On 1/7/13 3:27 PM, Christopher Anderson wrote:
I'm hoping to help out where I can. I have a fairly strong background in Information Security and system hardening, although I have not had a lot of exposure to XML and git.
Those are the easy parts! Just wait until you start writing/patching OVAL code!
I have been using Red Hat's products since Red Hat Linux 4.2 and Linux since 0.99.x (woo Yggdrasil and Slackware!). Also I have worked as a System Administrator for about a decade and a half, starting with Sun Solaris 2.5.1 with a slight detour through IRIX and moving as quickly as possible to Linux.
On the Information Assurance side, I'm fairly familiar with the DOD STIG guidelines and the NSA guides for hardening RHEL 5 and have used them at work over the years.
I'd really appreciate any starting points / pointers!
Consumption information is fairly well documented on the wiki: https://fedorahosted.org/scap-security-guide/wiki
Feedback on how easy it was for you to figure out how to download and use the content would be incredibly valuable.
After that, IMO, testing of the OVAL checks would be valuable. Specifically, ensuring that each XCCDF rule from the stig-rhel6-server profile is paired with an OVAL test, and that OVAL test is performing as expected.
There is a utility in scap-security-guide/RHEL6/utils/ called verify-references.py you can look at (just vi it) which may help in this. For example:
[shawn@rhel6 output]$ ../utils/verify-references.py --profile stig-rhel6-server --rules-with-invalid-checks ssg-rhel6-xccdf.xml Invalid OVAL definition referenced by XCCDF Rule: disable_gnome_thumbnailers Invalid OVAL definition referenced by XCCDF Rule: no_netrc_files Invalid OVAL definition referenced by XCCDF Rule: deny_password_attempts_unlock_time Invalid OVAL definition referenced by XCCDF Rule: deny_password_attempts_fail_interval Invalid OVAL definition referenced by XCCDF Rule: set_gdm_login_banner_text Invalid OVAL definition referenced by XCCDF Rule: disable_logwatch_for_logserver Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_lockd_tcp_port Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_lockd_udp_port Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_statd_port Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_mountd_port Invalid OVAL definition referenced by XCCDF Rule: use_root_squashing_all_exports Invalid OVAL definition referenced by XCCDF Rule: restrict_nfs_clients_to_privileged_ports Invalid OVAL definition referenced by XCCDF Rule: no_insecure_locks_exports Invalid OVAL definition referenced by XCCDF Rule: httpd_servertokens_prod Invalid OVAL definition referenced by XCCDF Rule: httpd_serversignature_off Invalid OVAL definition referenced by XCCDF Rule: httpd_install_mod_ssl Invalid OVAL definition referenced by XCCDF Rule: httpd_install_mod_security