From james.t.ford at gmail.com Thu Aug 20 11:37:31 2015 Content-Type: multipart/mixed; boundary="===============6308437929154664784==" MIME-Version: 1.0 From: James Ford To: scap-security-guide at lists.fedorahosted.org Subject: Re: Anyone using rhel6 ssg for centos6? Date: Fri, 15 Aug 2014 13:46:18 -0400 Message-ID: In-Reply-To: 53EE3F10.4090107@redhat.com --===============6308437929154664784== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Shawn, thanks for the detailed explanation. Rather than faking the system into thinking it's running RHEL6, would it be possible to update the oval definitions to include CentOS as an applicable platform? On Fri, Aug 15, 2014 at 1:10 PM, Shawn Wells wrote: > On 8/14/14, 5:25 PM, Jeremiah Jahn wrote: > > I'm using it for SL6. The problem is in openscap-cpe-oval.xml. The > > test for release is searching on RedHat only. > > > > I've changed mine to the following: notice the (redhat|sl) on the > > second line. You should be able to change it to whatever the > > centos-release rpm says. I can't remember right now if SSG is where I > > got the original xml file, or if it's the one from open-scap. It's > > very possible that you'll have to make sure that you'll have to alter > > the ssg-rhel6-cpe-dictionary.xml to point to your altered cpe-oval > > file. I've attached them just incase, but it took some tweaking. > > > > > xmlns=3D"http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"> > > match">^(redhat|sl)-release > > ^6[^\d] > > > > > To illustrate how CPE works, as part of Greg's question.... > > Step 1: In your OVAL check, you define which platforms the check is > written for. This is done by the stanzas, such as: > > > > > Red Hat Enterprise Linux 6 > > > > > Step 2: When an SCAP interpreter parses each OVAL rule, it will parse > the tag above. For each listed, it will find the > associated to find what needs to be ran. This will > tell the SCAP interpreter if the OVAL rule is applicable for the system > being scanned. > > For example, from SSG's CPE dictionary: > > > > > Red Hat Enterprise Linux 6 > > > > http://oval.mitre.org/XMLSchema/oval-definitions-5" > href=3D"filename">installed_OS_is_rhel6 > > > > In this case, if the tag matches the cpe-item/title, then the > cpe-item/check will be ran. In the case of "Red Hat Enterprise Linux 6" > the OVAL check "installed_OS_is_rhel6" will be ran. > > The installed_OS_is_rhel6 OVAL check queries the system to see if the > redhat-release-{server workstation}-6 RPM is installed, for example: > > > https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/= checks/installed_OS_is_rhel6.xml#L46#L55 > > comment=3D"redhat-release-server is version 6" id=3D"test_rhel_server" > version=3D"1"> > > > > > > > > > > ^6\.\d+$ > > > > > > redhat-release-server > > > > > If the the check passes, the SCAP interpreter knows the particular OVAL > rule is applicable to the system, executes the probes, and you get a > pass/fail result. If the installed_OS_is_rhel6 check fails, the OVAL > rule will be marked as "Not Applicable." > > > For users running derivative operating systems (CentOS, Scientific...) > you can edit your CPE dictionary's regex like Jeremiah outlined. This > will "fake" the system into thinking it's running RHEL6 and allow the > check to be ran. > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/ > -- = Sincerely, James --===============6308437929154664784== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+U2hhd24sIHRoYW5rcyBmb3IgdGhlIGRldGFpbGVkIGV4cGxhbmF0aW9u LiBSYXRoZXIgdGhhbiBmYWtpbmcgdGhlIHN5c3RlbSBpbnRvIHRoaW5raW5nIGl0JiMzOTtzIHJ1 bm5pbmcgUkhFTDYsIHdvdWxkIGl0IGJlIHBvc3NpYmxlIHRvIHVwZGF0ZSB0aGUgb3ZhbCBkZWZp bml0aW9ucyB0byBpbmNsdWRlIENlbnRPUyBhcyBhbiBhcHBsaWNhYmxlIHBsYXRmb3JtPzxicj4K wqA8YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48YnI+PGRpdiBjbGFzcz0i Z21haWxfcXVvdGUiPk9uIEZyaSwgQXVnIDE1LCAyMDE0IGF0IDE6MTAgUE0sIFNoYXduIFdlbGxz IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnNoYXduQHJlZGhhdC5jb20iIHRh cmdldD0iX2JsYW5rIj5zaGF3bkByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj4K PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7 Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBjbGFzcz0i Ij5PbiA4LzE0LzE0LCA1OjI1IFBNLCBKZXJlbWlhaCBKYWhuIHdyb3RlOjxicj4KJmd0OyBJJiMz OTttIHVzaW5nIGl0IGZvciBTTDYuIFRoZSBwcm9ibGVtIGlzIGluIG9wZW5zY2FwLWNwZS1vdmFs LnhtbC4gVGhlPGJyPgomZ3Q7IHRlc3QgZm9yIHJlbGVhc2UgaXMgc2VhcmNoaW5nIG9uIFJlZEhh dCBvbmx5Ljxicj4KJmd0Ozxicj4KJmd0OyBJJiMzOTt2ZSBjaGFuZ2VkIG1pbmUgdG8gdGhlIGZv bGxvd2luZzogbm90aWNlIHRoZSAocmVkaGF0fHNsKSBvbiB0aGU8YnI+CiZndDsgc2Vjb25kIGxp bmUuIFlvdSBzaG91bGQgYmUgYWJsZSB0byBjaGFuZ2UgaXQgdG8gd2hhdGV2ZXIgdGhlPGJyPgom Z3Q7IGNlbnRvcy1yZWxlYXNlIHJwbSBzYXlzLiBJIGNhbiYjMzk7dCByZW1lbWJlciByaWdodCBu b3cgaWYgU1NHIGlzIHdoZXJlIEk8YnI+CiZndDsgZ290IHRoZSBvcmlnaW5hbCB4bWwgZmlsZSwg b3IgaWYgaXQmIzM5O3MgdGhlIG9uZSBmcm9tIG9wZW4tc2NhcC4gSXQmIzM5O3M8YnI+CiZndDsg dmVyeSBwb3NzaWJsZSB0aGF0IHlvdSYjMzk7bGwgaGF2ZSB0byBtYWtlIHN1cmUgdGhhdCB5b3Um IzM5O2xsIGhhdmUgdG8gYWx0ZXI8YnI+CiZndDsgdGhlIHNzZy1yaGVsNi1jcGUtZGljdGlvbmFy eS54bWwgdG8gcG9pbnQgdG8geW91ciBhbHRlcmVkIGNwZS1vdmFsPGJyPgomZ3Q7IGZpbGUuIEkm IzM5O3ZlIGF0dGFjaGVkIHRoZW0ganVzdCBpbmNhc2UsIGJ1dCBpdCB0b29rIHNvbWUgdHdlYWtp bmcuPGJyPgomZ3Q7PGJyPgomZ3Q7ICZsdDtycG1pbmZvX3N0YXRlIGlkPSZxdW90O292YWw6b3Jn Lm9wZW4tc2NhcC5jcGUucmhlbDpzdGU6NiZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDs8YnI+ CiZndDsgeG1sbnM9JnF1b3Q7PGEgaHJlZj0iaHR0cDovL292YWwubWl0cmUub3JnL1hNTFNjaGVt YS9vdmFsLWRlZmluaXRpb25zLTUjbGludXgiIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vb3ZhbC5t aXRyZS5vcmcvWE1MU2NoZW1hL292YWwtZGVmaW5pdGlvbnMtNSNsaW51eDwvYT4mcXVvdDsmZ3Q7 PGJyPgomZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAmbHQ7bmFtZSBvcGVyYXRpb249 JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteKHJlZGhhdHxzbCktcmVsZWFzZSZsdDsvbmFt ZSZndDs8YnI+CiZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCZsdDt2ZXJzaW9uIG9w ZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O142W15cZF0mbHQ7L3ZlcnNpb24m Z3Q7PGJyPgomZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAmbHQ7L3JwbWluZm9fc3RhdGUmZ3Q7PGJy Pgo8YnI+Cjxicj4KPC9kaXY+VG8gaWxsdXN0cmF0ZSBob3cgQ1BFIHdvcmtzLCBhcyBwYXJ0IG9m IEdyZWcmIzM5O3MgcXVlc3Rpb24uLi4uPGJyPgo8YnI+ClN0ZXAgMTogSW4geW91ciBPVkFMIGNo ZWNrLCB5b3UgZGVmaW5lIHdoaWNoIHBsYXRmb3JtcyB0aGUgY2hlY2sgaXM8YnI+CndyaXR0ZW4g Zm9yLiBUaGlzIGlzIGRvbmUgYnkgdGhlICZsdDthZmZlY3RlZCZndDsgc3Rhbnphcywgc3VjaCBh czo8YnI+Cjxicj4KJmd0O8KgIMKgIMKgIMKgJmx0O2FmZmVjdGVkIGZhbWlseT0mcXVvdDt1bml4 JnF1b3Q7Jmd0Ozxicj4KJmd0O8KgIMKgIMKgIMKgIMKgJmx0O3BsYXRmb3JtJmd0O1JlZCBIYXQg RW50ZXJwcmlzZSBMaW51eCA2Jmx0Oy9wbGF0Zm9ybSZndDs8YnI+CiZndDvCoCDCoCDCoCDCoCZs dDsvYWZmZWN0ZWQmZ3Q7PGJyPgo8YnI+Cjxicj4KU3RlcCAyOiBXaGVuIGFuIFNDQVAgaW50ZXJw cmV0ZXIgcGFyc2VzIGVhY2ggT1ZBTCBydWxlLCBpdCB3aWxsIHBhcnNlPGJyPgp0aGUgJmx0O2Fm ZmVjdGVkJmd0OyB0YWcgYWJvdmUuIEZvciBlYWNoICZsdDtwbGF0Zm9ybSZndDsgbGlzdGVkLCBp dCB3aWxsIGZpbmQgdGhlPGJyPgphc3NvY2lhdGVkICZsdDtjcGktaXRlbSZndDsgdG8gZmluZCB3 aGF0ICZsdDtjaGVjayZndDsgbmVlZHMgdG8gYmUgcmFuLiBUaGlzIHdpbGw8YnI+CnRlbGwgdGhl IFNDQVAgaW50ZXJwcmV0ZXIgaWYgdGhlIE9WQUwgcnVsZSBpcyBhcHBsaWNhYmxlIGZvciB0aGUg c3lzdGVtPGJyPgpiZWluZyBzY2FubmVkLjxicj4KPGJyPgpGb3IgZXhhbXBsZSwgZnJvbSBTU0cm IzM5O3MgQ1BFIGRpY3Rpb25hcnk6PGJyPgo8YnI+CiZndDvCoCDCoCDCoCDCoCZsdDtjcGUtaXRl bSBuYW1lPSZxdW90O2NwZTovbzpyZWRoYXQ6ZW50ZXJwcmlzZV9saW51eDo2JnF1b3Q7Jmd0Ozxi cj4KJmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgJmx0O3RpdGxlIHhtbDpsYW5nPSZxdW90O2VuLXVz JnF1b3Q7Jmd0O1JlZCBIYXQgRW50ZXJwcmlzZSBMaW51eCA2Jmx0Oy90aXRsZSZndDs8YnI+CiZn dDvCoCDCoCDCoCDCoCDCoCDCoCDCoCZsdDshLS0gdGhlIGNoZWNrIHJlZmVyZW5jZXMgYW4gT1ZB TCBmaWxlIHRoYXQgY29udGFpbnMgYW4gaW52ZW50b3J5IGRlZmluaXRpb24gLS0mZ3Q7PGJyPgom Z3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAmbHQ7Y2hlY2sgc3lzdGVtPSZxdW90OzxhIGhyZWY9Imh0 dHA6Ly9vdmFsLm1pdHJlLm9yZy9YTUxTY2hlbWEvb3ZhbC1kZWZpbml0aW9ucy01IiB0YXJnZXQ9 Il9ibGFuayI+aHR0cDovL292YWwubWl0cmUub3JnL1hNTFNjaGVtYS9vdmFsLWRlZmluaXRpb25z LTU8L2E+JnF1b3Q7IGhyZWY9JnF1b3Q7ZmlsZW5hbWUmcXVvdDsmZ3Q7aW5zdGFsbGVkX09TX2lz X3JoZWw2Jmx0Oy9jaGVjayZndDs8YnI+CgomZ3Q7wqAgwqAgwqAgwqAmbHQ7L2NwZS1pdGVtJmd0 Ozxicj4KPGJyPgpJbiB0aGlzIGNhc2UsIGlmIHRoZSAmbHQ7cGxhdGZvcm0mZ3Q7IHRhZyBtYXRj aGVzIHRoZSBjcGUtaXRlbS90aXRsZSwgdGhlbiB0aGU8YnI+CmNwZS1pdGVtL2NoZWNrIHdpbGwg YmUgcmFuLiBJbiB0aGUgY2FzZSBvZiAmcXVvdDtSZWQgSGF0IEVudGVycHJpc2UgTGludXggNiZx dW90Ozxicj4KdGhlIE9WQUwgY2hlY2sgJnF1b3Q7aW5zdGFsbGVkX09TX2lzX3JoZWw2JnF1b3Q7 IHdpbGwgYmUgcmFuLjxicj4KPGJyPgpUaGUgaW5zdGFsbGVkX09TX2lzX3JoZWw2IE9WQUwgY2hl Y2sgcXVlcmllcyB0aGUgc3lzdGVtIHRvIHNlZSBpZiB0aGU8YnI+CnJlZGhhdC1yZWxlYXNlLXtz ZXJ2ZXIgd29ya3N0YXRpb259LTYgUlBNIGlzIGluc3RhbGxlZCwgZm9yIGV4YW1wbGU6PGJyPgo8 YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1 aWRlL2Jsb2IvbWFzdGVyL1JIRUwvNi9pbnB1dC9jaGVja3MvaW5zdGFsbGVkX09TX2lzX3JoZWw2 LnhtbCNMNDYjTDU1IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQ L3NjYXAtc2VjdXJpdHktZ3VpZGUvYmxvYi9tYXN0ZXIvUkhFTC82L2lucHV0L2NoZWNrcy9pbnN0 YWxsZWRfT1NfaXNfcmhlbDYueG1sI0w0NiNMNTU8L2E+PGJyPgoKJmd0O8KgIMKgJmx0O2xpbnV4 OnJwbWluZm9fdGVzdCBjaGVjaz0mcXVvdDthbGwmcXVvdDsgY2hlY2tfZXhpc3RlbmNlPSZxdW90 O2F0X2xlYXN0X29uZV9leGlzdHMmcXVvdDsgY29tbWVudD0mcXVvdDtyZWRoYXQtcmVsZWFzZS1z ZXJ2ZXIgaXMgdmVyc2lvbiA2JnF1b3Q7IGlkPSZxdW90O3Rlc3RfcmhlbF9zZXJ2ZXImcXVvdDsg dmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJmd0O8KgIMKgIMKgJmx0O2xpbnV4Om9iamVj dCBvYmplY3RfcmVmPSZxdW90O29ial9yaGVsX3NlcnZlciZxdW90OyAvJmd0Ozxicj4KJmd0O8Kg IMKgIMKgJmx0O2xpbnV4OnN0YXRlIHN0YXRlX3JlZj0mcXVvdDtzdGF0ZV9yaGVsX3NlcnZlciZx dW90OyAvJmd0Ozxicj4KJmd0O8KgIMKgJmx0Oy9saW51eDpycG1pbmZvX3Rlc3QmZ3Q7PGJyPgom Z3Q7wqAgwqAmbHQ7bGludXg6cnBtaW5mb19zdGF0ZSBpZD0mcXVvdDtzdGF0ZV9yaGVsX3NlcnZl ciZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PGJyPgomZ3Q7wqAgwqAgwqAmbHQ7bGlu dXg6dmVyc2lvbiBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteNlwuXGQr JCZsdDsvbGludXg6dmVyc2lvbiZndDs8YnI+CiZndDvCoCDCoCZsdDsvbGludXg6cnBtaW5mb19z dGF0ZSZndDs8YnI+CiZndDvCoCDCoCZsdDtsaW51eDpycG1pbmZvX29iamVjdCBpZD0mcXVvdDtv YmpfcmhlbF9zZXJ2ZXImcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0Ozxicj4KJmd0O8Kg IMKgIMKgJmx0O2xpbnV4Om5hbWUmZ3Q7cmVkaGF0LXJlbGVhc2Utc2VydmVyJmx0Oy9saW51eDpu YW1lJmd0Ozxicj4KJmd0O8KgIMKgJmx0Oy9saW51eDpycG1pbmZvX29iamVjdCZndDs8YnI+Cjxi cj4KPGJyPgpJZiB0aGUgdGhlIGNoZWNrIHBhc3NlcywgdGhlIFNDQVAgaW50ZXJwcmV0ZXIga25v d3MgdGhlIHBhcnRpY3VsYXIgT1ZBTDxicj4KcnVsZSBpcyBhcHBsaWNhYmxlIHRvIHRoZSBzeXN0 ZW0sIGV4ZWN1dGVzIHRoZSBwcm9iZXMsIGFuZCB5b3UgZ2V0IGE8YnI+CnBhc3MvZmFpbCByZXN1 bHQuIElmIHRoZSBpbnN0YWxsZWRfT1NfaXNfcmhlbDYgY2hlY2sgZmFpbHMsIHRoZSBPVkFMPGJy PgpydWxlIHdpbGwgYmUgbWFya2VkIGFzICZxdW90O05vdCBBcHBsaWNhYmxlLiZxdW90Ozxicj4K PGJyPgo8YnI+CkZvciB1c2VycyBydW5uaW5nIGRlcml2YXRpdmUgb3BlcmF0aW5nIHN5c3RlbXMg KENlbnRPUywgU2NpZW50aWZpYy4uLik8YnI+CnlvdSBjYW4gZWRpdCB5b3VyIENQRSBkaWN0aW9u YXJ5JiMzOTtzIHJlZ2V4IGxpa2UgSmVyZW1pYWggb3V0bGluZWQuIFRoaXM8YnI+CndpbGwgJnF1 b3Q7ZmFrZSZxdW90OyB0aGUgc3lzdGVtIGludG8gdGhpbmtpbmcgaXQmIzM5O3MgcnVubmluZyBS SEVMNiBhbmQgYWxsb3cgdGhlPGJyPgpjaGVjayB0byBiZSByYW4uPGJyPgo8ZGl2IGNsYXNzPSJI T0VuWmIiPjxkaXYgY2xhc3M9Img1Ij4tLTxicj4KU0NBUCBTZWN1cml0eSBHdWlkZSBtYWlsaW5n IGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwv YT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3Rz LmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9h Pjxicj4KPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHkt Z3VpZGUvIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAt c2VjdXJpdHktZ3VpZGUvPC9hPjwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PGJy IGNsZWFyPSJhbGwiPjxicj4tLSA8YnI+U2luY2VyZWx5LDxkaXY+PGJyPjwvZGl2PjxkaXY+SmFt ZXM8L2Rpdj4KCjwvZGl2Pgo= --===============6308437929154664784==--