From whbos at xs4all.nl Thu Aug 20 11:31:50 2015 Content-Type: multipart/mixed; boundary="===============7671771887413963970==" MIME-Version: 1.0 From: Willem Bos To: scap-security-guide at lists.fedorahosted.org Subject: Re: disa-stig-rhel5-v1r0.6-xccdf-manual.xml Date: Wed, 08 Aug 2012 08:35:19 +0200 Message-ID: In-Reply-To: 502190E4.4060306@redhat.com --===============7671771887413963970== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable @Shawn/Shannon: Thanks a lot for explaining OVAL vs. XCCDF. @Jeffrey : this goes beyond simply re-running the files trough tidy & xmllint so I'll leave it at this. If there's anything I can do just let me know. Regards, Willem. On Wed, Aug 8, 2012 at 12:04 AM, Shawn Wells wrote: > Shannon hit it on the head. The xccdf-manual includes "procedural" checks > that can not be automated with OVAL. An example of that would be there are > government policies mandating proper backups, however there isn't a single > system flag or command that can verify this. The intent is to process > "procedural checks" is to use OCIL, however that is still very much > evolving. > > Note that the disa-stig-* files are included for us to reference while we > build out content for the RHEL6 STIG. As a community we wanted to ensure > that we inherited RHEL5 STIG controls where appropriate, so we dropped the > disa-stig-* files into the RHEL6/references directory to allow developers= to > double check things. Those files absolutely should not be considered > official DISA content! > > In regards to SSG output things will still be dropped into > rhel6-xccdf-scap-security-guide.xml. > > -Shawn > > > > > On 8/7/12 4:14 PM, Shannon Mitchell wrote: > > I'm just guessing here, but it looks like the manual is meant to be the f= ull > thing. The oval language seems very limited on what it can do, so it only > takes care of a small subset of the full set of checks. The bad thing is > that it looks like the nessus scans that I have seen run against my syste= ms > check for all of them and not just the 350 in the benchmark. > > On Tue, Aug 7, 2012 at 4:03 PM, Willem Bos wrote: >> >> Hi Shannon, >> >> Thanks. OK, so where do the extra id's come from? I grep-ed the whole >> scap-security-guide directory on a id from the *-manual.xml file but - >> apart from the file itself - got no results... >> >> Regards, >> Willem. >> >> On Tue, Aug 7, 2012 at 9:20 PM, Shannon Mitchell >> wrote: >> > Every gen Id in the benchmark is in the manual. The manual contains a= ll >> > 350 >> > plus an extra 219. >> > >> > On Aug 7, 2012 1:41 PM, "Willem Bos" wrote: >> >> >> >> Hi Jeffrey, >> >> >> >> Are you sure disa-stig-rhel5-v1r0.6-xccdf-manual.xml is based on >> >> disa-stig-rhel5-v1r0.6-xccdf.xml? >> >> >> >> The *-manual.xml file contains a lot more GEN* tags : >> >> >> >> grep -c 'GEN' U_RedHat_5_V1R0.6_STIG_Benchmark-xccdf.xml >> >> 350 >> >> >> >> grep -c '<title>GEN' >> >> scap-security-guide/RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf.xml >> >> 350 >> >> >> >> grep -c '<title>GEN' >> >> >> >> >> >> scap-security-guide/RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-man= ual.xml >> >> 569 >> >> >> >> Maybe I'm missing something obvious but like I said, I'm new to this >> >> stuff >> >> :) >> >> >> >> Regards, >> >> Willem. >> >> >> >> >> >> On Mon, Aug 6, 2012 at 4:20 PM, Jeffrey Blank <blank(a)eclipse.ncsc.m= il> >> >> wrote: >> >> > This should be the same semantically (as the authoritative version >> >> > from >> >> > iase.disa.mil) -- I just ran it through xmllint (or was it tidy?) to >> >> > make it readable in a text editor. (And yes, I should have >> >> > documented >> >> > this.) >> >> > >> >> > I really can't remember which, but if you'd like to do a quick re-r= un >> >> > of >> >> > each and compare, it would certainly be good for us to document its >> >> > congruence with the official version :) >> >> > >> >> > (Also note that we are not the maintainers of that content for RHEL >> >> > 5.) >> >> > >> >> > >> >> > >> >> > >> >> > On 08/06/2012 03:00 AM, Willem Bos wrote: >> >> >> Hi All, >> >> >> >> >> >> The GIT repo contains the file >> >> >> RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml. This is >> >> >> not >> >> >> part of the zipfile you can download from >> >> >> >> >> >> http://web.nvd.nist.gov/view/ncp/repository/checklist/download?id= =3D1059. >> >> >> >> >> >> I could not find a Makefile target that creates it. What is its >> >> >> origin? >> >> >> >> >> >> Regards, >> >> >> Willem. > > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > --===============7671771887413963970==--