Ooops my mistake,
on -> off, intention is to turn it off(kernel_module_bluetooth_disabled).
alias bluetooth off
alias net-pf-31 off
:)
----- Original Message -----
From: "Brian Peake" <PEAKE(a)HIPKLLC.COM>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Thursday, November 8, 2012 7:13:52 PM
Subject: Re: using SCC/CSCC with SSG content
Thanks Peter for the feedback! Comments below…
Very Respectfully,
Brian Peake
On 11/8/12 11:39 AM, "Peter Vrabec" <pvrabec(a)redhat.com> wrote:
>Hi Brian,
>
>thnx. for the feedback. I have reviewed couple of your findings.
>
> > 1. Set_bootloader_password
> > 2. Enable_auditd_bootloader
> > 3. Limit_password_reuse
> > 4. All the pam_cracklib.so settings you already mentioned...
>
>
>These all ^^^ should be already fixed when we fixed #4. It's a same
>problem - textfilecontent54 on symlink.
Excellent news. Looking fwd to 0.9.2
>
> > Other parameters that fail also, that I KNOW are set properly:
> > 1. kernel_module_bluetooth_disabled
> > 2. sshd_set_idle_timeout
> > 3. sshd_disable_empty_passwords
> > 4. sshd_do_not_permit_user_env
>
>I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't
>reproduce the fail you can see.
>
>If I put
>"
>alias bluetooth on
>alias net-pf-31 on
>"
>into "dist.conf" file and run the scan I get
>...
>Title Disable Bluetooth Kernel Modules
>Rule kernel_module_bluetooth_disabled
>Ident CCE-14948-4
>Result pass
>....
Well I was using /etc/modprobe.d/modprobe.conf… I tried adding to
distro.conf
alias bluetooth on
alias net-pf-31 on
With same results.
# grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
grep: /etc/modprobe.conf: No such file or directory
/etc/modprobe.d/dist.conf:alias bluetooth on
/etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
Grep reports the same for net-pf-31, So I am not sure why it is
failing
for me.
>
>I'll take a look at the rest.
>
>Peter.
>
>
>On 11/07/2012 03:56 PM, Brian Peake wrote:
>> Peter,
>>
>> A list that passes on my test VM using SCC w/ SSG content (from
>> the
>> scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/
>> SSG:
>>
>> PASSES w/ SCC. FAILS w/ oscap
>>
>> 1. Set_bootloader_password
>> 2. Enable_auditd_bootloader
>> 3. Limit_password_reuse
>> 4. All the pam_cracklib.so settings you already mentioned...
>>
>>
>> Below is due to OVAL perhaps (tbh I don't know without digging)?
>>
>> Set properly with sysctl and in /etc/sysctl.conf, but fails w/
>> OpenSCAP
>> (non of the kernel parameters are checked with SCC tool, returns
>> all
>> errors during run)
>> 1. enable_randomize_va_space
>> 2. enable_execshield
>> 3. set_sysctl_net_ipv4_conf_all_log_martians
>> 4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
>> 5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
>> 6. set_sysctl_net_ipv4_tcp_syncookies
>> 7. set_sysctl_net_ipv4_conf_all_rp_filter
>> 8. set_sysctl_net_ipv4_conf_default_rp_filter
>>
>> Other parameters that fail also, that I KNOW are set properly:
>> 1. kernel_module_bluetooth_disabled
>> 2. sshd_set_idle_timeout
>> 3. sshd_disable_empty_passwords
>> 4. sshd_do_not_permit_user_env
>>
>> For the life of me - /etc/issue is set correctly (using the full
>> DoD
>> warning), but I cannot get it to pass?
>> I am also using GDM and have a working login banner, but that also
>>fails?
>>
>>
>> Very Respectfully,
>>
>> Brian Peake
>>
>>
>>
>> On 11/6/12 9:55 PM, "Shawn Wells" <shawn(a)redhat.com> wrote:
>>
>>> On 11/6/12 10:16 AM, Brian Peake wrote:
>>>> Thanks for the info Peter! I will get back when I get some time,
>>>> hopefully
>>>> tomorrow, with some examples.
>>>
>>>
>>> I was able to run a scan tonight using the latest git clone of
>>> SSG
>>> against the SCC tool. I've posted the output here:
>>>
http://people.redhat.com/swells/random/cscc.out.txt
>>>
>>> oscap output of the same content here:
>>>
http://people.redhat.com/swells/random/oscap.out.txt
>>>
>>> I'll drop the OVAL results somewhere shortly -- it generated
>>> 300MB of
>>> output!! Try not to laugh (cry?) at all our OVAL errors. Please
>>> keep in
>>> mind we haven't made OVAL a focus yet!
>>>
>>> Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual
>>> machine:
>>> real 21m59.028s
>>> user 21m17.791s
>>> sys 0m33.558s
>>>
>>> Compared against oscap:
>>> real 0m39.854s
>>> user 0m27.210s
>>> sys 0m12.671s
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide(a)lists.fedorahosted.org
>>>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>>
>>
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>
>_______________________________________________
>scap-security-guide mailing list
>scap-security-guide(a)lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide