I'm using the yum repos for my latest download also instead of git. I can corroborate several of the false positives on my RHEL6 box after locking things down with Security Blanket, and manually reviewing the failures. There are several that need additional
scrutiny. I used SCC 3.1 GA to run the checks as it seems to give me more insight into the results than oscap does (any suggestions on increasing the who/what/where/how/why logging w/o having to rebuild oscap from source appreciated).
I'd just reverted the VM where I'd done the SCC scan so I don't have the results in front of me, but from memory :
57/58/59 - SCC was showing the line, including the correct value, then complaining that the value didn't match what it was looking for. Wonder if this is a case of not handling the leading '-' incorrectly?
73 - I know the RHEL5 STIG had an issue with whitespace at one point that I'd gotten around
206-211 I don't have telnet on my box either, but I think it may be treating the failure of finding /etc/xinetd.d/telnet as not finding 'disabled' in that file
240 I had this also, but we set the file to point to /etc/issue rather than /etc/issue.net. The *contents* of both files are the same (the correct banner). Perhaps the check should be checking the contents of whatever banner is being used rather than just
the setting references the right file name?
From: firstname.lastname@example.org [email@example.com] on behalf of leam hall [firstname.lastname@example.org]
Sent: Wednesday, August 28, 2013 2:02 PM
Subject: Re: Various False Positives?
I'm using the openscap-utils rpm and the content from the Fedorahosted zip file.