It appears that the full command is needed. The scan won't run without the
cpe/dictionary reference. The minimal command needed is as follows:
oscap xccdf eval --profile <profile> \
--cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
Logan Rodrian
________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Brian Peake
[PEAKE(a)HIPKLLC.COM]
Sent: Thursday, March 07, 2013 06:47
To: scap-security-guide(a)lists.fedorahosted.org
Subject: EXT :Re: scap-security-guide 0.1-10 help
IGNORE my last. Just checked, that profile is there…
Very Respectfully,
Brian Peake
HiPK, LLC
From: Brian Peake <peake@hipkllc.com<mailto:peake@hipkllc.com>>
Reply-To:
<scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Date: Thu, 07 Mar 2013 08:41:59 -0500
To:
<scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: Re: scap-security-guide 0.1-10 help
Check the profile name: I found it appears to have changed and is no longer
stig-rhel6-server
I can't remember what it is now (have to scan the XCDDF), but the SSG site user
documentation had not been updated when I attempted my runs.
Very Respectfully,
Brian Peake
HiPK, LLC
From: "Rodrian, Logan P (IS)"
<Logan.Rodrian@ngc.com<mailto:Logan.Rodrian@ngc.com>>
Reply-To:
<scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Date: Thu, 7 Mar 2013 13:31:27 +0000
To:
"scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>"
<scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>>
Subject: RE: scap-security-guide 0.1-10 help
That is the URL where I found the command. I just happened to try the common profile in
addition to the stig-rhel6-server profile. Both yield the same result showing
"notapplicable".
Logan Rodrian
________________________________
From:
scap-security-guide-bounces@lists.fedorahosted.org<mailto:scap-security-guide-bounces@lists.fedorahosted.org>
[scap-security-guide-bounces@lists.fedorahosted.org<mailto:scap-security-guide-bounces@lists.fedorahosted.org>]
on behalf of Shawn Wells [shawn@redhat.com<mailto:shawn@redhat.com>]
Sent: Wednesday, March 06, 2013 19:53
To:
scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
Subject: EXT :Re: scap-security-guide 0.1-10 help
On 3/6/13 5:19 PM, Rodrian, Logan P (IS) wrote:
*
I am attempting a secstate audit and would like to use the newly released
scap-security-guide v0.1-10. I have tried simply applying the v0.1-10 rpm and importing
that content into secstate. When running a profile (no matter which is selected), the
report shows that none of the rules have been selected. Backing up a layer, I simply
tried the instructions on the scap-security-guide webpage of running:
oscap xccdf eval --profile common /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
...and then all output shows "Result notapplicable".
I haven't used the secstate tool much recently, so I can't address that... but as
for the oscap command above, where on the webpage did you find it? That's an outdated
invocation and needs to be updated.
Here's the current usage guide:
https://fedorahosted.org/scap-security-guide/wiki/usageguide
_______________________________________________ scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________ scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide