You are correct sir. It does support Res, but apparently it is picky when evaluating them in the way it was defined.

 

Here is one more change that I have verified does ensure it gets detected on RHEL 6. CentOS 6 support should still be intact.

 

Best regards,

 

Trey Henefield, CISSP

Senior IAVA Engineer

 

Ultra Electronics

Advanced Tactical Systems, Inc.

4101 Smith School Road

Building IV, Suite 100

Austin, TX 78744 USA

 

Trey.Henefield@ultra-ats.com

Tel: +1 512 327 6795 ext. 647

Fax: +1 512 327 8043

Mobile: +1 512 541 6450

 

www.ultra-ats.com

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Rui Pedro Bernardino
Sent: Wednesday, June 18, 2014 10:33 AM
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

 

My point with your initial CentOS suggestion is that it should work, but it doesn’t because SSG RHEL’s CPEs are broken.

 

This version works perfectly on CentOS but gets an error on RHEL:

<system_data>

          <lin-sys:rpminfo_item id="1069901" status="error">

            <lin-sys:name>redhat-release-(?:workstation|server)</lin-sys:name>

          </lin-sys:rpminfo_item>

</system_data>

 

Can you use REs in the rpminfo object name?

 

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Trey Henefield
Sent: quarta-feira, 18 de Junho de 2014 15:59
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

 

Yes, I don’t have CentOS 6 installed so I couldn’t verify, but from looking at the package on their site, it appeared as if the version indicated would work.

 

I am not sure about how the openscap software itself resolves CPE entries, or if it does at all. But from creating other SSGs, it has been my experience that you could pretty much define any CPE name. The key is in the cpe-oval check it is attached to by the cpe-dictionary.

 

The previous change I did will remove support for Red Hat.

 

Here is an updated file that should allow being used for both Red Hat 6 and CentOS 6.

 

Best regards,

 

 

Trey Henefield, CISSP

Senior IAVA Engineer

 

Ultra Electronics

Advanced Tactical Systems, Inc.

4101 Smith School Road

Building IV, Suite 100

Austin, TX 78744 USA

 

Trey.Henefield@ultra-ats.com

Tel: +1 512 327 6795 ext. 647

Fax: +1 512 327 8043

Mobile: +1 512 541 6450

 

www.ultra-ats.com

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Rui Pedro Bernardino
Sent: Wednesday, June 18, 2014 9:39 AM
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

 

I’m also building from the GIT version.

 

Anyway, using your file:

# cat /etc/redhat-release

CentOS release 6.2 (Final)

# oscap oval eval --results ssg-rhel6-cpe-oval.results.xml ssg-rhel6-cpe-oval.xml

Definition oval:ssg:def:100: false

Evaluation done.

 

When I edit the file and replace

<linux:version operation="pattern match">^6\.\d+$</linux:version>

by

<linux:version operation="pattern match">^6</linux:version>

 

And re-run:

# oscap oval eval --results ssg-rhel6-cpe-oval.results.xml ssg-rhel6-cpe-oval.xml

Definition oval:ssg:def:100: true

Evaluation done.

 

Also have a look at the end of  “ssg-rhel6-cpe-oval.results.xml”. “lin-sys:version” is “6” not “6.2”.

 

SSG’s platform check doesn’t work on Red Hat either; using scap-security-guid/RHEL/6/dist/content:

# cat /etc/redhat-release

Red Hat Enterprise Linux Server release 6.5 (Santiago)

# oscap oval eval  ssg-rhel6-cpe-oval.xml

Definition oval:ssg:def:100: false

Evaluation done.

 

And it will work if I edit the “pattern match” as on CentOS.

 

I think the platform CPE get defined through OpenSCAP’s CPE OVAL, not SSG’s. Just try move /usr/share/openscap/cpe/openscap-cpe-dict.xml to something else and try to run a xccdf eval.

 

Or am I messing things up?

 

Best regards

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Trey Henefield
Sent: quarta-feira, 18 de Junho de 2014 15:04
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

 

Ah, this is because you are using the prebuilt release package which has slightly different checks than what is on the trunk.

 

Try the attached file in place of you existing one.

 

The prebuilt package looks for redhat-release-workstation and redhat-release-server packages.

 

CentOS does not offer these similar packages. So instead I modified both of those to indicate centos-release, which is a valid package. Versioning should match up as is.

 

That is all that is needed.

 

I would not go any further as to create new checks inside the prebuilt package as this may mess up the numbering schema for all the checks created when the SSG package is built.

 

However, a check could easily be added in the source location I previously mentioned to also accept CentOS 6 as a valid target. Or a new CentOS6 check could be added as described and referenced in the CPE dictionary:

 

scap-security-guide\RHEL\6\input\checks\platform\rhel6-cpe-dictionary.xml

 

Best regards,

 

 

Trey Henefield, CISSP

Senior IAVA Engineer

 

Ultra Electronics

Advanced Tactical Systems, Inc.

4101 Smith School Road

Building IV, Suite 100

Austin, TX 78744 USA

 

Trey.Henefield@ultra-ats.com

Tel: +1 512 327 6795 ext. 647

Fax: +1 512 327 8043

Mobile: +1 512 541 6450

 

www.ultra-ats.com

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Rui Pedro Bernardino
Sent: Wednesday, June 18, 2014 7:21 AM
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

 

It requires an extra hack because ‘version’ on CentOS won’t match the specified pattern; here is how I did it to keep it compatible with RHEL:

  1. Add an extra criterion:

      <criteria operator="OR">

        <criterion comment="Red Hat Enterprise Linux 6 Workstation is installed" test_ref="test_rhel_workstation" />

        <criterion comment="Red Hat Enterprise Linux 6 Server is installed"      test_ref="test_rhel_server" />

        <criterion comment="CentOS 6 is installed"                               test_ref="test_centos" />

      </criteria>

2. Add an extra test:

  <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="test_centos" version="1">

    <linux:object object_ref="obj_centos" />

    <linux:state state_ref="state_centos" />

  </linux:rpminfo_test>

  <linux:rpminfo_state id="state_centos" version="1">

    <linux:version operation="pattern match">^6</linux:version>

  </linux:rpminfo_state>

  <linux:rpminfo_object id="obj_centos" version="1">

    <linux:name>centos-release</linux:name>

  </linux:rpminfo_object>

  

 

Another weirder issue on the original SSG check: I don’t think this check works on ‘pure’ RHEL6 either but the platform still matches for some reason I do not understand.

 

When I use ‘—oval-results’, the CPE result file (ssg-rhel6-cpe-oval.xml.result.xml), the test_rhel_* tests all fail for the same reason, i.e:

<lin-sys:version>6Server</lin-sys:version>

Won’t match:

<lin-def:version operation="pattern match">^6\.\d+$</lin-def:version>

 

Thus resulting in ‘false’ for test_rhel_server:

<test test_id="oval:ssg:tst:103" version="1" check="all" result="false">

   <tested_item item_id="1046111" result="false"/>

</test>

 

and consequently for installed_OS_is_rhel6:

<definition definition_id="oval:ssg:def:100" result="false" version="1">

 

But the definition still works ok, although it doesn’t on CentOS… What am I getting wrong were?

 

Thanks!

 

 

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Trey Henefield
Sent: quarta-feira, 18 de Junho de 2014 12:31
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

 



The check for Red Hat 6 is pulled from:

scap-security-guide\RHEL\6\input\checks\installed_OS_is_rhel6.xml

Simply change the two references to 'redhat-release' to state 'centos-release' instead. Then rebuild.

That should do it.

Best regards,


Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield@ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com

-----Original Message-----
From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Pettorino, Jeffrey D CTR USAF USAFA USAFA/DFAN
Sent: Tuesday, June 17, 2014 4:01 PM
To: 'scap-security-guide@lists.fedorahosted.org'
Subject: Anyone using rhel6 ssg for centos6?

I have been trying to get oscap working on my CentOS6.5 network core, without luck.

Everything comes back with "Result notapplicable".

I am pretty new to SCAP and XCCDF, but am a long-time user of Nessus and Security Center (prior to ACAS program by DISA).

Does anyone have suggestions where I can find some in depth guidance to adjust the rhel6 configs to CentOS?

--
Jeff

v/r,
Jeffrey D. Pettorino, GCIH, CISSP
Systems Engineer
High Performance Computing Research Center United States Air Force Academy Jeffrey.Pettorino.ctr@USAFA.edu
719/333-9391
----
The use of the Unix philosophy just for UNIX was a great waste.
Fortunately, Linux came along.
- Bellevue Linux User Group member, 2005

Disclaimer
The information contained in this communication from trey.henefield@ultra-ats.com sent at 2014-06-18 07:30:57 is private and may be legally privileged or export controlled. It is intended solely for use by scap-security-guide@lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide@lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.