On 9/12/13 2:51 PM, leam hall wrote:
Using the oscap from openscap 0.9.3-1 and the ssg content fresh from
the repo (0.1-12) I ran:
oscap xccdf eval --profile stig-rhel6-server --results
`hostname`-ssg-results.xml --report `hostname`-ssg-results.html --cpe
/usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
on my server. The output gave me stuff to work on and what seems to be
a list of false positives. I have not found these items in the STIG.
Could someone point me to them, or can we remove them from the scan if
they are not present?
I'm looking at the git repo but having issues with builds. So some of
these might already be fixed.
Thanks!
Leam
#####
Configure auditd admin_space_left Action on Low Disk Space
Disable IPv6 Networking Support Automatic Loading
Disable Kernel Parameter for Accepting ICMP Redirects By Default
Disable Kernel Parameter for Accepting Secure Redirects By Default
Disable Kernel Parameter for Accepting Secure Redirects for All
Interfaces
Disable Kernel Parameter for Sending ICMP Redirects by Default
Disable Modprobe Loading of USB Storage Driver
Ensure All Files Are Owned by a Group
Ensure All Files Are Owned by a User
Ensure auditd Collects Unauthorized Access Attempts to Files
(unsuccessful)
Ensure SELinux State is Enforcing
Implement Blank Screen Saver
Record Events that Modify User/Group Information
Set SSH Client Alive Count
DISA FSO wanted to retitle some of the rules, e.g. "Ensure All Files Are
Owner by a Group" they wanted to be a declarative "All Files Must be
Owned by a Group"
Within the content, we map back to the raw DISA CCI requirements through
the <ref disa=""> tags. To pull them out:
1) Find what XCCDF file/rule things map back to, e.g.:
[shawn@SSG-RHEL6 input]$ pwd
/var/www/html/scap-security-guide/RHEL6/input
[shawn@SSG-RHEL6 input]$ grep -rin "Ensure SELinux State is Enforcing" *
system/selinux.xml:107:<title>Ensure SELinux State is Enforcing</title>
2) Open the file, find the <ref> tag, to identify the DISA CCI:
<Rule id="set_selinux_state"
severity="medium">
.......
<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32,26"/>
<tested by="DS" on="20121024"/>
</Rule>
So, in this case, "Ensure SELinux State is Enforcing" maps to DISA CCI's
22, 32, and 26.