On Thu, Nov 16, 2017 at 8:49 AM, Olivier BONHOMME <obonhomme(a)nerim.net>
wrote:
On Wed, Nov 15, 2017 at 05:52:35PM +0100, Watson Yuuma Sato wrote:
> On 15/11/17 13:15, Olivier BONHOMME wrote:
> > Dear OpenScap community,
> >
> > I'm currently working for my company on checking the RHEL 7 SSG
profile (0.1.36 version) coverage against STIG 1.3 release.
> >
> > While browsing the 0.1.36 release, I discovered the stig-overlays.xml
which shows the matching between SSG rule and STIG rule.
> >
> > Can anybody confirm that I can use that file in order to check the
coverage rate of the SSG profile ?
> Hello, Olivier.
>
> I'd say yes, as the stig_overlay maps Rules in STIG to Rules in SSG.
> Rules that don't map to any Rule in SSG will have ruleid="XXXX".
>
> Last time stig_overlay.xml was updated in upstream was around 8 months
> ago, so the version there probably isn't STIG 1.3. And unfortunately I
> couldn't find to witch version it corresponds.
>
> To generate an updated stig_overlays.xml file, please refer to our
> Developer Guide [1].
>
> [1]
>
https://github.com/OpenSCAP/scap-security-guide/blob/
master/docs/manual/developer_guide.adoc#stig-overlay-content
Hello Watson,
Thanks for that clear answer. I followed the documentation from the dev
guide
and the result is that there is only two rules which are not matched
against the
STIG v1.3. So congrats to the team for such a good job !
I also have a more "senstive" question. It's about the same task but with
CentOS
profile but when I used the create-stig-overlay.py script, all the rules
were
tagged XXXX.
After some investigations, I identified that when the derivative
distribution
generation is enabled, the matching with STIG is removed which is bad for
doing
a coverage check for the CentOS profile.
I fully understand the reason provided in the commit message when it has
been
enabled but I would be curious if it would be possible to let the RHEL
stigid
rules in a very unofficial way adding a CMake option ?
This is expected behaviour. A separate CentOS STIG has to be created and
exist for a
stig_overlay.xml to be created and exist.CentOS *does not* meet STIG
compliance
equirements nor do Red Hat certificationstransfer or follow down to the
derivatives. The
CentOS project also echos this statement at
https://wiki.centos.org/FAQ/General#head-4b2dd1ea6dcc1243d6e3886dc3e5d1eb...
For this reason, all RHEL identifiers have been stripped out of the
derivative profiles.
You should not have to check coverage of the CentOS profile as the CentOS
profile
is almost an exact copy of the RHEL profile just with some changes to work
on CentOS.
Also, some RHEL checks/rules in the STIG are duplicates of others, or they
are no longer valid for
the latest release. Any of duplicated/outdated checks/rules have been
remove/updated (as much
as feasibly possible) for the latest release. So if there are missing RHEL
identifiers, it is usually
because of duplication or new content that has yet to be added.