On 2/17/13 8:08 PM, Brian Millett wrote:
On Sun, 17 Feb 2013 01:41:06 -0500
Shawn Wells<shawn(a)redhat.com> wrote:
> >On 2/16/13 1:35 PM, Shawn Wells wrote:
>> > >EXAMPLE USAGE:
>> > >
>> > >(since generate fix only produces scripts for failed rules, change all
>> > >results to fail)
>> > >
>> > >if ! rpm -qa | grep -q aide; then
>> > >yum -y install aide
>> > >fi
>> > >
>> > >if rpm -qa | grep -q xinetd; then
>> > >yum -y remove xinetd
>> > >fi
>> > >
>> > >if rpm -qa | grep -q telnet-server; then
>> > >yum -y remove telnet-server
>> > >fi
>> > >
>> > >if rpm -qa | grep -q ypserv; then
>> > >yum -y remove ypserv
>> > >fi
> >
> >My patch-push script keeps dropping things it thinks are comments.
> >Here's the full example workflow:
> >
> ># oscap xccdf eval --profile stig-rhel6-server --results
> >/tmp/results.xml --oval-results --cpe-dict
> >output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-xccdf.xml
> >
> >since `generate fix` only does so for failed rules, change everything to
> >failed to get sample output:
> ># sed -i
's/<result>pass<\/result>/<result>fail<\/result>/g'
> >/tmp/results.xml
> >
> ># oscap xccdf generate fix --result-id
> >xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
> >#!/bin/bash
> ># OpenSCAP fix generator output for benchmark: DRAFT Guide to the Secure
> >Configuration of Red Hat Enterprise Linux 6
> >
> ># XCCDF rule: install_aide
> ># CCE-27024-9
> >
> >if ! rpm -qa | grep -q aide; then
> >yum -y install aide
> >fi
> >
> >
> ># XCCDF rule: uninstall_xinetd
> ># CCE-27005-8
> >
> >if rpm -qa | grep -q xinetd; then
> >yum -y remove xinetd
> >fi
> >
> >
> ># XCCDF rule: uninstall_telnet_server
> ># CCE-27073-6
> >
> >if rpm -qa | grep -q telnet-server; then
> >yum -y remove telnet-server
> >fi
> >
> >
> ># XCCDF rule: uninstall_ypserv
> ># CCE-27079-3
> >
> >if rpm -qa | grep -q ypserv; then
> >yum -y remove ypserv
> >fi
> >
> >
> ># generated: 2013-02-16T13:40:22-05:00
> ># END OF SCRIPT
This looks really good. I'm ready to implement this tomorrow. I've got +-
400 "fix"es that need to be broke out so they can be maintained a bit more
easily. This is awesome.
That's awesome!! Hopefully this will provide a framework to incorporate
those scripts! A few considerations, as people start thinking about
submitting fix scripts:
- There needs to be a direct mapping between an XCCDF rule and script,
meaning a script should only fix one thing at a time.
- Name the scripts against the XCCDF rule it addresses
- When submitting patches, please make each script its own patch! This
will allow peer review on each script indivudually, and should they get
ack'd, you can push the specific components which are approved.
I've been looking at the XCCDF spec, and I wish that there was a
means of
having a "value-id" (as in the check-export) for a "fix". That would
allow a
remediation truly be based on a profile. The checks allow refine-values to be
adapted for each profile, but I see no way to do the same for the fixes. So I
guess a limitation to the fix is that it is a one size fits all. Unless you
all (who really know this stuff) knows of a way to add a value to a fix??
Tresys
was working on a proper way.
I've been (lamely) working around this:
$ grep "<refine-value" ssg-rhel6-xccdf.xml | awk -F\" ' { print $2
"="
$4 } ' >/tmp/fixscript.sh
$ oscap xccdf generate fix --result-id
xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
>/tmp/fixscript.sh
Allows me to use the xccdf variables until something real gets created.
Thanks Shawn.
I'm just one of many :)