Huh, OK. I don't think that's what's going wrong here, since Shawn is
talking about the content of /etc/issue (and since everyone is using the
same interpreter), but I can go ahead and remove them from the small
handful of checks that use it.
- Maura Dailey
On 09/03/2013 12:14 PM, Shane Shaffer wrote:
Modifier spans like (?i) and (?-i) aren't supported in OVAL,
though
they will probably work in some interpreters depending on the regex
implementation.
Shane Shaffer
G2, Inc.
shane.shaffer(a)g2-inc.com <mailto:shane.shaffer@g2-inc.com>
On Tue, Sep 3, 2013 at 11:49 AM, Maura Dailey <maura(a)eclipse.ncsc.mil
<mailto:maura@eclipse.ncsc.mil>> wrote:
>> 240 /etc/ssh/sshd_config Banner
>> The OVAL check was definitely working on my system when
>> I last tested it. I'm able to reproduce...
>>
>> [root@rhel6 checks]# cat /etc/issue
>> You are accessing a U.S. Government (USG) Information
>> System (IS) that is provided for USG-authorized use
>> only. By using this IS (which includes any device
>> attached to this IS), you consent to the following
>> conditions:
>> -The USG routinely intercepts and monitors
>> communications on this IS for purposes including, but
>> not limited to, penetration testing, COMSEC monitoring,
>> network operations and defense, personnel misconduct
>> (PM), law enforcement (LE), and counterintelligence (CI)
>> investigations.
>> -At any time, the USG may inspect and seize data stored
>> on this IS.
>> -Communications using, or data stored on, this IS are
>> not private, are subject to routine monitoring,
>> interception, and search, and may be disclosed or used
>> for any USG-authorized purpose.
>> -This IS includes security measures (e.g.,
>> authentication and access controls) to protect USG
>> interests -- not for your personal benefit or privacy.
>> -Notwithstanding the above, using this IS does not
>> constitute consent to PM, LE or CI investigative
>> searching or monitoring of the content of privileged
>> communications, or work product, related to personal
>> representation or services by attorneys,
>> psychotherapists, or clergy, and their assistants. Such
>> communications and work product are private and
>> confidential. See User Agreement for details.
>>
>> [root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml
>> Evaluating with OVAL tempfile :
>> /tmp/sshd_banner_setXKCJxI.xml
>> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
>> Definition oval:scap-security-guide.testing:def:193: false
>> Definition oval:scap-security-guide.testing:def:191: false
>> Definition oval:scap-security-guide.testing:def:190: false
>> Evaluation done.
>>
>> Maura, do you want to take a stab at this (noticed your
>> signoff on the OVAL)?
>>
>> FWIW, if I used the USGCB banner everything worked OK.
>>
The ONLY thing the check is doing is checking that the line
'Banner /etc/issue' exists in /etc/ssh/sshd_config or that sshd is
disabled. It doesn't care about the content of /etc/issue at all.
I have no idea why it's failing for both of you guys. Full check
is below my signature for comparison.
- Maura Dailey
<def-group>
<definition class="compliance" id="sshd_banner_set"
version="1">
<metadata>
<title>Enable a Warning Banner</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>SSH warning banner should be enabled (and
dependencies are
met)</description>
<reference source="MED" ref_id="20130813"
ref_url="test_attestation" />
</metadata>
<criteria comment="SSH is not being used or conditions are met"
operator="OR">
<extend_definition comment="sshd service is disabled"
definition_ref="service_sshd_disabled" />
<criterion comment="Check Banner in /etc/ssh/sshd_config"
test_ref="test_sshd_banner_set" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all"
check_existence="all_exist"
comment="Tests the value of the Banner[\s]+/etc/issue setting in
the /etc/ssh/sshd_config file"
id="test_sshd_banner_set" version="1">
<ind:object object_ref="obj_sshd_banner_set" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sshd_banner_set"
version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide