>From c1ac67410cf5d596b43f10f799131e3cfbcdd5a4 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 2 Apr 2012 13:46:21 -0400 Subject: [PATCH] Moved dist/ to input/dist_template Originally the dist/ folder was created to house the formal output of the make process, however with 'make rpm' the need for a specifically named output directory ( %{name}-%{version} ) was created. This moves dist/ into input/dist_template, so we can use it as a skeleton directory. The 'make dist' now copies input/dist_template to ${name}-%{version}, keeping all subfolders and .gitignore files. --- rhel6/src/Makefile | 4 +- rhel6/src/dist/README | 69 -------------------- rhel6/src/dist/STIG-draft/.gitignore | 1 - rhel6/src/dist/STIG-draft/README | 3 - rhel6/src/dist/USGCB-submission/.gitignore | 1 - rhel6/src/dist/USGCB-submission/README | 3 - rhel6/src/dist/content/.gitignore | 1 - rhel6/src/dist/guide/.gitignore | 3 - rhel6/src/dist/policytables/.gitignore | 2 - rhel6/src/dist/policytables/README | 2 - rhel6/src/input/dist_template/README | 69 ++++++++++++++++++++ .../src/input/dist_template/STIG-draft/.gitignore | 1 + rhel6/src/input/dist_template/STIG-draft/README | 3 + .../dist_template/USGCB-submission/.gitignore | 1 + .../input/dist_template/USGCB-submission/README | 3 + rhel6/src/input/dist_template/content/.gitignore | 1 + rhel6/src/input/dist_template/guide/.gitignore | 3 + .../input/dist_template/policytables/.gitignore | 2 + rhel6/src/input/dist_template/policytables/README | 2 + 19 files changed, 87 insertions(+), 87 deletions(-) delete mode 100644 rhel6/src/dist/README delete mode 100644 rhel6/src/dist/STIG-draft/.gitignore delete mode 100644 rhel6/src/dist/STIG-draft/README delete mode 100644 rhel6/src/dist/USGCB-submission/.gitignore delete mode 100644 rhel6/src/dist/USGCB-submission/README delete mode 100644 rhel6/src/dist/content/.gitignore delete mode 100644 rhel6/src/dist/guide/.gitignore delete mode 100644 rhel6/src/dist/policytables/.gitignore delete mode 100644 rhel6/src/dist/policytables/README create mode 100644 rhel6/src/input/dist_template/README create mode 100644 rhel6/src/input/dist_template/STIG-draft/.gitignore create mode 100644 rhel6/src/input/dist_template/STIG-draft/README create mode 100644 rhel6/src/input/dist_template/USGCB-submission/.gitignore create mode 100644 rhel6/src/input/dist_template/USGCB-submission/README create mode 100644 rhel6/src/input/dist_template/content/.gitignore create mode 100644 rhel6/src/input/dist_template/guide/.gitignore create mode 100644 rhel6/src/input/dist_template/policytables/.gitignore create mode 100644 rhel6/src/input/dist_template/policytables/README diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile index 7813624..100ea50 100644 --- a/rhel6/src/Makefile +++ b/rhel6/src/Makefile @@ -69,7 +69,7 @@ eval-common: oscap xccdf eval --profile common --results /tmp/results-test.xml ${OUT}/rhel6-xccdf-scap-security-guide.xml dist: content guide tables - cp -r dist/ ${DIST}/ + cp -r ${IN}/dist_template/ ${DIST}/ cp ${OUT}/rhel6-guide.html ${DIST}/guide cp ${OUT}/rhel6-xccdf-scap-security-guide.xml ${DIST}/content cp ${OUT}/rhel6-oval-scap-security-guide.xml ${DIST}/content @@ -108,5 +108,5 @@ rpm: dist clean: rm -f ${OUT}/*.xml ${OUT}/*.html ${OUT}/*.pdf ${OUT}/*.spec ${OUT}/*.tar ${OUT}/*.gz ${OUT}/*.ini - rm -f ${DIST}/policytables/*.html ${DIST}/guide/*.html ${DIST}/content/*.xml + rm -f ${DIST}/ rm -rf ${OUT}/RPMS/ diff --git a/rhel6/src/dist/README b/rhel6/src/dist/README deleted file mode 100644 index 9bcdc7a..0000000 --- a/rhel6/src/dist/README +++ /dev/null @@ -1,69 +0,0 @@ -Welcome to the scap-security-guide! - - -========= OVERVIEW ========= - -The scap-security-guide project, or SSG for short, aims to deliver security -guidance, baselines, and associated validation mechanisms for Red Hat Enterprise -Linux. We utilize the Security Content Automation Protocol (SCAP) to accomplish -this, with specific aims to be fully compliant with SCAP Version 1.1. The SSG -homepage is https://fedorahosted.org/scap-security-guide/, where you can find -the latest versions, documentation, a mailing list, and FAQs. - -SCAP content itself consists of XML files that enable automated compliance -checking. These are machine readable formats which can be used in your -security compliance tool of choice (oscap, FirstAidKit, etc). These structured -formats also enable the generation of human-readable documents such as guides, -checklists, and tables. - -(1) guide/ -This directory contains a human-readable prose guide, in HTML format. You can -view these guides in a standard web browser and they contain practical, actionable -information for system administrators. These guides not only list out the security -recommendations, but also contain reasoning and a mapping back to a U.S. Government -security policy where applicable. This should be your starting point to understand -the content that the SSG ships. - -(2) policymappings/ -In reviewing feedback from the user community it quickly became apparent that having -a table which maps SSG recommendations back to U.S. Government policies would be -incredibly helpful. Within the policymappings/ directory you will find tables which -link SSG recommendations back to U.S. Government policies, such as NIST 800-53 and -DCID 6/3. - -(3) content/ -This directory contains machine-consumable files (in the XCCDF and OVAL formats) -that can be used to carry out automated compliance checks. - -(3) USGCB-submission/ -This directory should contain SCAP content suitable for submission to NIST as a -United States Government Configuration Baseline. - -(4) STIG-draft/ -This directory should contain SCAP content suitable for submission to DISA FSO -as a STIG. - -Project Homepage: https://fedorahosted.org/scap-security-guide/ -Project Mailing List: https://fedorahosted.org/mailman/listinfo/scap-security-guide - - -========= USAGE ========= -To run a scan against the included "Generic Server" profile, run the following commands: - -$ cd content -$ oscap xccdf eval --profile server rhel6-xccdf-scap-security-guide.xml - -You will receive output displayed to your console indicating which checks your -system has passed (or failed), simular to the output below: - -Rule ID: xwindows_remote_listening -Title: Disable X Window System Listening -Result: fail - -Rule ID: disable_avahi -Title: Disable Avahi Server Software -Result: fail - -Rule ID: disable_dhcp_server -Title: Disable DHCP Service -Result: pass diff --git a/rhel6/src/dist/STIG-draft/.gitignore b/rhel6/src/dist/STIG-draft/.gitignore deleted file mode 100644 index 6722cd9..0000000 --- a/rhel6/src/dist/STIG-draft/.gitignore +++ /dev/null @@ -1 +0,0 @@ -*.xml diff --git a/rhel6/src/dist/STIG-draft/README b/rhel6/src/dist/STIG-draft/README deleted file mode 100644 index 71b716a..0000000 --- a/rhel6/src/dist/STIG-draft/README +++ /dev/null @@ -1,3 +0,0 @@ -This folder will contain SCAP content which meets DISA FSO requirements for a -RHEL 6 STIG. This will entail mapping to the OS SRG, as well as transforming -the content to ensure that its structure and format are consumable by FSO. diff --git a/rhel6/src/dist/USGCB-submission/.gitignore b/rhel6/src/dist/USGCB-submission/.gitignore deleted file mode 100644 index 6722cd9..0000000 --- a/rhel6/src/dist/USGCB-submission/.gitignore +++ /dev/null @@ -1 +0,0 @@ -*.xml diff --git a/rhel6/src/dist/USGCB-submission/README b/rhel6/src/dist/USGCB-submission/README deleted file mode 100644 index 6d88796..0000000 --- a/rhel6/src/dist/USGCB-submission/README +++ /dev/null @@ -1,3 +0,0 @@ -This folder will contain SCAP content suitable for submission to NIST as a -USGCB candidate for RHEL 6 in server and desktop roles, per NIST Special -Publication 800-70 Appendix E. diff --git a/rhel6/src/dist/content/.gitignore b/rhel6/src/dist/content/.gitignore deleted file mode 100644 index 6722cd9..0000000 --- a/rhel6/src/dist/content/.gitignore +++ /dev/null @@ -1 +0,0 @@ -*.xml diff --git a/rhel6/src/dist/guide/.gitignore b/rhel6/src/dist/guide/.gitignore deleted file mode 100644 index 1842498..0000000 --- a/rhel6/src/dist/guide/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -*.html -*.pdf -*.xml diff --git a/rhel6/src/dist/policytables/.gitignore b/rhel6/src/dist/policytables/.gitignore deleted file mode 100644 index 8174f51..0000000 --- a/rhel6/src/dist/policytables/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -*.xml -*.html diff --git a/rhel6/src/dist/policytables/README b/rhel6/src/dist/policytables/README deleted file mode 100644 index 73c8b57..0000000 --- a/rhel6/src/dist/policytables/README +++ /dev/null @@ -1,2 +0,0 @@ -This directory contains tables which demonstrate mapping of policy -requirements to system settings. diff --git a/rhel6/src/input/dist_template/README b/rhel6/src/input/dist_template/README new file mode 100644 index 0000000..9bcdc7a --- /dev/null +++ b/rhel6/src/input/dist_template/README @@ -0,0 +1,69 @@ +Welcome to the scap-security-guide! + + +========= OVERVIEW ========= + +The scap-security-guide project, or SSG for short, aims to deliver security +guidance, baselines, and associated validation mechanisms for Red Hat Enterprise +Linux. We utilize the Security Content Automation Protocol (SCAP) to accomplish +this, with specific aims to be fully compliant with SCAP Version 1.1. The SSG +homepage is https://fedorahosted.org/scap-security-guide/, where you can find +the latest versions, documentation, a mailing list, and FAQs. + +SCAP content itself consists of XML files that enable automated compliance +checking. These are machine readable formats which can be used in your +security compliance tool of choice (oscap, FirstAidKit, etc). These structured +formats also enable the generation of human-readable documents such as guides, +checklists, and tables. + +(1) guide/ +This directory contains a human-readable prose guide, in HTML format. You can +view these guides in a standard web browser and they contain practical, actionable +information for system administrators. These guides not only list out the security +recommendations, but also contain reasoning and a mapping back to a U.S. Government +security policy where applicable. This should be your starting point to understand +the content that the SSG ships. + +(2) policymappings/ +In reviewing feedback from the user community it quickly became apparent that having +a table which maps SSG recommendations back to U.S. Government policies would be +incredibly helpful. Within the policymappings/ directory you will find tables which +link SSG recommendations back to U.S. Government policies, such as NIST 800-53 and +DCID 6/3. + +(3) content/ +This directory contains machine-consumable files (in the XCCDF and OVAL formats) +that can be used to carry out automated compliance checks. + +(3) USGCB-submission/ +This directory should contain SCAP content suitable for submission to NIST as a +United States Government Configuration Baseline. + +(4) STIG-draft/ +This directory should contain SCAP content suitable for submission to DISA FSO +as a STIG. + +Project Homepage: https://fedorahosted.org/scap-security-guide/ +Project Mailing List: https://fedorahosted.org/mailman/listinfo/scap-security-guide + + +========= USAGE ========= +To run a scan against the included "Generic Server" profile, run the following commands: + +$ cd content +$ oscap xccdf eval --profile server rhel6-xccdf-scap-security-guide.xml + +You will receive output displayed to your console indicating which checks your +system has passed (or failed), simular to the output below: + +Rule ID: xwindows_remote_listening +Title: Disable X Window System Listening +Result: fail + +Rule ID: disable_avahi +Title: Disable Avahi Server Software +Result: fail + +Rule ID: disable_dhcp_server +Title: Disable DHCP Service +Result: pass diff --git a/rhel6/src/input/dist_template/STIG-draft/.gitignore b/rhel6/src/input/dist_template/STIG-draft/.gitignore new file mode 100644 index 0000000..6722cd9 --- /dev/null +++ b/rhel6/src/input/dist_template/STIG-draft/.gitignore @@ -0,0 +1 @@ +*.xml diff --git a/rhel6/src/input/dist_template/STIG-draft/README b/rhel6/src/input/dist_template/STIG-draft/README new file mode 100644 index 0000000..71b716a --- /dev/null +++ b/rhel6/src/input/dist_template/STIG-draft/README @@ -0,0 +1,3 @@ +This folder will contain SCAP content which meets DISA FSO requirements for a +RHEL 6 STIG. This will entail mapping to the OS SRG, as well as transforming +the content to ensure that its structure and format are consumable by FSO. diff --git a/rhel6/src/input/dist_template/USGCB-submission/.gitignore b/rhel6/src/input/dist_template/USGCB-submission/.gitignore new file mode 100644 index 0000000..6722cd9 --- /dev/null +++ b/rhel6/src/input/dist_template/USGCB-submission/.gitignore @@ -0,0 +1 @@ +*.xml diff --git a/rhel6/src/input/dist_template/USGCB-submission/README b/rhel6/src/input/dist_template/USGCB-submission/README new file mode 100644 index 0000000..6d88796 --- /dev/null +++ b/rhel6/src/input/dist_template/USGCB-submission/README @@ -0,0 +1,3 @@ +This folder will contain SCAP content suitable for submission to NIST as a +USGCB candidate for RHEL 6 in server and desktop roles, per NIST Special +Publication 800-70 Appendix E. diff --git a/rhel6/src/input/dist_template/content/.gitignore b/rhel6/src/input/dist_template/content/.gitignore new file mode 100644 index 0000000..6722cd9 --- /dev/null +++ b/rhel6/src/input/dist_template/content/.gitignore @@ -0,0 +1 @@ +*.xml diff --git a/rhel6/src/input/dist_template/guide/.gitignore b/rhel6/src/input/dist_template/guide/.gitignore new file mode 100644 index 0000000..1842498 --- /dev/null +++ b/rhel6/src/input/dist_template/guide/.gitignore @@ -0,0 +1,3 @@ +*.html +*.pdf +*.xml diff --git a/rhel6/src/input/dist_template/policytables/.gitignore b/rhel6/src/input/dist_template/policytables/.gitignore new file mode 100644 index 0000000..8174f51 --- /dev/null +++ b/rhel6/src/input/dist_template/policytables/.gitignore @@ -0,0 +1,2 @@ +*.xml +*.html diff --git a/rhel6/src/input/dist_template/policytables/README b/rhel6/src/input/dist_template/policytables/README new file mode 100644 index 0000000..73c8b57 --- /dev/null +++ b/rhel6/src/input/dist_template/policytables/README @@ -0,0 +1,2 @@ +This directory contains tables which demonstrate mapping of policy +requirements to system settings. -- 1.7.1