On 11/1/12 1:00 PM, Peter Vrabec wrote:
Hi
Shawn,
if you see all the rules with notapplicable results it's because
we start supporting CPE applicability processing.
I see this in the content:
<platform idref="cpe:/o:redhat:enterprise_linux:6"/>
<platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
Please use "--cpe-dict" option. I have just found out that it's
missing in a man page. Well I need kick someone. :)
--cpe-dict ssg-rhel6-cpe-dictionary.xml
should work for you if you are on RHEL6 system.
If for some reason you don't want cpe applicability check you need
to remove <platform> elements from the content.
Thank you Peter!
I've pushed a few patches (per David's ack) which solve our
immediate content problems and cut a new RPM.
Eric (+interested parties): Can you download the following RPM and
provide feedback? If users report back this fixes their issue I'll
cut a new (official) release and put it on the wiki.
http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-7.noarch.rpm
As Peter mentioned above, be sure to use the --cpe-dict flag, e.g.:
$ oscap xccdf eval --profile stig-server --cpe-dict
ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml
PLEASE NOTE the now proper execution of CPE exposes
some errors in our OVAL. Some rules will pass/fail while others will
throw errors. We'll work on fixing these now, e.g.:
$ oscap xccdf eval --profile stig-server --cpe-dict
RHEL6/output/ssg-rhel6-cpe-dictionary.xml
RHEL6/output/ssg-rhel6-xccdf.xml
....
Title Ensure All World-Writable Directories Are Owned by a System
Account
Rule world_writable_files_system_ownership
Ident CCE-14794-2
Result fail
Title Ensure tftp Daemon Uses Secure Mode
Rule tftpd_uses_secure_mode
Ident CCE-TODO
Result pass
Title Enable Logging of All FTP Transactions
Rule ftp_log_transactions
Ident CCE-4549-2
Result notchecked
Title Ensure the Default Bash Umask is Set Correctly
Rule user_umask_bashrc
Ident CCE-3844-8
Result error