Bond,

The RHEL SCAP content actually contains an OVAL test of the platform you are on. Since you are on CentOS, rather than RHEL, all the tests in the profile test fails and all the test evaluate as non-applicable.

This can be fixed a couple ways.
1) Alter the actual OVAL test to test for CentOS instead of RHEL (see below)
2) Build SCAP-Security-Guide content for CentOS from the GitHub repo
3) Take a look at https://github.com/openprivacy/ansible-scap

More details
1) Use the CentOS quick start in https://github.com/GovReady/govready if you are working with RHEL 6.5 content.

2) I should know this, but not off the top of my head (and I have to run out). But I believe we can now build SSG from https://github.com/OpenSCAP/scap-security-guide

3) https://github.com/openprivacy/ansible-scap is very cool b/c it builds SSG from source for RHEL 7 and it shows how to use GovReady and OpenSCAP-ssh to remotely scan machines.

Background
(re-posted from a previous email to list)

SCAP (Security Content Automation Protocol) is actually a set of multiple standards and specifications that are used together to enable automatically testing hundreds of nerd settings. Let me emphasize that: SCAP is not a single XML specification -- SCAP is multiple standards and specs. Whenever you give "SCAP Content" to a scanner to check a system configurations you are giving the scanner multiple XML files representing multiple standards.

- XCCDF describes the checklist (Extensible Configuration Checklist Description Format). [1]
- CCE are unique identifiers and descriptive material for specific configuration settings (Common Configuration Enumeration). [1]
- OVAL is the XML that describes tests, including multi-part tests, that assess if a CCE identified configuration setting is correct on a system. (Open Vulnerability Assessment Language) [1]
- CPE is as unique string of text to uniquely identify a "platform" of software, hardware, or application (Common Platform Enumeration). The idea is that CPE string can be used to associate a checklist (XCCDF), a configuration setting (CCE) or test (OVAL) with a specific platform. (Oy!) [1]

And the list goes on. But to understand how to use SCAP-Security-Guide on CentOS we only need to worry about  XCCDF, CCE, OVAL, and CPE. (At least I think...)

Almost all RHEL CCE's (config settings) and OVAL (test criterion) work on CentOS. The exception are those settings/tests like the RHEL GPG key installed which only make sense in relation to a RHEL subscription and do not apply to CentOS

So why does OpenSCAP run SCAP-Security-Guide on CentOS, but the results come back "not applicable?"  Two reasons:
1) Because the XCCDF in RHEL refers to CPE XML file that specifies RHEL and not CentOS.
2) Because CPE platform string is verified with an OVAL test that checks the RPMs for platform identification.

Thus, to get OpenSCAP to work on CentOS, we need to tell OpenSCAP to use a CPE-dictionary.xml file that includes a CPE string for CentOS and we need to have a corrected OVAL test that validates we are on CentOS.

And how do we do this reliability? Part of what I'm trying to do with my software, GovReady [2], is to make things like this easier. 

But you don't have to use GovReady. If you read the CentOS quick start in the GovReady README, you will see link to a CentOS ssg-centos6-cpe-oval.xml and ssg-centos6-cpe-oval.xml file that make the necessary adjustments. You just need to copy them to your local CentOS server and then correctly specify their path when running OpenSCAP. Like so:

oscap xccdf eval --oval-results --profile server --cpe scap/content/ssg-centos6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

Alternatively, you could manually update the CPE and OVAL XML file using (e.g., using a sed statement). 

It's still kind of confusing for me. So I hope I have the above correct.


Greg Elin
http://govready.org - Making FISMA compliance easier for innovators

phone: 917-304-3488

On Tue, Jun 30, 2015 at 5:56 PM, Bond Masuda <bond.masuda@hexadiam.com> wrote:
Hello,

Is there a guide on how to use the RHEL SCAP content for CentOS? When I
try to use it, I get a lot of "Result: notapplicable". What needs to be
done?

I'm using it with OpenSCAP per the manual:

# oscap xccdf eval --profile stig-rhel6-server-upstream \
     --results /tmp/`hostname`-ssg-results.xml \
     --report /tmp/`hostname`-ssg-results.html \
     --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
     /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

TIA,
-Bond
--
SCAP Security Guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
https://github.com/OpenSCAP/scap-security-guide/