Modifier spans like (?i) and (?-i) aren't supported in OVAL, though they
will probably work in some interpreters depending on the regex
implementation.
Shane Shaffer
G2, Inc.
shane.shaffer(a)g2-inc.com
On Tue, Sep 3, 2013 at 11:49 AM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
240 /etc/ssh/sshd_config Banner
> The OVAL check was definitely working on my system when I last tested
> it. I'm able to reproduce...
>
> [root@rhel6 checks]# cat /etc/issue
> You are accessing a U.S. Government (USG) Information System (IS) that is
> provided for USG-authorized use only. By using this IS (which includes any
> device attached to this IS), you consent to the following conditions:
> -The USG routinely intercepts and monitors communications on this IS for
> purposes including, but not limited to, penetration testing, COMSEC
> monitoring, network operations and defense, personnel misconduct (PM), law
> enforcement (LE), and counterintelligence (CI) investigations.
> -At any time, the USG may inspect and seize data stored on this IS.
> -Communications using, or data stored on, this IS are not private, are
> subject to routine monitoring, interception, and search, and may be
> disclosed or used for any USG-authorized purpose.
> -This IS includes security measures (e.g., authentication and access
> controls) to protect USG interests -- not for your personal benefit or
> privacy.
> -Notwithstanding the above, using this IS does not constitute consent to
> PM, LE or CI investigative searching or monitoring of the content of
> privileged communications, or work product, related to personal
> representation or services by attorneys, psychotherapists, or clergy, and
> their assistants. Such communications and work product are private and
> confidential. See User Agreement for details.
>
> [root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml
> Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
> Definition oval:scap-security-guide.testing:def:193: false
> Definition oval:scap-security-guide.testing:def:191: false
> Definition oval:scap-security-guide.testing:def:190: false
> Evaluation done.
>
> Maura, do you want to take a stab at this (noticed your signoff on the
> OVAL)?
>
> FWIW, if I used the USGCB banner everything worked OK.
>
>
The ONLY thing the check is doing is checking that the line 'Banner
/etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled. It
doesn't care about the content of /etc/issue at all. I have no idea why
it's failing for both of you guys. Full check is below my signature for
comparison.
- Maura Dailey
<def-group>
<definition class="compliance" id="sshd_banner_set"
version="1">
<metadata>
<title>Enable a Warning Banner</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>SSH warning banner should be enabled (and dependencies
are
met)</description>
<reference source="MED" ref_id="20130813"
ref_url="test_attestation"
/>
</metadata>
<criteria comment="SSH is not being used or conditions are met"
operator="OR">
<extend_definition comment="sshd service is disabled"
definition_ref="service_sshd_disabled" />
<criterion comment="Check Banner in /etc/ssh/sshd_config"
test_ref="test_sshd_banner_set" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all"
check_existence="all_exist"
comment="Tests the value of the Banner[\s]+/etc/issue setting in the
/etc/ssh/sshd_config file"
id="test_sshd_banner_set" version="1">
<ind:object object_ref="obj_sshd_banner_set" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sshd_banner_set"
version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide