Martin,

Thank you for your answer. See attachment for xccdf result file.
If you look at the rule

Result for Disable Hot Deployment in production

you will see it passes. But if I check manually I can see that the file

JBOSS_HOME/server/[PROFILE]/deploy/hdscanner-jboss-beans.xml


hasn't been deleted. So my conclusion is that the rule should have failed.

And I'm not sure what you mean with "oval results". if you tell how to generate it I will post it.


regards,


Ivan




On Tue, Apr 29, 2014 at 1:29 PM, Martin Preisler <mpreisle@redhat.com> wrote:
----- Original Message -----
> From: "Ivan Saez Scheihing" <saezscheihing@gmail.com>
> To: "SCAP Security Guide" <scap-security-guide@lists.fedorahosted.org>
> Sent: Tuesday, April 22, 2014 8:00:39 PM
> Subject: Re: oscap & jboss on Fedora
>
> Martin,
>
> I was able to run xccdf and oscan after editing the eap5-xccdf.xml file. I
> did comment out all '<platform idref="cpe:/a:redhat..' lines (5 lines in
> total).
>
> java -jar xccdfexec.jar -result bla.xml --report bla.html --profile
> eap5_full -c eap5-cpe-oval.xml -C eap5-cpe-dictionary.xl -P eap5_full

No idea what xccdfexec.jar is. Is it a wrapper around oscap? The arguments look familiar.

>
> Did run and asked me a lot's of questions. The same questions as can be
> found in the JBossEAP5_Guide.html document. Based on my answers it
> generated a few xml files. But am I mistaken or doesn't  xccdfexec cheeck
> anything?
>
> Oscap did check some things by it self (by inspecting jboss xml files I
> supose). I run it with the following options:
>
> oscap xccdf eval --results bla.xml --report bla.html --profile eap5-full
> -cpe eap5-cpe-dictionary.xml eap5-xccdf.xml
>
>
> It generated the bla.html file and most of the checks were done. Previously
> I did check the Jboss by hand and I think oscap is not very meticulous.
> Some checks did get the passed status and I'm sure it should have failed.
> Any comments on this/

We need more specifics, else I can't comment. Give us a particular rule that passed and shouldn't have. Post your xccdf result file, post your oval results.

--
Martin Preisler
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide