0Ozxicj4KJmx0Oy9jcml0 ZXJpYSZndDs8YnI+Cjxicj4KJmx0O3VuaXg6cGFzc3dvcmRfdGVzdCBjaGVjaz0mcXVvdDthbGwm cXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90O25vbmVfZXhpc3QmcXVvdDs8YnI+CmNvbW1lbnQ9 JnF1b3Q7VGVzdGluZyBzeXN0ZW0gYWNjb3VudHMgaW4gL2V0Yy9hdC5hbGxvdyZxdW90Ozxicj4K aWQ9JnF1b3Q7dGVzdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgdmVyc2lvbj0m cXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJm5ic3A7ICZsdDt1bml4Om9iamVjdCBvYmplY3RfcmVmPSZx dW90O29iamVjdF9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3cmcXVvdDsgLyZndDs8YnI+CiZs dDsvdW5peDpwYXNzd29yZF90ZXN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpwYXNzd29yZF9vYmpl Y3QgaWQ9JnF1b3Q7b2JqZWN0X2F0X3N5c3RlbV9hY2NvdW50c19hdF9hbGxvdyZxdW90OyB2ZXJz aW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgombmJzcDsgJmx0O3VuaXg6dXNlcm5hbWUgb3BlcmF0 aW9uPSZxdW90O2VxdWFscyZxdW90Ozxicj4KdmFyX3JlZj0mcXVvdDt2YXJfYXRfc3lzdGVtX2Fj Y291bnRzX2FsbG93X2xpc3QmcXVvdDsgdmFyX2NoZWNrPSZxdW90O2F0IGxlYXN0IG9uZSZxdW90 Ozxicj4KZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IC8mZ3Q7PGJyPgombmJzcDsgJmx0O2Zp bHRlciBhY3Rpb249JnF1b3Q7aW5jbHVkZSZxdW90OyZndDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3Vu dHNfYXRfYWxsb3dfdWlkJmx0Oy9maWx0ZXImZ3Q7PGJyPgombHQ7L3VuaXg6cGFzc3dvcmRfb2Jq ZWN0Jmd0Ozxicj4KPGJyPgombHQ7bG9jYWxfdmFyaWFibGUgaWQ9JnF1b3Q7dmFyX2F0X3N5c3Rl bV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7PGJyPgpjb21tZW50PSZxdW90O0FjY291bnRzIEFs bG93ZWQmcXVvdDsgZGF0YXR5cGU9JnF1b3Q7c3RyaW5nJnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZx dW90OyZndDs8YnI+CiZuYnNwOyAmbHQ7b2JqZWN0X2NvbXBvbmVudCBpdGVtX2ZpZWxkPSZxdW90 O3N1YmV4cHJlc3Npb24mcXVvdDs8YnI+Cm9iamVjdF9yZWY9JnF1b3Q7b2JqZWN0X2F0X3N5c3Rl bV9hY2NvdW50c19hbGxvd19saXN0JnF1b3Q7IC8mZ3Q7PGJyPgombHQ7L2xvY2FsX3ZhcmlhYmxl Jmd0Ozxicj4KPGJyPgombHQ7aW5kOnRleHRmaWxlY29udGVudDU0X29iamVjdCBjb21tZW50PSZx dW90Oy9ldGMvYXQuYWxsb3cmcXVvdDs8YnI+CmlkPSZxdW90O29iamVjdF9hdF9zeXN0ZW1fYWNj b3VudHNfYWxsb3dfbGlzdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgombmJz cDsgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRjL2F0LmFsbG93Jmx0Oy9pbmQ6ZmlsZXBhdGgmZ3Q7 PGJyPgombmJzcDsgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNo JnF1b3Q7Jmd0O14oLiopJCZsdDsvaW5kOnBhdHRlcm4mZ3Q7PGJyPgombmJzcDsgJmx0O2luZDpp bnN0YW5jZSBvcGVyYXRpb249JnF1b3Q7Z3JlYXRlciB0aGFuIG9yIGVxdWFsJnF1b3Q7PGJyPgpk YXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MCZsdDsvaW5kOmluc3RhbmNlJmd0Ozxicj4KJmx0 Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0Jmd0Ozxicj4KPGJyPgombHQ7dW5peDpwYXNz d29yZF9zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9hdF9zeXN0ZW1fYWNjb3VudHNfYXRfYWxsb3dfdWlk JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+CiZuYnNwOyAmbHQ7dW5peDp1c2Vy X2lkIGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyBvcGVyYXRpb249JnF1b3Q7bGVzcyB0aGFuJnF1 b3Q7Jmd0OzUwMCZsdDsvdW5peDp1c2VyX2lkJmd0Ozxicj4KJmx0Oy91bml4OnBhc3N3b3JkX3N0 YXRlJmd0Ozxicj4KPGJyPgo8YnI+ClRoZSB0ZXN0IGFib3ZlIGdldHMgdGhlIHVzZXJzIGluZm9y bWF0aW9uIGZyb20gdGhlIHNvdXJjZXMgc3BlY2lmaWVkPGJyPgppbiBOU1MgKC9ldGMvbnNzd2l0 Y2guY29uZikgd2hpY2ggaXMgY29ycmVjdCwgaG93ZXZlciBJIHdhbnQgdG8gY3JlYXRlPGJyPgph IHZlcnNpb24gdGhhdCB1c2VzIC9ldGMvcGFzc3dkIGRpcmVjdGx5LiBXaHk/IFdlIGhhdmUgbWFu eTxicj4KKHRob3VzYW5kcz8pIG9mIFJIRUwgNSBiYXNlZCBzZXJ2ZXJzIHdpdGggTERBUCBpbnRl Z3JhdGlvbiwgYW5kIG1hbnk8YnI+Cih0aG91c2FuZHM/KSBvZiBhY2NvdW50cyBpbiB0aGUgTERB UCBzZXJ2ZXJzLjxicj4KPGJyPgpTaW1wbGUgdGVzdHMgbGlrZSBSSEVMLzUvaW5wdXQvb3ZhbC9h dF9zeXN0ZW1fYWNjb3VudHMueG1sIGFuZDxicj4KUkhFTC81L2lucHV0L292YWwvY3Jvbl9zeXN0 ZW1fYWNjb3VudHMueG1sIGNhbiB0YWtlIGhvdXJzIHRvIHJ1bjxicj4KYmVjYXVzZSB0aGV5IHJl dHJpZXZlICphbGwqIHVzZXJzIGluZm9ybWF0aW9uIGZyb20gdGhlIExEQVAgc2VydmVyczxicj4K YW5kIHRoZXkgZG8gaXQgKmZvciBlYWNoIGVudHJ5KiBpbiAvZXRjL2F0LmFsbG93IGFuZCAvZXRj L2Nyb24uYWxsb3cuPGJyPgpBbHNvLCBpZiB3ZSBydW4gT3BlblNDQVAgKG9zY2FwKSBhdCB0aGUg c2FtZSB0aW1lIGluIGEgZmV3IHNlcnZlcnM8YnI+CnRoZXkgaGl0IHRoZSBMREFQIHNlcnZlcnMg cmVhbGx5IGJhZC48YnI+Cjxicj4KSSBoYXZlIGJlZW4gdHJ5aW5nIHRvIHJlcGxhY2UgcGFzc3dv cmRfdGVzdCBhbmQgcGFzc3dvcmRfb2JqZWN0IGJ5PGJyPgp0ZXh0ZmlsZWNvbnRlbnQ1NF90ZXN0 IGFuZCB0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3Qgd2l0aG91dCBhbnkgbHVjay48YnI+CklmIHlv dSB3YW50LCBJIGNhbiBzaGFyZSBteSBhdF9zeXN0ZW1fYWNjb3VudHMueG1sIGZpbGUgdGhhdCBJ IHRob3VnaHQ8YnI+Cml0IHdhcyBnb2luZyB0byB3b3JrLjxicj4KPGJyPgpJIHdvdWxkIHJlYWxs eSBhcHByZWNpYXRlIGFueSBoZWxwIG9yIGhpbnQ/PGJyPgo8YnI+Cjxicj4KUmVnYXJkczxzcGFu Pjxmb250IGNvbG9yPSIjODg4ODg4Ij48YnI+Ci0tPGJyPgpSb2RvbGZvIE1hcnTtbmV6PGJyPgo8 L2ZvbnQ+PC9zcGFuPjwvYmxvY2txdW90ZT4KPC9kaXY+Cjxicj4KPC9kaXY+Cjxicj4KPC9kaXY+ CjwvZGl2Pgo8c3BhbiBjbGFzcz0iSE9FblpiIj48Zm9udCBjb2xvcj0iIzg4ODg4OCI+LS08YnI+ ClNDQVAgU2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PGJyPgo8YSBocmVmPSJtYWlsdG86c2Nh cC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiB0YXJnZXQ9Il9ibGFuayI+ c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEgaHJl Zj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAtc2VjdXJp dHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9 Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FkbWluL2xpc3RzL3NjYXAt c2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0 dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLyIgcmVsPSJub3Jl ZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAt c2VjdXJpdHktZ3VpZGUvPC9hPjxicj4KPGJyPgo8L2ZvbnQ+PC9zcGFuPjwvYmxvY2txdW90ZT4K PC9kaXY+Cjxicj4KPC9kaXY+CjwvZGl2Pgo8L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8L2Rpdj4KPGJy PgotLTxicj4KU0NBUCBTZWN1cml0eSBHdWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1h aWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIHRhcmdldD0i X2JsYW5rIj5zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJy Pgo8YSBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlzdHMvc2Nh cC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiByZWw9Im5vcmVmZXJyZXIi IHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYWRtaW4vbGlz dHMvc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjxicj4KPGEg aHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvIiBy ZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblND QVAvc2NhcC1zZWN1cml0eS1ndWlkZS88L2E+PGJyPgo8YnI+CjwvYmxvY2txdW90ZT4KPC9kaXY+ Cjxicj4KPC9kaXY+Cjxicj4KPHByZT48Zm9udCBjb2xvcj0iYmx1ZSI+ClNjYW5uZWQgYnkgRm9y Y2Vwb2ludCBFbWFpbCBTZWN1cml0eSBHYXRld2F5PGJyPkNsaWNrIDxhIGhyZWY9Imh0dHBzOi8v ZXNncGVtLndlYnNlbnNlLmNvbTo0NDMvcGVtL3BhZ2VzL2RpZ2VzdFByb2Nlc3MvZGlnZXN0UHJv Y2Vzcy5qc2Y/Y29udGVudD1jMzgwNWM1OTUxODg5YzVlYzUxMGJkOTEzZjMzNmIzZDE3MTZkNDdk OTNiNGVlMTBkZTA0YTc4ZWY2YzdmYWQ4MmMwZmUwZTUwZjgzZWMyOWM2YTA2NmRmNzUwOTUxZDUy MjhhODA1ODkwMjc5NWU5NGZhODZjYzdjNmU2OWYyYjMzZGIyYzEwOTJlNzZkN2IwOGViN2I4ZWZi M2ViMDQ2OTE1NmFjNTE1MjdkNTg1OWU0ZWVjNzRkM2YzMGRiMmMwMjVlMzA3ZmY4MDM5YWYwMDAz MGRhNDZmYWNmMDhlNmE0ZmFmZTMzNDNkMTJmMGZlMmZhNTFmNTg4ODc5MmVhYjkxODYwYmIxYjc0 MGQyY2Y2M2MwOTkyYzA0MzBlOGIiIHRpdGxlPSJXYXJuaW5nOiBSZXBvcnQgdGhlIG1lc3NhZ2Ug YXMgc3BhbSIgdGFyZ2V0PSJfYmxhbmsiPmhlcmU8L2E+Jm5ic3A7dG8gcmVwb3J0IHRoaXMgZW1h aWwgYXMgc3BhbQoKPC9mb250PjwvcHJlPgo8YnI+CjwvZGl2Pgo8L2Rpdj4KPC9kaXY+Cgo8YnI+ PHByZT48Zm9udCBjb2xvcj0iYmx1ZSI+Cgo8L2ZvbnQ+PC9wcmU+PGJyPgo8L2JvZHk+CjwvaHRt bD4K --===============5275806459614119073==-- From rmtzcx at gmail.com Wed Jun 15 16:40:17 2016 Content-Type: multipart/mixed; boundary="===============2154765632086836911==" MIME-Version: 1.0 From: =?utf-8?q?Rodolfo_Mart=C3=ADnez_=3Crmtzcx_at_gmail=2Ecom=3E?= To: scap-security-guide at lists.fedorahosted.org Subject: Issue with file_permissions_ungroupowned in CentOS 5 Date: Tue, 14 Jun 2016 23:55:54 -0500 Message-ID: --===============2154765632086836911== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, I am having an issue with OVAL test file_permissions_ungroupowned in CentOS 5. I believe it is a bug in the oscap version that it is available in CentOS 5 (kind of old, v1.0.8). Here is the procedure I am doing: 1. Download and build scap-security-guide for RHEL5 in my Fedora 23 machine; then copy the output to my CentOS 5 testing server: wget https://github.com/OpenSCAP/scap-security-guide/archive/v0.1.29.tar.gz -O scap-security-guide-0.1.29.tar.gz tar -zxf scap-security-guide-0.1.29.tar.gz make -C scap-security-guide-0.1.29/RHEL/5 dist scp -r scap-security-guide-0.1.29/RHEL/5/dist/content centos5-test: Now in the CentOS 5 testing server, create a tailoring file to run file_permissions_ungroupowned test alone: cat >ssg-centos5-xccdf-tailoring.xml <<"EOF" 1 CentOS 5 [TAILORED] > > > EOF > > Create a file without corresponding group in /etc/group: > > touch /an_unowned_group_file > > chgrp 4567 /an_unowned_group_file > > find / -nogroup 2>/dev/null > /an_unowned_group_file <-- Check that it is found > > > Finally run oscap: > > oscap xccdf eval \ > --tailoring-file ssg-centos5-xccdf-tailoring.xml \ > --profile xccdf_my_profile_stig-centos5-upstream_tailored \ > --cpe content/ssg-rhel5-cpe-dictionary.xml \ > content/ssg-centos5-xccdf.xml > > ... and output is: > > Title Ensure All Files Are Owned by a Group > Rule file_permissions_ungroupowned > Ident GEN001170 > Result pass > > I would expect that the test fails since there is at least one file > without existing group. > > I took a look at the OVAL definition > scap-security-guide-0.1.29/RHEL/5/input/oval/file_permissions_ungroupowne= d.xml > but I do not see anything wrong. > > Do you have any idea why this test is passing when it should fail? > > Regards > > -- > Rodolfo Mart=C3=ADnez > --===============8583868256501844561== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGVyZSBpcyB0aGUgcmVsZXZh bnQgcGFydCBvZiB0aGUgZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWQgT1ZBTCB0ZXN0Ojxi cj48YnI+wqAgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0mcXVvdDthbGwgbG9jYWwgZmls ZXMmcXVvdDsgaWQ9JnF1b3Q7ZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWRfb2JqZWN0JnF1 b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8YnI+wqDCoMKgICZsdDt1bml4OmJlaGF2aW9y cyByZWN1cnNlPSZxdW90O2RpcmVjdG9yaWVzJnF1b3Q7IHJlY3Vyc2VfZGlyZWN0aW9uPSZxdW90 O2Rvd24mcXVvdDsgbWF4X2RlcHRoPSZxdW90Oy0xJnF1b3Q7IHJlY3Vyc2VfZmlsZV9zeXN0ZW09 JnF1b3Q7bG9jYWwmcXVvdDsgLyZndDs8YnI+wqDCoMKgICZsdDt1bml4OnBhdGggb3BlcmF0aW9u PSZxdW90O2VxdWFscyZxdW90OyZndDsvJmx0Oy91bml4OnBhdGgmZ3Q7PGJyPsKgwqDCoCAmbHQ7 dW5peDpmaWxlbmFtZSBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDsuKiZs dDsvdW5peDpmaWxlbmFtZSZndDs8YnI+wqDCoMKgICZsdDtmaWx0ZXIgYWN0aW9uPSZxdW90O2V4 Y2x1ZGUmcXVvdDsmZ3Q7ZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWRfbGlzdF9tYXRjaCZs dDsvZmlsdGVyJmd0Ozxicj7CoCAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7PGJyPjxicj48L2Rp dj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5JZiBJIGNyZWF0ZSAmIzM5O2FhYSYjMzk7IGZpbGUg aW4gL3RtcCBhbmQgY2hhZ2UgdGhlIEdJRCB0byBhIG5vbi1leGlzdGluZyBncm91cCBpbiAvZXRj L2dyb3VwLCB0aGUgdGVzdCBzaG91bGQgZmFpbCwgYnV0IGl0IHBhc3Nlcy48YnI+PGJyPjwvZGl2 PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZjtmb250LXNpemU6c21hbGwiPklmIEkgY2hhbmdlIHRoZSBmaWxlIG5hbWUgcGF0dGVy biBtYXRjaCBmcm9tICYjMzk7LiomIzM5OyB0byAmIzM5O2EuKiYjMzk7IG9yIGNoYW5nZSB0aGUg cGF0aCB0byAvdG1wLCB0aGUgdGVzdCBmYWlscyBjb3JyZWN0bHkuPGJyPjxicj48L2Rpdj48ZGl2 IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2Vy aWY7Zm9udC1zaXplOnNtYWxsIj5JcyB0aGVyZSBhbnkgbGltaXRhdGlvbiBpbiB0aGUgYW1vdW50 IG9mIGZpbGVzIHRoYXQgb3NjYXAgY2FuIHByb2Nlc3M/PGJyPjxicj48L2Rpdj48ZGl2IGNsYXNz PSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9u dC1zaXplOnNtYWxsIj5UaGFua3M8YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIg c3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+PGJy PjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnIgY2xlYXI9ImFsbCI+PGRp dj48ZGl2IGNsYXNzPSJnbWFpbF9zaWduYXR1cmUiIGRhdGEtc21hcnRtYWlsPSJnbWFpbF9zaWdu YXR1cmUiPjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBz aXplPSIyIj4tLTxicj48L2ZvbnQ+PC9kaXY+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21h LHNhbnMtc2VyaWYiPjxmb250IHNpemU9IjIiPlJvZG9sZm8gTWFydMOtbmV6PC9mb250PjwvZGl2 PjwvZGl2PjwvZGl2Pgo8YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFR1ZSwgSnVuIDE0 LCAyMDE2IGF0IDExOjU1IFBNLCBSb2RvbGZvIE1hcnTDrW5leiA8c3BhbiBkaXI9Imx0ciI+Jmx0 OzxhIGhyZWY9Im1haWx0bzpybXR6Y3hAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+cm10emN4 QGdtYWlsLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9Imdt YWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mg c29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxf ZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpz bWFsbCI+SGksPGJyPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0i Zm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5JIGFtIGhhdmlu ZyBhbiBpc3N1ZSB3aXRoIE9WQUwgdGVzdCBmaWxlX3Blcm1pc3Npb25zX3VuZ3JvdXBvd25lZCBp biBDZW50T1MgNS4gSSBiZWxpZXZlIGl0IGlzIGEgYnVnIGluIHRoZSBvc2NhcCB2ZXJzaW9uIHRo YXQgaXQgaXMgYXZhaWxhYmxlIGluIENlbnRPUyA1IChraW5kIG9mIG9sZCwgdjEuMC44KS48YnI+ PGJyPjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0 YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPkhlcmUgaXMgdGhlIHByb2NlZHVyZSBJ IGFtIGRvaW5nOjxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9 ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+MS4gRG93bmxv YWQgYW5kIGJ1aWxkIHNjYXAtc2VjdXJpdHktZ3VpZGUgZm9yIFJIRUw1IGluIG15IEZlZG9yYSAy MyBtYWNoaW5lOyB0aGVuIGNvcHkgdGhlIG91dHB1dCB0byBteSBDZW50T1MgNSB0ZXN0aW5nIHNl cnZlcjo8YnI+PGJyPndnZXQgPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3Nj YXAtc2VjdXJpdHktZ3VpZGUvYXJjaGl2ZS92MC4xLjI5LnRhci5neiIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlL2FyY2hpdmUv djAuMS4yOS50YXIuZ3o8L2E+IC1PIHNjYXAtc2VjdXJpdHktZ3VpZGUtMC4xLjI5LnRhci5nejxi cj48YnI+dGFyIC16eGYgc2NhcC1zZWN1cml0eS1ndWlkZS0wLjEuMjkudGFyLmd6PGJyPjxicj5t YWtlIC1DIHNjYXAtc2VjdXJpdHktZ3VpZGUtMC4xLjI5L1JIRUwvNSBkaXN0PGJyPjxicj5zY3Ag LXIgc2NhcC1zZWN1cml0eS1ndWlkZS0wLjEuMjkvUkhFTC81L2Rpc3QvY29udGVudCBjZW50b3M1 LXRlc3Q6PGJyPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9u dC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5Ob3cgaW4gdGhlIENl bnRPUyA1IHRlc3Rpbmcgc2VydmVyLCBjcmVhdGUgYSB0YWlsb3JpbmcgZmlsZSB0byBydW4gZmls ZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWQgdGVzdCBhbG9uZTo8YnI+PGJyPmNhdCAmZ3Q7c3Nn LWNlbnRvczUteGNjZGYtdGFpbG9yaW5nLnhtbCAmbHQ7Jmx0OyZxdW90O0VPRiZxdW90Ozxicj4m bHQ7P3htbCB2ZXJzaW9uPSZxdW90OzEuMCZxdW90OyBlbmNvZGluZz0mcXVvdDtVVEYtOCZxdW90 Oz8mZ3Q7PGJyPiZsdDtUYWlsb3JpbmcgeG1sbnM9JnF1b3Q7PGEgaHJlZj0iaHR0cDovL2NoZWNr bGlzdHMubmlzdC5nb3YveGNjZGYvMS4yIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL2NoZWNrbGlz dHMubmlzdC5nb3YveGNjZGYvMS4yPC9hPiZxdW90OyBpZD0mcXVvdDt4Y2NkZl9zc2ctY2VudG9z NV90YWlsb3JpbmdfeGNjZGYmcXVvdDsmZ3Q7PGJyPsKgwqDCoCAmbHQ7dmVyc2lvbiB0aW1lPSZx dW90OzIwMTYtMDYtMTRUMTk6NTA6NTcmcXVvdDsmZ3Q7MSZsdDsvdmVyc2lvbiZndDs8YnI+wqDC oMKgICZsdDtQcm9maWxlIGlkPSZxdW90O3hjY2RmX215X3Byb2ZpbGVfc3RpZy1jZW50b3M1LXVw c3RyZWFtX3RhaWxvcmVkJnF1b3Q7Jmd0Ozxicj7CoMKgwqDCoMKgwqDCoCAmbHQ7dGl0bGUmZ3Q7 Q2VudE9TIDUgW1RBSUxPUkVEXSZsdDsvdGl0bGUmZ3Q7PGJyPsKgwqDCoMKgwqDCoMKgICZsdDtz ZWxlY3QgaWRyZWY9JnF1b3Q7ZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWQmcXVvdDsgc2Vs ZWN0ZWQ9JnF1b3Q7dHJ1ZSZxdW90Oy8mZ3Q7PGJyPsKgwqDCoCAmbHQ7L1Byb2ZpbGUmZ3Q7PGJy PiZsdDsvVGFpbG9yaW5nJmd0Ozxicj5FT0Y8YnI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9ImdtYWls X2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6 c21hbGwiPkNyZWF0ZSBhIGZpbGUgd2l0aG91dCBjb3JyZXNwb25kaW5nIGdyb3VwIGluIC9ldGMv Z3JvdXA6PGJyPjxicj50b3VjaCAvYW5fdW5vd25lZF9ncm91cF9maWxlPGJyPjxicj5jaGdycCA0 NTY3IC9hbl91bm93bmVkX2dyb3VwX2ZpbGU8YnI+PGJyPmZpbmQgLyAtbm9ncm91cCAyJmd0Oy9k ZXYvbnVsbDxicj4vYW5fdW5vd25lZF9ncm91cF9maWxlICZsdDstLSBDaGVjayB0aGF0IGl0IGlz IGZvdW5kIDxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZv bnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+PGJyPjwvZGl2Pjxk aXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1z ZXJpZjtmb250LXNpemU6c21hbGwiPkZpbmFsbHkgcnVuIG9zY2FwOjxicj48YnI+b3NjYXAgeGNj ZGYgZXZhbCBcPGJyPsKgwqDCoCAtLXRhaWxvcmluZy1maWxlIHNzZy1jZW50b3M1LXhjY2RmLXRh aWxvcmluZy54bWwgXDxicj7CoMKgwqAgLS1wcm9maWxlIHhjY2RmX215X3Byb2ZpbGVfc3RpZy1j ZW50b3M1LXVwc3RyZWFtX3RhaWxvcmVkIFw8YnI+wqDCoMKgIC0tY3BlIGNvbnRlbnQvc3NnLXJo ZWw1LWNwZS1kaWN0aW9uYXJ5LnhtbCBcPGJyPsKgwqDCoCBjb250ZW50L3NzZy1jZW50b3M1LXhj Y2RmLnhtbDxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZv bnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+Li4uIGFuZCBvdXRw dXQgaXM6PGJyPjxicj5UaXRsZcKgwqAgRW5zdXJlIEFsbCBGaWxlcyBBcmUgT3duZWQgYnkgYSBH cm91cDxicj5SdWxlwqDCoMKgIGZpbGVfcGVybWlzc2lvbnNfdW5ncm91cG93bmVkPGJyPklkZW50 wqDCoCBHRU4wMDExNzA8YnI+UmVzdWx0wqAgcGFzczxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0i Z21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQt c2l6ZTpzbWFsbCI+SSB3b3VsZCBleHBlY3QgdGhhdCB0aGUgdGVzdCBmYWlscyBzaW5jZSB0aGVy ZSBpcyBhdCBsZWFzdCBvbmUgZmlsZSB3aXRob3V0IGV4aXN0aW5nIGdyb3VwLjxicj48YnI+PC9k aXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxz YW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SSB0b29rIGEgbG9vayBhdCB0aGUgT1ZBTCBkZWZp bml0aW9uIHNjYXAtc2VjdXJpdHktZ3VpZGUtMC4xLjI5L1JIRUwvNS9pbnB1dC9vdmFsL2ZpbGVf cGVybWlzc2lvbnNfdW5ncm91cG93bmVkLnhtbCBidXQgSSBkbyBub3Qgc2VlIGFueXRoaW5nIHdy b25nLjxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQt ZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+RG8geW91IGhhdmUgYW55 IGlkZWEgd2h5IHRoaXMgdGVzdCBpcyBwYXNzaW5nIHdoZW4gaXQgc2hvdWxkIGZhaWw/PGJyPjxi cj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFo b21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5SZWdhcmRzPGJyPjwvZGl2PjxkaXYgY2xh c3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtm b250LXNpemU6c21hbGwiPjxiciBjbGVhcj0iYWxsIj48L2Rpdj48ZGl2PjxkaXYgZGF0YS1zbWFy dG1haWw9ImdtYWlsX3NpZ25hdHVyZSI+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWYiPjxmb250IHNpemU9IjIiPi0tPGJyPjwvZm9udD48L2Rpdj48ZGl2IHN0eWxlPSJm b250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+Um9kb2xmbyBNYXJ0 w61uZXo8L2ZvbnQ+PC9kaXY+PC9kaXY+PC9kaXY+CjwvZGl2Pgo8L2Jsb2NrcXVvdGU+PC9kaXY+ PGJyPjwvZGl2Pgo= --===============8583868256501844561==-- From shawn at redhat.com Fri Jun 17 17:47:53 2016 Content-Type: multipart/mixed; boundary="===============4008546956541905979==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: Issue with file_permissions_ungroupowned in CentOS 5 Date: Fri, 17 Jun 2016 13:47:38 -0400 Message-ID: <576437BA.2030300@redhat.com> In-Reply-To: CAB6RzTu7o4+a5H-uM=Rv4CqtTaZaYgndDYtJ67p3tw+AWe1XBQ@mail.gmail.com --===============4008546956541905979== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 6/15/16 2:09 PM, Rodolfo Mart=C3=ADnez wrote: > Here is the relevant part of the file_permissions_ungroupowned OVAL test: > > id=3D"file_permissions_ungroupowned_object" version=3D"1"> > max_depth=3D"-1" recurse_file_system=3D"local" /> > / > .* > action=3D"exclude">file_permissions_ungroupowned_list_match > > > If I create 'aaa' file in /tmp and chage the GID to a non-existing = > group in /etc/group, the test should fail, but it passes. > > If I change the file name pattern match from '.*' to 'a.*' or change = > the path to /tmp, the test fails correctly. > > Is there any limitation in the amount of files that oscap can process? > > Thanks > > > -- > Rodolfo Mart=C3=ADnez > > On Tue, Jun 14, 2016 at 11:55 PM, Rodolfo Mart=C3=ADnez > wrote: > > Hi, > > I am having an issue with OVAL test file_permissions_ungroupowned > in CentOS 5. I believe it is a bug in the oscap version that it is > available in CentOS 5 (kind of old, v1.0.8). > > Here is the procedure I am doing: > > 1. Download and build scap-security-guide for RHEL5 in my Fedora > 23 machine; then copy the output to my CentOS 5 testing server: > > wget > https://github.com/OpenSCAP/scap-security-guide/archive/v0.1.29.tar.gz > -O scap-security-guide-0.1.29.tar.gz > > tar -zxf scap-security-guide-0.1.29.tar.gz > > make -C scap-security-guide-0.1.29/RHEL/5 dist > > scp -r scap-security-guide-0.1.29/RHEL/5/dist/content centos5-test: > > Now in the CentOS 5 testing server, create a tailoring file to run > file_permissions_ungroupowned test alone: > > cat >ssg-centos5-xccdf-tailoring.xml <<"EOF" > > id=3D"xccdf_ssg-centos5_tailoring_xccdf"> > 1 > > CentOS 5 [TAILORED] > >> >> >> EOF >> >> Create a file without corresponding group in /etc/group: >> >> touch /an_unowned_group_file >> >> chgrp 4567 /an_unowned_group_file >> >> find / -nogroup 2>/dev/null >> /an_unowned_group_file <-- Check that it is found >> >> >> Finally run oscap: >> >> =E2=80=8B=E2=80=8B >> oscap xccdf eval \ >> --tailoring-file ssg-centos5-xccdf-tailoring.xml \ >> --profile xccdf_my_profile_stig-centos5-upstream_tailored \ >> --cpe content/ssg-rhel5-cpe-dictionary.xml \ >> content/ssg-centos5-xccdf.xml >> >> ... and output is: >> >> Title Ensure All Files Are Owned by a Group >> Rule file_permissions_ungroupowned >> Ident GEN001170 >> Result pass >> >> I would expect that the test fails since there is at least one file >> without existing group. >> >> I took a look at the OVAL definition >> scap-security-guide-0.1.29/RHEL/5/input/oval/file_permissions_ungroupown= ed.xml >> but I do not see anything wrong. >> >> Do you have any idea why this test is passing when it should fail? >> >> Regards >> > > Hi Rodolfo, > > Thanks for reporting this! I've updated the RHEL5 content to use the > updated file_permissions_ungroupowned check: > https://github.com/OpenSCAP/scap-security-guide/pull/1296 > > That should get merged in the next few days pending peer review. If > you could test the PR and verify this works for you, that'd be great! > > Shawn > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ > > =E2=80=8B Hi Shawn, I think the problem is not with the OVAL definition, the shared and RHEL5 versions are practically the same. I think the issue is in oscap. Below is the test of the PR. It is still not working correctly. # touch /tmp/ungroupedowned_file # chgrp 4567 /tmp/ungroupedowned_file # find / -nogroup 2>/dev/null /tmp/ungroupedowned_file <=3D=3D Confirmation that it is an ungrouped owned file =E2=80=8B# oscap xccdf eval \ --tailoring-file ssg-centos5-xccdf-tailoring.xml \ --profile xccdf_my_profile_stig-centos5-upstream_tailored \ --cpe content/ssg-rhel5-cpe-dictionary.xml \ content/ssg-centos5-xccdf.xml Title Ensure All Files Are Owned by a Group Rule file_permissions_ungroupowned Ident GEN001170 Result pass <=3D=3D It should fail =E2=80=8B =E2=80=8BSame OVAL definition is working fine in RHEL/CentOS 6 and 7 with openscap-1.2.x -- Rodolfo Mart=C3=ADnez =E2=80=8B --===============1643769711992037035== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48ZGl2IGNsYXNzPSJn bWFpbF9xdW90ZSI+T24gRnJpLCBKdW4gMTcsIDIwMTYgYXQgMTI6NDcgUE0sIFNoYXduIFdlbGxz IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXduQHJlZGhhdC5jb20iIHRh cmdldD0iX2JsYW5rIj5zaGF3bkByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj48 YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MHB4IDBweCAwcHgg MC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIwNCk7cGFkZGluZy1sZWZ0 OjFleCI+CiAgCiAgICAKICAKICA8ZGl2IGJnY29sb3I9IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAi PjxkaXY+PGRpdiBjbGFzcz0iaDUiPgogICAgPGJyPgogICAgPGJyPgogICAgPGRpdj5PbiA2LzE1 LzE2IDI6MDkgUE0sIFJvZG9sZm8gTWFydMOtbmV6CiAgICAgIHdyb3RlOjxicj4KICAgIDwvZGl2 PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgIDxkaXYgZGlyPSJsdHIiPgogICAg ICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpz bWFsbCI+SGVyZSBpcwogICAgICAgICAgdGhlIHJlbGV2YW50IHBhcnQgb2YgdGhlIGZpbGVfcGVy bWlzc2lvbnNfdW5ncm91cG93bmVkIE9WQUwKICAgICAgICAgIHRlc3Q6PGJyPgogICAgICAgICAg PGJyPgogICAgICAgICAgwqAgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0mcXVvdDthbGwg bG9jYWwgZmlsZXMmcXVvdDsKICAgICAgICAgIGlkPSZxdW90O2ZpbGVfcGVybWlzc2lvbnNfdW5n cm91cG93bmVkX29iamVjdCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgogICAg ICAgICAgwqDCoMKgICZsdDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSZxdW90O2RpcmVjdG9yaWVz JnF1b3Q7CiAgICAgICAgICByZWN1cnNlX2RpcmVjdGlvbj0mcXVvdDtkb3duJnF1b3Q7IG1heF9k ZXB0aD0mcXVvdDstMSZxdW90OwogICAgICAgICAgcmVjdXJzZV9maWxlX3N5c3RlbT0mcXVvdDts b2NhbCZxdW90OyAvJmd0Ozxicj4KICAgICAgICAgIMKgwqDCoCAmbHQ7dW5peDpwYXRoIG9wZXJh dGlvbj0mcXVvdDtlcXVhbHMmcXVvdDsmZ3Q7LyZsdDsvdW5peDpwYXRoJmd0Ozxicj4KICAgICAg ICAgIMKgwqDCoCAmbHQ7dW5peDpmaWxlbmFtZSBvcGVyYXRpb249JnF1b3Q7cGF0dGVybgogICAg ICAgICAgbWF0Y2gmcXVvdDsmZ3Q7LiombHQ7L3VuaXg6ZmlsZW5hbWUmZ3Q7PGJyPgogICAgICAg ICAgwqDCoMKgICZsdDtmaWx0ZXIKYWN0aW9uPSZxdW90O2V4Y2x1ZGUmcXVvdDsmZ3Q7ZmlsZV9w ZXJtaXNzaW9uc191bmdyb3Vwb3duZWRfbGlzdF9tYXRjaCZsdDsvZmlsdGVyJmd0Ozxicj4KICAg ICAgICAgIMKgICZsdDsvdW5peDpmaWxlX29iamVjdCZndDs8YnI+CiAgICAgICAgICA8YnI+CiAg ICAgICAgPC9kaXY+CiAgICAgICAgPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMt c2VyaWY7Zm9udC1zaXplOnNtYWxsIj5JZiBJCiAgICAgICAgICBjcmVhdGUgJiMzOTthYWEmIzM5 OyBmaWxlIGluIC90bXAgYW5kIGNoYWdlIHRoZSBHSUQgdG8gYSBub24tZXhpc3RpbmcKICAgICAg ICAgIGdyb3VwIGluIC9ldGMvZ3JvdXAsIHRoZSB0ZXN0IHNob3VsZCBmYWlsLCBidXQgaXQgcGFz c2VzLjxicj4KICAgICAgICAgIDxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2IHN0eWxl PSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPklmIEkKICAg ICAgICAgIGNoYW5nZSB0aGUgZmlsZSBuYW1lIHBhdHRlcm4gbWF0Y2ggZnJvbSAmIzM5Oy4qJiMz OTsgdG8gJiMzOTthLiomIzM5OyBvcgogICAgICAgICAgY2hhbmdlIHRoZSBwYXRoIHRvIC90bXAs IHRoZSB0ZXN0IGZhaWxzIGNvcnJlY3RseS48YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9k aXY+CiAgICAgICAgPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9u dC1zaXplOnNtYWxsIj5JcyB0aGVyZQogICAgICAgICAgYW55IGxpbWl0YXRpb24gaW4gdGhlIGFt b3VudCBvZiBmaWxlcyB0aGF0IG9zY2FwIGNhbiBwcm9jZXNzPzxicj4KICAgICAgICAgIDxicj4K ICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZjtmb250LXNpemU6c21hbGwiPlRoYW5rczxicj4KICAgICAgICA8L2Rpdj4KICAgICAg ICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21h bGwiPjxicj4KICAgICAgICA8L2Rpdj4KICAgICAgPC9kaXY+CiAgICAgIDxkaXYgY2xhc3M9Imdt YWlsX2V4dHJhIj48YnIgY2xlYXI9ImFsbCI+CiAgICAgICAgPGRpdj4KICAgICAgICAgIDxkaXYg ZGF0YS1zbWFydG1haWw9ImdtYWlsX3NpZ25hdHVyZSI+CiAgICAgICAgICAgIDxkaXYgc3R5bGU9 ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj4tLTxicj4KICAg ICAgICAgICAgICA8L2ZvbnQ+PC9kaXY+CiAgICAgICAgICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj5Sb2RvbGZvCiAgICAgICAgICAg ICAgICBNYXJ0w61uZXo8L2ZvbnQ+PC9kaXY+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICA8L2Rp dj4KICAgICAgICA8YnI+CiAgICAgICAgPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFR1ZSwg SnVuIDE0LCAyMDE2IGF0IDExOjU1IFBNLAogICAgICAgICAgUm9kb2xmbyBNYXJ0w61uZXogPHNw YW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPjwvYT48YSBocmVmPSJtYWlsdG86cm10emN4QGdtYWlsLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnJtdHpjeEBnbWFpbC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPgogICAgICAg ICAgPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHgg MHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmct bGVmdDoxZXgiPgogICAgICAgICAgICA8ZGl2IGRpcj0ibHRyIj4KICAgICAgICAgICAgICA8ZGl2 IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPkhp LDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAg ICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6 c21hbGwiPkkKICAgICAgICAgICAgICAgIGFtIGhhdmluZyBhbiBpc3N1ZSB3aXRoIE9WQUwgdGVz dAogICAgICAgICAgICAgICAgZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWQgaW4gQ2VudE9T IDUuIEkgYmVsaWV2ZSBpdAogICAgICAgICAgICAgICAgaXMgYSBidWcgaW4gdGhlIG9zY2FwIHZl cnNpb24gdGhhdCBpdCBpcyBhdmFpbGFibGUgaW4KICAgICAgICAgICAgICAgIENlbnRPUyA1IChr aW5kIG9mIG9sZCwgdjEuMC44KS48YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgPC9kaXY+CiAgICAgICAgICAgICAgPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5IZXJlCiAgICAgICAgICAgICAgICBpcyB0aGUgcHJv Y2VkdXJlIEkgYW0gZG9pbmc6PGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg IDwvZGl2PgogICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5z LXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+MS4KICAgICAgICAgICAgICAgIERvd25sb2FkIGFuZCBi dWlsZCBzY2FwLXNlY3VyaXR5LWd1aWRlIGZvciBSSEVMNSBpbiBteQogICAgICAgICAgICAgICAg RmVkb3JhIDIzIG1hY2hpbmU7IHRoZW4gY29weSB0aGUgb3V0cHV0IHRvIG15IENlbnRPUyA1CiAg ICAgICAgICAgICAgICB0ZXN0aW5nIHNlcnZlcjo8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICB3Z2V0IDxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9z Y2FwLXNlY3VyaXR5LWd1aWRlL2FyY2hpdmUvdjAuMS4yOS50YXIuZ3oiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9hcmNoaXZl L3YwLjEuMjkudGFyLmd6PC9hPgogICAgICAgICAgICAgICAgLU8gc2NhcC1zZWN1cml0eS1ndWlk ZS0wLjEuMjkudGFyLmd6PGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg dGFyIC16eGYgc2NhcC1zZWN1cml0eS1ndWlkZS0wLjEuMjkudGFyLmd6PGJyPgogICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgbWFrZSAtQyBzY2FwLXNlY3VyaXR5LWd1aWRlLTAu MS4yOS9SSEVMLzUgZGlzdDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg IHNjcCAtciBzY2FwLXNlY3VyaXR5LWd1aWRlLTAuMS4yOS9SSEVMLzUvZGlzdC9jb250ZW50CiAg ICAgICAgICAgICAgICBjZW50b3M1LXRlc3Q6PGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRh aG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+Tm93CiAgICAgICAgICAgICAgICBpbiB0 aGUgQ2VudE9TIDUgdGVzdGluZyBzZXJ2ZXIsIGNyZWF0ZSBhIHRhaWxvcmluZyBmaWxlCiAgICAg ICAgICAgICAgICB0byBydW4gZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWQgdGVzdCBhbG9u ZTo8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBjYXQgJmd0O3NzZy1j ZW50b3M1LXhjY2RmLXRhaWxvcmluZy54bWwgJmx0OyZsdDsmcXVvdDtFT0YmcXVvdDs8YnI+CiAg ICAgICAgICAgICAgICAmbHQ7P3htbCB2ZXJzaW9uPSZxdW90OzEuMCZxdW90OyBlbmNvZGluZz0m cXVvdDtVVEYtOCZxdW90Oz8mZ3Q7PGJyPgogICAgICAgICAgICAgICAgJmx0O1RhaWxvcmluZyB4 bWxucz0mcXVvdDs8YSBocmVmPSJodHRwOi8vY2hlY2tsaXN0cy5uaXN0Lmdvdi94Y2NkZi8xLjIi IHRhcmdldD0iX2JsYW5rIj5odHRwOi8vY2hlY2tsaXN0cy5uaXN0Lmdvdi94Y2NkZi8xLjI8L2E+ JnF1b3Q7CiAgICAgICAgICAgICAgICBpZD0mcXVvdDt4Y2NkZl9zc2ctY2VudG9zNV90YWlsb3Jp bmdfeGNjZGYmcXVvdDsmZ3Q7PGJyPgogICAgICAgICAgICAgICAgwqDCoMKgICZsdDt2ZXJzaW9u CiAgICAgICAgICAgICAgICB0aW1lPSZxdW90OzIwMTYtMDYtMTRUMTk6NTA6NTcmcXVvdDsmZ3Q7 MSZsdDsvdmVyc2lvbiZndDs8YnI+CiAgICAgICAgICAgICAgICDCoMKgwqAgJmx0O1Byb2ZpbGUK ICAgICAgICAgICAgICAgIGlkPSZxdW90O3hjY2RmX215X3Byb2ZpbGVfc3RpZy1jZW50b3M1LXVw c3RyZWFtX3RhaWxvcmVkJnF1b3Q7Jmd0Ozxicj4KICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDC oMKgICZsdDt0aXRsZSZndDtDZW50T1MgNSBbVEFJTE9SRURdJmx0Oy90aXRsZSZndDs8YnI+CiAg ICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDCoCAmbHQ7c2VsZWN0IGlkcmVmPSZxdW90O2ZpbGVf cGVybWlzc2lvbnNfdW5ncm91cG93bmVkJnF1b3Q7CiAgICAgICAgICAgICAgICBzZWxlY3RlZD0m cXVvdDt0cnVlJnF1b3Q7LyZndDs8YnI+CiAgICAgICAgICAgICAgICDCoMKgwqAgJmx0Oy9Qcm9m aWxlJmd0Ozxicj4KICAgICAgICAgICAgICAgICZsdDsvVGFpbG9yaW5nJmd0Ozxicj4KICAgICAg ICAgICAgICAgIEVPRjxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Rp dj4KICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJp Zjtmb250LXNpemU6c21hbGwiPkNyZWF0ZQogICAgICAgICAgICAgICAgYSBmaWxlIHdpdGhvdXQg Y29ycmVzcG9uZGluZyBncm91cCBpbiAvZXRjL2dyb3VwOjxicj4KICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgIHRvdWNoIC9hbl91bm93bmVkX2dyb3VwX2ZpbGU8YnI+CiAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBjaGdycCA0NTY3IC9hbl91bm93bmVkX2dy b3VwX2ZpbGU8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBmaW5kIC8g LW5vZ3JvdXAgMiZndDsvZGV2L251bGw8YnI+CiAgICAgICAgICAgICAgICAvYW5fdW5vd25lZF9n cm91cF9maWxlICZsdDstLSBDaGVjayB0aGF0IGl0IGlzIGZvdW5kIDxicj4KICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJm b250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPjxicj4KICAgICAg ICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPkZpbmFsbHkKICAgICAgICAgICAgICAgIHJ1 biBvc2NhcDo8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8ZGl2IGNs YXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7 Zm9udC1zaXplOnNtYWxsO2Rpc3BsYXk6aW5saW5lIj7igIvigIs8L2Rpdj5vc2NhcCB4Y2NkZiBl dmFsIFw8YnI+CiAgICAgICAgICAgICAgICDCoMKgwqAgLS10YWlsb3JpbmctZmlsZSBzc2ctY2Vu dG9zNS14Y2NkZi10YWlsb3JpbmcueG1sIFw8YnI+CiAgICAgICAgICAgICAgICDCoMKgwqAgLS1w cm9maWxlCiAgICAgICAgICAgICAgICB4Y2NkZl9teV9wcm9maWxlX3N0aWctY2VudG9zNS11cHN0 cmVhbV90YWlsb3JlZCBcPGJyPgogICAgICAgICAgICAgICAgwqDCoMKgIC0tY3BlIGNvbnRlbnQv c3NnLXJoZWw1LWNwZS1kaWN0aW9uYXJ5LnhtbCBcPGJyPgogICAgICAgICAgICAgICAgwqDCoMKg IGNvbnRlbnQvc3NnLWNlbnRvczUteGNjZGYueG1sPGJyPgogICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5 OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+Li4uCiAgICAgICAgICAgICAgICBh bmQgb3V0cHV0IGlzOjxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIFRp dGxlwqDCoCBFbnN1cmUgQWxsIEZpbGVzIEFyZSBPd25lZCBieSBhIEdyb3VwPGJyPgogICAgICAg ICAgICAgICAgUnVsZcKgwqDCoCBmaWxlX3Blcm1pc3Npb25zX3VuZ3JvdXBvd25lZDxicj4KICAg ICAgICAgICAgICAgIElkZW50wqDCoCBHRU4wMDExNzA8YnI+CiAgICAgICAgICAgICAgICBSZXN1 bHTCoCBwYXNzPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvZGl2Pgog ICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2Zv bnQtc2l6ZTpzbWFsbCI+SQogICAgICAgICAgICAgICAgd291bGQgZXhwZWN0IHRoYXQgdGhlIHRl c3QgZmFpbHMgc2luY2UgdGhlcmUgaXMgYXQgbGVhc3QKICAgICAgICAgICAgICAgIG9uZSBmaWxl IHdpdGhvdXQgZXhpc3RpbmcgZ3JvdXAuPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9t YSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SQogICAgICAgICAgICAgICAgdG9vayBhIGxv b2sgYXQgdGhlIE9WQUwgZGVmaW5pdGlvbgogICAgICAgICAgICAgICAgc2NhcC1zZWN1cml0eS1n dWlkZS0wLjEuMjkvUkhFTC81L2lucHV0L292YWwvZmlsZV9wZXJtaXNzaW9uc191bmdyb3Vwb3du ZWQueG1sCiAgICAgICAgICAgICAgICBidXQgSSBkbyBub3Qgc2VlIGFueXRoaW5nIHdyb25nLjxi cj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAg ICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21h bGwiPkRvCiAgICAgICAgICAgICAgICB5b3UgaGF2ZSBhbnkgaWRlYSB3aHkgdGhpcyB0ZXN0IGlz IHBhc3Npbmcgd2hlbiBpdAogICAgICAgICAgICAgICAgc2hvdWxkIGZhaWw/PGJyPgogICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxkaXYgc3R5 bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+UmVnYXJk czxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgPC9kaXY+CiAgICAgIDwvZGl2PgogICAgPC9ibG9ja3F1b3Rl PgogICAgPGJyPjwvZGl2PjwvZGl2PgogICAgSGkgUm9kb2xmbywgPGJyPgogICAgPGJyPgogICAg wqDCoMKgIFRoYW5rcyBmb3IgcmVwb3J0aW5nIHRoaXMhIEkmIzM5O3ZlIHVwZGF0ZWQgdGhlIFJI RUw1IGNvbnRlbnQgdG8gdXNlCiAgICB0aGUgdXBkYXRlZCBmaWxlX3Blcm1pc3Npb25zX3VuZ3Jv dXBvd25lZCBjaGVjazo8YnI+CiAgICA8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3BlblND QVAvc2NhcC1zZWN1cml0eS1ndWlkZS9wdWxsLzEyOTYiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9wdWxsLzEyOTY8L2E+PGJy PgogICAgPGJyPgogICAgwqDCoMKgIFRoYXQgc2hvdWxkIGdldCBtZXJnZWQgaW4gdGhlIG5leHQg ZmV3IGRheXMgcGVuZGluZyBwZWVyIHJldmlldy4KICAgIElmIHlvdSBjb3VsZCB0ZXN0IHRoZSBQ UiBhbmQgdmVyaWZ5IHRoaXMgd29ya3MgZm9yIHlvdSwgdGhhdCYjMzk7ZCBiZQogICAgZ3JlYXQh PHNwYW4gY2xhc3M9IiI+PGZvbnQgY29sb3I9IiM4ODg4ODgiPjxicj4KICAgIDxicj4KICAgIFNo YXduCiAgPC9mb250Pjwvc3Bhbj48L2Rpdj4KCjxicj4tLTxicj4KU0NBUCBTZWN1cml0eSBHdWlk ZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxp c3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9z dGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9h ZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIHJl bD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVk Lm9yZy9hZG1pbi9saXN0cy9zY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1 cml0eS1ndWlkZS8iIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0 aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLzwvYT48YnI+Cjxicj48L2Jsb2Nr cXVvdGU+PC9kaXY+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZh bWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPuKAizxkaXYgY2xhc3M9Imdt YWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNp emU6c21hbGwiPkhpIFNoYXduLDxicj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVs dCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+ SQogdGhpbmsgdGhlIHByb2JsZW0gaXMgbm90IHdpdGggdGhlIE9WQUwgZGVmaW5pdGlvbiwgdGhl IHNoYXJlZCBhbmQgUkhFTDUKIHZlcnNpb25zIGFyZSBwcmFjdGljYWxseSB0aGUgc2FtZS4gSSB0 aGluayB0aGUgaXNzdWUgaXMgaW4gb3NjYXAuIEJlbG93CiBpcyB0aGUgdGVzdCBvZiB0aGUgUFIu IEl0IGlzIHN0aWxsIG5vdCB3b3JraW5nIGNvcnJlY3RseS48YnI+PC9kaXY+PGRpdiBjbGFzcz0i Z21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQt c2l6ZTpzbWFsbCI+PGJyPiMgdG91Y2ggL3RtcC91bmdyb3VwZWRvd25lZF9maWxlPGJyPiMgY2hn cnAgNDU2NyAvdG1wL3VuZ3JvdXBlZG93bmVkX2ZpbGU8YnI+IyBmaW5kIC8gLW5vZ3JvdXAgMiZn dDsvZGV2L251bGw8YnI+L3RtcC91bmdyb3VwZWRvd25lZF9maWxlwqAgJmx0Oz09IENvbmZpcm1h dGlvbiB0aGF0IGl0IGlzIGFuIHVuZ3JvdXBlZCBvd25lZCBmaWxlPGJyPjwvZGl2PjxkaXYgY2xh c3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtm b250LXNpemU6c21hbGwiPjxicj7igIsjIG9zY2FwIHhjY2RmIGV2YWwgXDxicj7CoMKgwqAgLS10 YWlsb3JpbmctZmlsZSBzc2ctY2VudG9zNS14Y2NkZi10YWlsb3JpbmcueG1sIFw8YnI+wqDCoMKg IC0tcHJvZmlsZSB4Y2NkZl9teV9wcm9maWxlX3N0aWctY2VudG9zNS11cHN0cmVhbV90YWlsb3Jl ZCBcPGJyPsKgwqDCoCAtLWNwZSBjb250ZW50L3NzZy1yaGVsNS1jcGUtZGljdGlvbmFyeS54bWwg XDxicj7CoMKgwqAgY29udGVudC9zc2ctY2VudG9zNS14Y2NkZi54bWw8YnI+PGJyPlRpdGxlwqDC oCBFbnN1cmUgQWxsIEZpbGVzIEFyZSBPd25lZCBieSBhIEdyb3VwPGJyPlJ1bGXCoMKgwqAgZmls ZV9wZXJtaXNzaW9uc191bmdyb3Vwb3duZWQ8YnI+SWRlbnTCoMKgIEdFTjAwMTE3MDxicj5SZXN1 bHTCoCBwYXNzwqDCoCAmbHQ7PT0gSXQgc2hvdWxkIGZhaWw8YnI+4oCLPC9kaXY+PGRpdiBjbGFz cz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2Zv bnQtc2l6ZTpzbWFsbCI+PGJyPuKAi1NhbWUgT1ZBTCBkZWZpbml0aW9uIGlzIHdvcmtpbmcgZmlu ZSBpbiBSSEVML0NlbnRPUyA2IGFuZCA3IHdpdGggb3BlbnNjYXAtMS4yLng8YnI+PC9kaXY+PGJy IGNsZWFyPSJhbGwiPjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfc2lnbmF0dXJlIiBkYXRhLXNtYXJ0 bWFpbD0iZ21haWxfc2lnbmF0dXJlIj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZiI+PGZvbnQgc2l6ZT0iMiI+LS08YnI+PC9mb250PjwvZGl2PjxkaXYgc3R5bGU9ImZv bnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj48Zm9udCBzaXplPSIyIj5Sb2RvbGZvIE1hcnTD rW5lejwvZm9udD48L2Rpdj48L2Rpdj48L2Rpdj4K4oCLPC9kaXY+PGJyPjwvZGl2PjwvZGl2Pgo= --===============1643769711992037035==-- From jlieskov at redhat.com Fri Jun 24 15:21:31 2016 Content-Type: multipart/mixed; boundary="===============1958370376794646041==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: SCAP Security Guide 0.1.30 Date: Fri, 24 Jun 2016 11:21:23 -0400 Message-ID: <226123128.2107515.1466781683580.JavaMail.zimbra@redhat.com> In-Reply-To: 1080605487.2105705.1466781112666.JavaMail.zimbra@redhat.com --===============1958370376794646041== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello folks, it's my pleasure and honor to announce that SCAP Security Guide release 0.1.30 has been created and is now available for download. Highlights of this release: * CNSS No.1253 (nist-CL-IL-AL) profile has been ported to Red Hat Enterprise Linux 7, * SCAP benchmark for Red Hat Enterprise Linux 7 now passes official NIST SCAP ScapVal-1.2.14.1 content validation tool requirements, * The XCCDF rules for Red Hat Enterprise Linux 7 has been equipped with CCE identifiers, * New CJIS "Criminal Justice Information Services (CJIS) Security Policy" profile has been added to Red Hat Enterprise Linux 7 benchmark, * Profile for each ANSSI hardening level for NP targets has been added to Debian 8 benchmark, * Remediation scripts don't rely on external /usr/share/scap-security-guide/remediation_functions shell library any more (instead starting from this release the remediation scripts are part of the specific benchmark itself). This allows to perform remediation without the need to have scap-security-guide RPM package being installed. For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=3Dmilestone%3A0.= 1.30 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30= /scap-security-guide-0.1.30.zip (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30= /scap-security-guide-0.1.30-oval-5.10.zip (Zip archive using OVAL-5.10 language version) Happy hardening! Regards, Jan -- Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream team) --===============1958370376794646041==-- From jlieskov at redhat.com Fri Jun 24 16:16:11 2016 Content-Type: multipart/mixed; boundary="===============3732960789409955464==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: [Proposal] Replace SSG feature milestones on GitHub with GH feature labels -- any objections? Date: Fri, 24 Jun 2016 12:16:01 -0400 Message-ID: <245226129.2122522.1466784961289.JavaMail.zimbra@redhat.com> In-Reply-To: 1221307602.2119744.1466784337709.JavaMail.zimbra@redhat.com --===============3732960789409955464== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello folks, so there are these SSG "feature milestones" on GitHub: * Infrastructure Enhancements and Fixes (https://github.com/OpenSCAP/scap-security-guide/milestones/Infrastruct= ure%20Enhancements%20and%20Fixes) * RHEL7 NIAP/USGCB Submission (https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL7%20NIA= P/USGCB%20Submission) * NIST 800-53 identifiers assignment (https://github.com/OpenSCAP/scap-security-guide/milestones/NIST%20800-= 53%20identifiers%20assignment) * Unimplemented OVAL checks (https://github.com/OpenSCAP/scap-security-guide/milestones/Unimplement= ed%20OVAL%20checks) = * RHEL-6 USGCB Profile Review (https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL-6%20US= GCB%20Profile%20Review) * Draft RHEL 7 STIG (https://github.com/OpenSCAP/scap-security-guide/milestones/Draft%20RHE= L%207%20STIG%20) There are two issues with the current approach: * they are updated very seldom -- basically only in moment new release is c= reated, * they don't allow to reference all issues fixed in one particular release = -- when some change is made (let's suppose it's related with RHEL 7 STIG effort), the = corresponding change is tagged with "Draft RHEL 7 STIG" milestone. But it also belongs to some specific release (suppose 0.1.30 in this case= ). Trying to obtain all changes finished in 0.1.30 release this change wouldn't be present th= ere, because it has "Draft RHEL7 STIG" milestone instead of "0.1.30" one. Therefore the proposal is to move this SSG feature milestones into GitHub l= abels instead. This way it will be possible to have just numeric milestones (0.1.31, 0.1.3= 2, ...) and assign labels to pull request (so we won't loose the information some chang= e / PR is relevant to "RHEL 7 STIG" effort). Simultaneously will be able truly to list all cha= nges that have been finished in particular release. I can turn the feature milestones into feature labels. But prior to doing t= hat wanted to know if there are some concerns / objections against doing that? Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team --===============3732960789409955464==-- From shawn at redhat.com Fri Jun 24 16:19:24 2016 Content-Type: multipart/mixed; boundary="===============3450474645602298890==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [Proposal] Replace SSG feature milestones on GitHub with GH feature labels -- any objections? Date: Fri, 24 Jun 2016 12:19:13 -0400 Message-ID: <576D5D81.4060008@redhat.com> In-Reply-To: 245226129.2122522.1466784961289.JavaMail.zimbra@redhat.com --===============3450474645602298890== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 6/24/16 12:16 PM, Jan Lieskovsky wrote: > Hello folks, > > so there are these SSG "feature milestones" on GitHub: > * Infrastructure Enhancements and Fixes > (https://github.com/OpenSCAP/scap-security-guide/milestones/Infrastr= ucture%20Enhancements%20and%20Fixes) > > * RHEL7 NIAP/USGCB Submission > (https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL7%20= NIAP/USGCB%20Submission) > > * NIST 800-53 identifiers assignment > (https://github.com/OpenSCAP/scap-security-guide/milestones/NIST%208= 00-53%20identifiers%20assignment) > > * Unimplemented OVAL checks > (https://github.com/OpenSCAP/scap-security-guide/milestones/Unimplem= ented%20OVAL%20checks) > = > * RHEL-6 USGCB Profile Review > (https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL-6%2= 0USGCB%20Profile%20Review) > > * Draft RHEL 7 STIG > (https://github.com/OpenSCAP/scap-security-guide/milestones/Draft%20= RHEL%207%20STIG%20) > > There are two issues with the current approach: > * they are updated very seldom -- basically only in moment new release is= created, > * they don't allow to reference all issues fixed in one particular releas= e -- when some > change is made (let's suppose it's related with RHEL 7 STIG effort), t= he corresponding > change is tagged with "Draft RHEL 7 STIG" milestone. > > But it also belongs to some specific release (suppose 0.1.30 in this c= ase). Trying to obtain > all changes finished in 0.1.30 release this change wouldn't be present= there, because it has > "Draft RHEL7 STIG" milestone instead of "0.1.30" one. > > Therefore the proposal is to move this SSG feature milestones into GitHub= labels instead. > This way it will be possible to have just numeric milestones (0.1.31, 0.1= .32, ...) and > assign labels to pull request (so we won't loose the information some cha= nge / PR is relevant > to "RHEL 7 STIG" effort). Simultaneously will be able truly to list all c= hanges that have > been finished in particular release. > > I can turn the feature milestones into feature labels. But prior to doing= that > wanted to know if there are some concerns / objections against doing that? None from my side. Makes all the sense in the world. Should make release = notes much much easier to create. -- = Shawn Wells Chief Security Strategist U.S. Public Sector shawn(a)redhat.com | 443.534.0130 --===============3450474645602298890==-- From redhatrises at gmail.com Fri Jun 24 16:41:24 2016 Content-Type: multipart/mixed; boundary="===============8482409386190518707==" MIME-Version: 1.0 From: Gabe Alford To: scap-security-guide at lists.fedorahosted.org Subject: Re: [Proposal] Replace SSG feature milestones on GitHub with GH feature labels -- any objections? Date: Fri, 24 Jun 2016 10:41:11 -0600 Message-ID: In-Reply-To: 576D5D81.4060008@redhat.com --===============8482409386190518707== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Fri, Jun 24, 2016 at 10:19 AM, Shawn Wells wrote: > > > On 6/24/16 12:16 PM, Jan Lieskovsky wrote: > >> Hello folks, >> >> so there are these SSG "feature milestones" on GitHub: >> * Infrastructure Enhancements and Fixes >> ( >> https://github.com/OpenSCAP/scap-security-guide/milestones/Infrastructur= e%20Enhancements%20and%20Fixes >> ) >> >> * RHEL7 NIAP/USGCB Submission >> ( >> https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL7%20NIAP/= USGCB%20Submission >> ) >> >> * NIST 800-53 identifiers assignment >> ( >> https://github.com/OpenSCAP/scap-security-guide/milestones/NIST%20800-53= %20identifiers%20assignment >> ) >> >> * Unimplemented OVAL checks >> ( >> https://github.com/OpenSCAP/scap-security-guide/milestones/Unimplemented= %20OVAL%20checks >> ) >> * RHEL-6 USGCB Profile Review >> ( >> https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL-6%20USGC= B%20Profile%20Review >> ) >> >> * Draft RHEL 7 STIG >> ( >> https://github.com/OpenSCAP/scap-security-guide/milestones/Draft%20RHEL%= 207%20STIG%20 >> ) >> >> There are two issues with the current approach: >> * they are updated very seldom -- basically only in moment new release is >> created, >> * they don't allow to reference all issues fixed in one particular >> release -- when some >> change is made (let's suppose it's related with RHEL 7 STIG effort), >> the corresponding >> change is tagged with "Draft RHEL 7 STIG" milestone. >> >> But it also belongs to some specific release (suppose 0.1.30 in this >> case). Trying to obtain >> all changes finished in 0.1.30 release this change wouldn't be present >> there, because it has >> "Draft RHEL7 STIG" milestone instead of "0.1.30" one. >> >> Therefore the proposal is to move this SSG feature milestones into GitHub >> labels instead. >> This way it will be possible to have just numeric milestones (0.1.31, >> 0.1.32, ...) and >> assign labels to pull request (so we won't loose the information some >> change / PR is relevant >> to "RHEL 7 STIG" effort). Simultaneously will be able truly to list all >> changes that have >> been finished in particular release. >> >> I can turn the feature milestones into feature labels. But prior to doing >> that >> wanted to know if there are some concerns / objections against doing tha= t? >> > > None from my side. Makes all the sense in the world. Should make release > notes much much easier to create. I'd say that or we do a better job of moving tickets/PRs to the actual release Milestones. Or have separate branches associated the respective Milestones and merge those branches into the master when the milestone is complete like a ton of other projects do. Gabe --===============8482409386190518707== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxkaXYgY2xhc3M9ImdtYWls X3F1b3RlIj5PbiBGcmksIEp1biAyNCwgMjAxNiBhdCAxMDoxOSBBTSwgU2hhd24gV2VsbHMgPHNw YW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPnNoYXduQHJlZGhhdC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9j a3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRl ci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgY2xhc3M9IkhPRW5a YiI+PGRpdiBjbGFzcz0iaDUiPjxicj4KPGJyPgpPbiA2LzI0LzE2IDEyOjE2IFBNLCBKYW4gTGll c2tvdnNreSB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9 Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVm dDoxZXgiPgpIZWxsbyBmb2xrcyw8YnI+Cjxicj4KwqAgwqBzbyB0aGVyZSBhcmUgdGhlc2UgU1NH ICZxdW90O2ZlYXR1cmUgbWlsZXN0b25lcyZxdW90OyBvbiBHaXRIdWI6PGJyPgrCoCDCoCogSW5m cmFzdHJ1Y3R1cmUgRW5oYW5jZW1lbnRzIGFuZCBGaXhlczxicj4KwqAgwqAgwqAoPGEgaHJlZj0i aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvbWlsZXN0b25l cy9JbmZyYXN0cnVjdHVyZSUyMEVuaGFuY2VtZW50cyUyMGFuZCUyMEZpeGVzIiByZWw9Im5vcmVm ZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1z ZWN1cml0eS1ndWlkZS9taWxlc3RvbmVzL0luZnJhc3RydWN0dXJlJTIwRW5oYW5jZW1lbnRzJTIw YW5kJTIwRml4ZXM8L2E+KTxicj4KPGJyPgrCoCDCoCogUkhFTDcgTklBUC9VU0dDQiBTdWJtaXNz aW9uPGJyPgrCoCDCoCDCoCg8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2Nh cC1zZWN1cml0eS1ndWlkZS9taWxlc3RvbmVzL1JIRUw3JTIwTklBUC9VU0dDQiUyMFN1Ym1pc3Np b24iIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNvbS9P cGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlL21pbGVzdG9uZXMvUkhFTDclMjBOSUFQL1VTR0NC JTIwU3VibWlzc2lvbjwvYT4pPGJyPgo8YnI+CsKgIMKgKiBOSVNUIDgwMC01MyBpZGVudGlmaWVy cyBhc3NpZ25tZW50PGJyPgrCoCDCoCDCoCg8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3Bl blNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9taWxlc3RvbmVzL05JU1QlMjA4MDAtNTMlMjBpZGVu dGlmaWVycyUyMGFzc2lnbm1lbnQiIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlL21pbGVzdG9uZXMv TklTVCUyMDgwMC01MyUyMGlkZW50aWZpZXJzJTIwYXNzaWdubWVudDwvYT4pPGJyPgo8YnI+CsKg IMKgKiBVbmltcGxlbWVudGVkIE9WQUwgY2hlY2tzPGJyPgrCoCDCoCDCoCg8YSBocmVmPSJodHRw czovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9taWxlc3RvbmVzL1Vu aW1wbGVtZW50ZWQlMjBPVkFMJTIwY2hlY2tzIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9taWxl c3RvbmVzL1VuaW1wbGVtZW50ZWQlMjBPVkFMJTIwY2hlY2tzPC9hPik8YnI+CsKgIMKgIMKgKiBS SEVMLTYgVVNHQ0IgUHJvZmlsZSBSZXZpZXc8YnI+CsKgIMKgIMKgKDxhIGhyZWY9Imh0dHBzOi8v Z2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlL21pbGVzdG9uZXMvUkhFTC02 JTIwVVNHQ0IlMjBQcm9maWxlJTIwUmV2aWV3IiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9taWxl c3RvbmVzL1JIRUwtNiUyMFVTR0NCJTIwUHJvZmlsZSUyMFJldmlldzwvYT4pPGJyPgo8YnI+CsKg IMKgKiBEcmFmdCBSSEVMIDcgU1RJRzxicj4KwqAgwqAgwqAoPGEgaHJlZj0iaHR0cHM6Ly9naXRo dWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvbWlsZXN0b25lcy9EcmFmdCUyMFJI RUwlMjA3JTIwU1RJRyUyMCIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvbWlsZXN0b25lcy9EcmFm dCUyMFJIRUwlMjA3JTIwU1RJRyUyMDwvYT4pPGJyPgo8YnI+ClRoZXJlIGFyZSB0d28gaXNzdWVz IHdpdGggdGhlIGN1cnJlbnQgYXBwcm9hY2g6PGJyPgoqIHRoZXkgYXJlIHVwZGF0ZWQgdmVyeSBz ZWxkb20gLS0gYmFzaWNhbGx5IG9ubHkgaW4gbW9tZW50IG5ldyByZWxlYXNlIGlzIGNyZWF0ZWQs PGJyPgoqIHRoZXkgZG9uJiMzOTt0IGFsbG93IHRvIHJlZmVyZW5jZSBhbGwgaXNzdWVzIGZpeGVk IGluIG9uZSBwYXJ0aWN1bGFyIHJlbGVhc2UgLS0gd2hlbiBzb21lPGJyPgrCoCDCoGNoYW5nZSBp cyBtYWRlIChsZXQmIzM5O3Mgc3VwcG9zZSBpdCYjMzk7cyByZWxhdGVkIHdpdGggUkhFTCA3IFNU SUcgZWZmb3J0KSwgdGhlIGNvcnJlc3BvbmRpbmc8YnI+CsKgIMKgY2hhbmdlIGlzIHRhZ2dlZCB3 aXRoICZxdW90O0RyYWZ0IFJIRUwgNyBTVElHJnF1b3Q7IG1pbGVzdG9uZS48YnI+Cjxicj4KwqAg wqBCdXQgaXQgYWxzbyBiZWxvbmdzIHRvIHNvbWUgc3BlY2lmaWMgcmVsZWFzZSAoc3VwcG9zZSAw LjEuMzAgaW4gdGhpcyBjYXNlKS4gVHJ5aW5nIHRvIG9idGFpbjxicj4KwqAgwqBhbGwgY2hhbmdl cyBmaW5pc2hlZCBpbiAwLjEuMzAgcmVsZWFzZSB0aGlzIGNoYW5nZSB3b3VsZG4mIzM5O3QgYmUg cHJlc2VudCB0aGVyZSwgYmVjYXVzZSBpdCBoYXM8YnI+CsKgIMKgJnF1b3Q7RHJhZnQgUkhFTDcg U1RJRyZxdW90OyBtaWxlc3RvbmUgaW5zdGVhZCBvZiAmcXVvdDswLjEuMzAmcXVvdDsgb25lLjxi cj4KPGJyPgpUaGVyZWZvcmUgdGhlIHByb3Bvc2FsIGlzIHRvIG1vdmUgdGhpcyBTU0cgZmVhdHVy ZSBtaWxlc3RvbmVzIGludG8gR2l0SHViIGxhYmVscyBpbnN0ZWFkLjxicj4KVGhpcyB3YXkgaXQg d2lsbCBiZSBwb3NzaWJsZSB0byBoYXZlIGp1c3QgbnVtZXJpYyBtaWxlc3RvbmVzICgwLjEuMzEs IDAuMS4zMiwgLi4uKSBhbmQ8YnI+CmFzc2lnbiBsYWJlbHMgdG8gcHVsbCByZXF1ZXN0IChzbyB3 ZSB3b24mIzM5O3QgbG9vc2UgdGhlIGluZm9ybWF0aW9uIHNvbWUgY2hhbmdlIC8gUFIgaXMgcmVs ZXZhbnQ8YnI+CnRvICZxdW90O1JIRUwgNyBTVElHJnF1b3Q7IGVmZm9ydCkuIFNpbXVsdGFuZW91 c2x5IHdpbGwgYmUgYWJsZSB0cnVseSB0byBsaXN0IGFsbCBjaGFuZ2VzIHRoYXQgaGF2ZTxicj4K YmVlbiBmaW5pc2hlZCBpbiBwYXJ0aWN1bGFyIHJlbGVhc2UuPGJyPgo8YnI+CkkgY2FuIHR1cm4g dGhlIGZlYXR1cmUgbWlsZXN0b25lcyBpbnRvIGZlYXR1cmUgbGFiZWxzLiBCdXQgcHJpb3IgdG8g ZG9pbmcgdGhhdDxicj4Kd2FudGVkIHRvIGtub3cgaWYgdGhlcmUgYXJlIHNvbWUgY29uY2VybnMg LyBvYmplY3Rpb25zIGFnYWluc3QgZG9pbmcgdGhhdD88YnI+CjwvYmxvY2txdW90ZT4KPGJyPjwv ZGl2PjwvZGl2PgpOb25lIGZyb20gbXkgc2lkZS4gTWFrZXMgYWxsIHRoZSBzZW5zZSBpbiB0aGUg d29ybGQuIFNob3VsZCBtYWtlIHJlbGVhc2Ugbm90ZXMgbXVjaCBtdWNoIGVhc2llciB0byBjcmVh dGUuPHNwYW4gY2xhc3M9IkhPRW5aYiI+PC9zcGFuPjwvYmxvY2txdW90ZT48ZGl2Pjxicj48L2Rp dj48ZGl2PkkmIzM5O2Qgc2F5IHRoYXQgb3Igd2UgZG8gYSBiZXR0ZXIgam9iIG9mIG1vdmluZyB0 aWNrZXRzL1BScyB0byB0aGUgYWN0dWFsIHJlbGVhc2UgTWlsZXN0b25lcy4gT3IgaGF2ZSBzZXBh cmF0ZSBicmFuY2hlcyBhc3NvY2lhdGVkPGJyPnRoZSByZXNwZWN0aXZlIE1pbGVzdG9uZXMgYW5k IG1lcmdlIHRob3NlIGJyYW5jaGVzIGludG8gdGhlIG1hc3RlciB3aGVuIHRoZSBtaWxlc3RvbmUg aXMgY29tcGxldGUgbGlrZSBhIHRvbiBvZiBvdGhlciBwcm9qZWN0cyBkby48YnI+PGJyPjwvZGl2 PjxkaXY+R2FiZTxicj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj4K --===============8482409386190518707==-- From zmoravec at redhat.com Mon Jun 27 09:04:04 2016 Content-Type: multipart/mixed; boundary="===============8979001201706662242==" MIME-Version: 1.0 From: Zbynek Moravec To: scap-security-guide at lists.fedorahosted.org Subject: Re: [Proposal] Replace SSG feature milestones on GitHub with GH feature labels -- any objections? Date: Mon, 27 Jun 2016 05:03:55 -0400 Message-ID: <913689088.6835122.1467018235534.JavaMail.zimbra@redhat.com> In-Reply-To: CAGLxfGwfru7kAmoUwv8MDwOYHxKzCs1ym1dGYb28Cn0zBquTTg@mail.gmail.com --===============8979001201706662242== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > From: "Gabe Alford" > To: "SCAP Security Guide" > Sent: Friday, June 24, 2016 6:41:11 PM > Subject: Re: [Proposal] Replace SSG feature milestones on GitHub with GH = feature labels -- any objections? > = > On Fri, Jun 24, 2016 at 10:19 AM, Shawn Wells < shawn(a)redhat.com > wrot= e: > = > = > = > = > = > On 6/24/16 12:16 PM, Jan Lieskovsky wrote: > = > = > Hello folks, > = > so there are these SSG "feature milestones" on GitHub: > * Infrastructure Enhancements and Fixes > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/Infrastructure= %20Enhancements%20and%20Fixes > ) > = > * RHEL7 NIAP/USGCB Submission > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL7%20NIAP/U= SGCB%20Submission > ) > = > * NIST 800-53 identifiers assignment > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/NIST%20800-53%= 20identifiers%20assignment > ) > = > * Unimplemented OVAL checks > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/Unimplemented%= 20OVAL%20checks > ) > * RHEL-6 USGCB Profile Review > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL-6%20USGCB= %20Profile%20Review > ) > = > * Draft RHEL 7 STIG > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/Draft%20RHEL%2= 07%20STIG%20 > ) > = > There are two issues with the current approach: > * they are updated very seldom -- basically only in moment new release is > created, > * they don't allow to reference all issues fixed in one particular releas= e -- > when some > change is made (let's suppose it's related with RHEL 7 STIG effort), the > corresponding > change is tagged with "Draft RHEL 7 STIG" milestone. > = > But it also belongs to some specific release (suppose 0.1.30 in this case= ). > Trying to obtain > all changes finished in 0.1.30 release this change wouldn't be present th= ere, > because it has > "Draft RHEL7 STIG" milestone instead of "0.1.30" one. > = > Therefore the proposal is to move this SSG feature milestones into GitHub > labels instead. > This way it will be possible to have just numeric milestones (0.1.31, 0.1= .32, > ...) and > assign labels to pull request (so we won't loose the information some cha= nge > / PR is relevant > to "RHEL 7 STIG" effort). Simultaneously will be able truly to list all > changes that have > been finished in particular release. > = > I can turn the feature milestones into feature labels. But prior to doing > that > wanted to know if there are some concerns / objections against doing that? > = I think, labels are very versatile and I don't see any reason why don't use= them in such way. > None from my side. Makes all the sense in the world. Should make release > notes much much easier to create. > = > I'd say that or we do a better job of moving tickets/PRs to the actual > release Milestones. Or have separate branches associated > the respective Milestones and merge those branches into the master when t= he > milestone is complete like a ton of other projects do. I am afraid, that making of many branches could bring quite problems after = some larger structure changes - complicated merging. > = > Gabe > = > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ --===============8979001201706662242==-- From swells at redhat.com Tue Jun 28 23:03:53 2016 Content-Type: multipart/mixed; boundary="===============5272756166963280107==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: SSG namespace in rhel7 data steam Date: Tue, 28 Jun 2016 16:03:43 -0700 Message-ID: <-5362265109430896519@unknownmsgid> --===============5272756166963280107== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable In the rhel7 rpm we use the ssgproject.org namespace in the data stream file. Should we change that to RedHat.com or at least open-scap.org? --===============5272756166963280107==-- From bdiamond at hushmail.com Wed Jun 29 08:53:21 2016 Content-Type: multipart/mixed; boundary="===============8793797549764495926==" MIME-Version: 1.0 From: Bill Diamond To: scap-security-guide at lists.fedorahosted.org Subject: Re: SSG namespace in rhel7 data steam Date: Tue, 28 Jun 2016 21:25:43 -0700 Message-ID: <559814243d2efe9ef8b2c26d5c1665af@smtp.hushmail.com> In-Reply-To: -5362265109430896519@unknownmsgid --===============8793797549764495926== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I'd concur with the namespace change to support delineation with other proj= ects. The specific namespace is important: there are multiple projects, suc= h as PCI-DSS ongoing. Bill (aka billd(a)redhat.com) > On Jun 28, 2016, at 16:03, Shawn Wells wrote: > = > In the rhel7 rpm we use the ssgproject.org namespace in the data > stream file. Should we change that to RedHat.com or at least > open-scap.org? > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ --===============8793797549764495926==-- From jlieskov at redhat.com Wed Jun 29 11:53:21 2016 Content-Type: multipart/mixed; boundary="===============4707514889013542329==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: SSG namespace in rhel7 data steam Date: Wed, 29 Jun 2016 07:53:12 -0400 Message-ID: <71464829.3468910.1467201192366.JavaMail.zimbra@redhat.com> In-Reply-To: -5362265109430896519@unknownmsgid --===============4707514889013542329== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hey Shawn, ----- Original Message ----- > From: "Shawn Wells" > To: "scap-security-guide" > Sent: Wednesday, June 29, 2016 1:03:43 AM > Subject: SSG namespace in rhel7 data steam > = > In the rhel7 rpm we use the ssgproject.org namespace in the data > stream file. Nice catch. > Should we change that to RedHat.com or at least > open-scap.org? FWIW for me I like the latter one better (since people might get wondering why e.g. Debian/8 benchmark has RedHat.com in the datastream namespace). Especially when the Debian/8 benchmark wasn't contributed by Red Hat AFAIK. Having separate strings in datastream namespaces for various products isn't a way to go either IMHO (since it would introduce worthless? complexity). >From the above the latter proposal comes out like reasonable alternative. Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ >=20 --===============4707514889013542329==-- From jlieskov at redhat.com Wed Jun 29 12:10:53 2016 Content-Type: multipart/mixed; boundary="===============3432472113940547205==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [Proposal] Replace SSG feature milestones on GitHub with GH feature labels -- any objections? Date: Wed, 29 Jun 2016 08:10:45 -0400 Message-ID: <205700461.3475665.1467202245476.JavaMail.zimbra@redhat.com> In-Reply-To: CAGLxfGwfru7kAmoUwv8MDwOYHxKzCs1ym1dGYb28Cn0zBquTTg@mail.gmail.com --===============3432472113940547205== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Gabe, ----- Original Message ----- > From: "Gabe Alford" > To: "SCAP Security Guide" > Sent: Friday, June 24, 2016 6:41:11 PM > Subject: Re: [Proposal] Replace SSG feature milestones on GitHub with GH = feature labels -- any objections? > = > On Fri, Jun 24, 2016 at 10:19 AM, Shawn Wells < shawn(a)redhat.com > wrot= e: > = > = > = > = > = > On 6/24/16 12:16 PM, Jan Lieskovsky wrote: > = > = > Hello folks, > = > so there are these SSG "feature milestones" on GitHub: > * Infrastructure Enhancements and Fixes > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/Infrastructure= %20Enhancements%20and%20Fixes > ) > = > * RHEL7 NIAP/USGCB Submission > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL7%20NIAP/U= SGCB%20Submission > ) > = > * NIST 800-53 identifiers assignment > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/NIST%20800-53%= 20identifiers%20assignment > ) > = > * Unimplemented OVAL checks > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/Unimplemented%= 20OVAL%20checks > ) > * RHEL-6 USGCB Profile Review > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/RHEL-6%20USGCB= %20Profile%20Review > ) > = > * Draft RHEL 7 STIG > ( > https://github.com/OpenSCAP/scap-security-guide/milestones/Draft%20RHEL%2= 07%20STIG%20 > ) > = > There are two issues with the current approach: > * they are updated very seldom -- basically only in moment new release is > created, > * they don't allow to reference all issues fixed in one particular releas= e -- > when some > change is made (let's suppose it's related with RHEL 7 STIG effort), the > corresponding > change is tagged with "Draft RHEL 7 STIG" milestone. > = > But it also belongs to some specific release (suppose 0.1.30 in this case= ). > Trying to obtain > all changes finished in 0.1.30 release this change wouldn't be present th= ere, > because it has > "Draft RHEL7 STIG" milestone instead of "0.1.30" one. > = > Therefore the proposal is to move this SSG feature milestones into GitHub > labels instead. > This way it will be possible to have just numeric milestones (0.1.31, 0.1= .32, > ...) and > assign labels to pull request (so we won't loose the information some cha= nge > / PR is relevant > to "RHEL 7 STIG" effort). Simultaneously will be able truly to list all > changes that have > been finished in particular release. > = > I can turn the feature milestones into feature labels. But prior to doing > that > wanted to know if there are some concerns / objections against doing that? > = > None from my side. Makes all the sense in the world. Should make release > notes much much easier to create. > = > I'd say that or we do a better job of moving tickets/PRs to the actual > release Milestones. IMHO from the nature of e.g. "RHEL-7 STIG" milestone, the issue being it's very unlikely we will address them in timeframe of one release (1-2 months). This is not just due the scope of changes that need to be implemented, but also partly due to us depending on external 3rd parties when implementing such effort (e.g. some standard first formally needs to be finished, till we can implement it in SCAP). So often we = can't ensure this effort will be finished in 1-2 months. IMHO labels approach is better in this situations, since label can span across multiple releases. And having milestones corresponding just to numeric release numbers, will ensure each issue: * can be tracked down to belong to particular release (e.g. it was fixed in 0.1.18 or 0.1.27 release). Right now, additional steps are necessary to find out, in which specific release the issue got actually fixed (basically just by mapping the date where it got corrected), * the nature / point of the change will still be visible (e.g. by having "RHEL-7 STIG" label it would be immediately clear this change belongs to finish "RHEL-7 STIG" support effort etc.) > Or have separate branches associated > the respective Milestones and merge those branches into the master when t= he > milestone is complete like a ton of other projects do. -1 on this approach due to maintenance burden. Suppose 20 such branches (not that much crazy idea given the count of features / products we are enhancing in parallel right now). Who will maintain those branches to keep them updated and address the conflicts? Another PoV -- suppose a month or two when we wouldn't do any other change, than just progressing with some of those current milestones (e.g. we would made couple of changes to "Missing OVALs" one, couple of changes to "RHEL-7= STIG" support one, and for example also to "RHEL-6 USGCB review" one). But none of them would be completed during that period. What should go into the rele= ase notes? (we couldn't mention the changes because the corresponding branches wouldn't be merged into master yet) Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > Gabe > = > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/admin/lists/scap-security-guide(a)lists.fe= dorahosted.org > https://github.com/OpenSCAP/scap-security-guide/ >=20 --===============3432472113940547205==-- From MatthewWilkinson at alliantenergy.com Wed Jun 29 20:51:31 2016 Content-Type: multipart/mixed; boundary="===============2763140290005782110==" MIME-Version: 1.0 From: Wilkinson, Matthew To: scap-security-guide at lists.fedorahosted.org Subject: Roadmap for RHEL 7 SSG Date: Wed, 29 Jun 2016 20:51:11 +0000 Message-ID: <6c1beb492ee44fa0b1afa9e08410b192@CIDWINEXCH2.ALI.PRI> --===============2763140290005782110== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Is there a roadmap for a final implementation of the RHEL 7 SSG? I'm curiou= s when I can build a security baseline based off of the SCAP Security Guide= for RHEL 7. We happen to be running Oracle Linux if there's any impact based on that pa= rticular OS. Thanks so much, Matthew Wilkinson | Lead Server Administrator, Unix ALLIANT ENERGY 200 1st St. SE | Cedar Rapids, IA 52401 Office: (319) 786-7694 alliantenergy.com I MatthewWilkinson(a)allia= ntenergy.com This e-mail message is intended only for the personal use of the recipient(= s) named above. This message may be an attorney-client communication and as= such privileged and confidential. If you are not an intended recipient, yo= u may not review, copy or distribute this message. If you have received thi= s communication in error, please notify us immediately by e-mail and delete= the original message. --===============2763140290005782110== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+CjxoZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNv bnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11cy1hc2NpaSI+CjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPgo8c3R5bGU+ PCEtLQovKiBGb250IERlZmluaXRpb25zICovCkBmb250LWZhY2UKCXtmb250LWZhbWlseTpDYWxp YnJpOwoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQpAZm9udC1mYWNlCgl7Zm9udC1m YW1pbHk6Ikx1Y2lkYSBDb25zb2xlIjsKCXBhbm9zZS0xOjIgMTEgNiA5IDQgNSA0IDIgMiA0O30K LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbAoJe21hcmdpbjowaW47CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7Cglmb250LXNpemU6 MTEuMHB0OwoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjt9CmE6bGluaywgc3Bh bi5Nc29IeXBlcmxpbmsKCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7Cgljb2xvcjpibHVlOwoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9CmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xs b3dlZAoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsKCWNvbG9yOnB1cnBsZTsKCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQpzcGFuLkVtYWlsU3R5bGUxNwoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLWNvbXBvc2U7Cglmb250LWZhbWlseToiTHVjaWRhIENvbnNvbGUiOwoJY29sb3I6d2luZG93 dGV4dDt9Ci5Nc29DaHBEZWZhdWx0Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7Cglmb250 LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiO30KQHBhZ2UgV29yZFNlY3Rpb24xCgl7c2l6 ZTo4LjVpbiAxMS4waW47CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQpkaXYuV29y ZFNlY3Rpb24xCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPgo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pgo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4KPG86c2hhcGVsYXlv dXQgdjpleHQ9ImVkaXQiPgo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4KPC9vOnNo YXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPgo8L2hlYWQ+Cjxib2R5IGxhbmc9IkVOLVVTIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7THVjaWRhIENvbnNvbGUmcXVvdDsiPklzIHRoZXJlIGEgcm9hZG1hcCBmb3IgYSBm aW5hbCBpbXBsZW1lbnRhdGlvbiBvZiB0aGUgUkhFTCA3IFNTRz8gSSYjODIxNzttIGN1cmlvdXMg d2hlbiBJIGNhbiBidWlsZCBhIHNlY3VyaXR5IGJhc2VsaW5lIGJhc2VkIG9mZiBvZiB0aGUgU0NB UCBTZWN1cml0eSBHdWlkZSBmb3IgUkhFTCA3Lgo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+CjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0x1Y2lkYSBDb25zb2xlJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0x1Y2lkYSBDb25zb2xlJnF1b3Q7Ij5XZSBoYXBwZW4gdG8gYmUgcnVubmlu ZyBPcmFjbGUgTGludXggaWYgdGhlcmUmIzgyMTc7cyBhbnkgaW1wYWN0IGJhc2VkIG9uIHRoYXQg cGFydGljdWxhciBPUy4KPG86cD48L286cD48L3NwYW4+PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtMdWNpZGEg Q29uc29sZSZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPgo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtM dWNpZGEgQ29uc29sZSZxdW90OyI+VGhhbmtzIHNvIG11Y2gsPG86cD48L286cD48L3NwYW4+PC9w Pgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtMdWNpZGEgQ29uc29sZSZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibGluZS1oZWlnaHQ6MTIuMDVwdDt0 ZXh0LWF1dG9zcGFjZTpub25lIj48Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5NYXR0aGV3IFdp bGtpbnNvbjwvc3Bhbj48L2I+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMDA0 RjhBIj4gfDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMDA0RjhB Ij4KPC9zcGFuPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+TGVh ZCBTZXJ2ZXIgQWRtaW5pc3RyYXRvciwgVW5peDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJp ZiZxdW90Oztjb2xvcjojMDA0RjhBIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+CjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJsaW5lLWhlaWdodDoxMi4wNXB0O3RleHQtYXV0b3NwYWNlOm5vbmUi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojQTZBNkE2Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L2I+PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibGluZS1oZWln aHQ6MTIuMDVwdDt0ZXh0LWF1dG9zcGFjZTpub25lIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1 b3Q7O2NvbG9yOiMxRjQ5N0QiPkFMTElBTlQgRU5FUkdZPG86cD48L286cD48L3NwYW4+PC9iPjwv cD4KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEyLjA1cHQ7dGV4dC1h dXRvc3BhY2U6bm9uZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojN0Y3RjdGIj4y MDAgMTxzdXA+c3Q8L3N1cD4gU3QuIFNFIHwgQ2VkYXIgUmFwaWRzLCBJQSA1MjQwMTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEy LjA1cHQ7dGV4dC1hdXRvc3BhY2U6bm9uZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xv cjojN0Y3RjdGIj5PZmZpY2U6ICgzMTkpIDc4Ni03Njk0PG86cD48L286cD48L3NwYW4+PC9wPgo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibGluZS1oZWlnaHQ6MTIuMDVwdDt0ZXh0LWF1dG9z cGFjZTpub25lIj48YSBocmVmPSJodHRwOi8vd3d3LmFsbGlhbnRlbmVyZ3kuY29tLyI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1 b3Q7c2Fucy1zZXJpZiZxdW90OyI+YWxsaWFudGVuZXJneS5jb208L3NwYW4+PC9hPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDsiPgo8c3BhbiBzdHlsZT0iY29sb3I6IzAwNEY4QSI+SSA8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOk1hdHRoZXdXaWxraW5zb25AYWxsaWFudGVuZXJneS5jb20iPk1hdHRo ZXdXaWxraW5zb25AYWxsaWFudGVuZXJneS5jb208L2E+PHU+PHNwYW4gc3R5bGU9ImNvbG9yOiMw NzcwQ0YiPjxvOnA+PC9vOnA+PC9zcGFuPjwvdT48L3NwYW4+PC9wPgo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibGluZS1oZWlnaHQ6MTIuMDVwdDt0ZXh0LWF1dG9zcGFjZTpub25lIj48dT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMwNzcwQ0YiPjxvOnA+PHNwYW4gc3R5bGU9 InRleHQtZGVjb3JhdGlvbjpub25lIj4mbmJzcDs8L3NwYW4+PC9vOnA+PC9zcGFuPjwvdT48L3A+ CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjpibGFj ayI+VGhpcyBlLW1haWwgbWVzc2FnZSBpcyBpbnRlbmRlZCBvbmx5IGZvciB0aGUgcGVyc29uYWwg dXNlIG9mIHRoZSByZWNpcGllbnQocykgbmFtZWQgYWJvdmUuIFRoaXMgbWVzc2FnZSBtYXkgYmUg YW4gYXR0b3JuZXktY2xpZW50IGNvbW11bmljYXRpb24gYW5kIGFzIHN1Y2ggcHJpdmlsZWdlZAog YW5kIGNvbmZpZGVudGlhbC4gSWYgeW91IGFyZSBub3QgYW4gaW50ZW5kZWQgcmVjaXBpZW50LCB5 b3UgbWF5IG5vdCByZXZpZXcsIGNvcHkgb3IgZGlzdHJpYnV0ZSB0aGlzIG1lc3NhZ2UuIElmIHlv dSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlm eSB1cyBpbW1lZGlhdGVseSBieSBlLW1haWwgYW5kIGRlbGV0ZSB0aGUgb3JpZ2luYWwgbWVzc2Fn ZS48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtjb2xvcjpibGFjayI+PG86cD48 L286cD48L3NwYW4+PC9wPgo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4KPC9kaXY+CjwvYm9keT4KPC9odG1sPgo= --===============2763140290005782110==--