I should have caught that myself Peter, thanks.
Anyone have an idea why I cannot get rid of:
prelink: /usr/lib64/libgnome-bluetooth.so.7.0.2: at least one of file's
dependancies has changed since pre linking
It is keeping the rpm_verify_permissions from passing? # rpm -Va | grep
'^.M' is returning the above ^^ line.
I tried turning prelink off and running # pre link -au as per
and it did clear all
the other prelink problems the box I am on had, except the above one...
Very Respectfully,
Brian Peake
On 11/8/12 4:45 PM, "Peter Vrabec" <pvrabec(a)redhat.com> wrote:
Ooops my mistake,
on -> off, intention is to turn it off(kernel_module_bluetooth_disabled).
alias bluetooth off
alias net-pf-31 off
:)
----- Original Message -----
> From: "Brian Peake" <PEAKE(a)HIPKLLC.COM>
> To: scap-security-guide(a)lists.fedorahosted.org
> Sent: Thursday, November 8, 2012 7:13:52 PM
> Subject: Re: using SCC/CSCC with SSG content
>
> Thanks Peter for the feedback! Comments below
>
> Very Respectfully,
> Brian Peake
>
> On 11/8/12 11:39 AM, "Peter Vrabec" <pvrabec(a)redhat.com> wrote:
>
> >Hi Brian,
> >
> >thnx. for the feedback. I have reviewed couple of your findings.
> >
> > > 1. Set_bootloader_password
> > > 2. Enable_auditd_bootloader
> > > 3. Limit_password_reuse
> > > 4. All the pam_cracklib.so settings you already mentioned...
> >
> >
> >These all ^^^ should be already fixed when we fixed #4. It's a same
> >problem - textfilecontent54 on symlink.
>
> Excellent news. Looking fwd to 0.9.2
> >
> > > Other parameters that fail also, that I KNOW are set properly:
> > > 1. kernel_module_bluetooth_disabled
> > > 2. sshd_set_idle_timeout
> > > 3. sshd_disable_empty_passwords
> > > 4. sshd_do_not_permit_user_env
> >
> >I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't
> >reproduce the fail you can see.
> >
> >If I put
> >"
> >alias bluetooth on
> >alias net-pf-31 on
> >"
> >into "dist.conf" file and run the scan I get
> >...
> >Title Disable Bluetooth Kernel Modules
> >Rule kernel_module_bluetooth_disabled
> >Ident CCE-14948-4
> >Result pass
> >....
>
> Well I was using /etc/modprobe.d/modprobe.conf I tried adding to
> distro.conf
>
> alias bluetooth on
> alias net-pf-31 on
>
> With same results.
> # grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
> grep: /etc/modprobe.conf: No such file or directory
> /etc/modprobe.d/dist.conf:alias bluetooth on
> /etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
>
> Grep reports the same for net-pf-31, So I am not sure why it is
> failing
> for me.
>
>
> >
> >I'll take a look at the rest.
> >
> >Peter.
> >
> >
> >On 11/07/2012 03:56 PM, Brian Peake wrote:
> >> Peter,
> >>
> >> A list that passes on my test VM using SCC w/ SSG content (from
> >> the
> >> scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/
> >> SSG:
> >>
> >> PASSES w/ SCC. FAILS w/ oscap
> >>
> >> 1. Set_bootloader_password
> >> 2. Enable_auditd_bootloader
> >> 3. Limit_password_reuse
> >> 4. All the pam_cracklib.so settings you already mentioned...
> >>
> >>
> >> Below is due to OVAL perhaps (tbh I don't know without digging)?
> >>
> >> Set properly with sysctl and in /etc/sysctl.conf, but fails w/
> >> OpenSCAP
> >> (non of the kernel parameters are checked with SCC tool, returns
> >> all
> >> errors during run)
> >> 1. enable_randomize_va_space
> >> 2. enable_execshield
> >> 3. set_sysctl_net_ipv4_conf_all_log_martians
> >> 4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
> >> 5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
> >> 6. set_sysctl_net_ipv4_tcp_syncookies
> >> 7. set_sysctl_net_ipv4_conf_all_rp_filter
> >> 8. set_sysctl_net_ipv4_conf_default_rp_filter
> >>
> >> Other parameters that fail also, that I KNOW are set properly:
> >> 1. kernel_module_bluetooth_disabled
> >> 2. sshd_set_idle_timeout
> >> 3. sshd_disable_empty_passwords
> >> 4. sshd_do_not_permit_user_env
> >>
> >> For the life of me - /etc/issue is set correctly (using the full
> >> DoD
> >> warning), but I cannot get it to pass?
> >> I am also using GDM and have a working login banner, but that also
> >>fails?
> >>
> >>
> >> Very Respectfully,
> >>
> >> Brian Peake
> >>
> >>
> >>
> >> On 11/6/12 9:55 PM, "Shawn Wells" <shawn(a)redhat.com> wrote:
> >>
> >>> On 11/6/12 10:16 AM, Brian Peake wrote:
> >>>> Thanks for the info Peter! I will get back when I get some time,
> >>>> hopefully
> >>>> tomorrow, with some examples.
> >>>
> >>>
> >>> I was able to run a scan tonight using the latest git clone of
> >>> SSG
> >>> against the SCC tool. I've posted the output here:
> >>>
http://people.redhat.com/swells/random/cscc.out.txt
> >>>
> >>> oscap output of the same content here:
> >>>
http://people.redhat.com/swells/random/oscap.out.txt
> >>>
> >>> I'll drop the OVAL results somewhere shortly -- it generated
> >>> 300MB of
> >>> output!! Try not to laugh (cry?) at all our OVAL errors. Please
> >>> keep in
> >>> mind we haven't made OVAL a focus yet!
> >>>
> >>> Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual
> >>> machine:
> >>> real 21m59.028s
> >>> user 21m17.791s
> >>> sys 0m33.558s
> >>>
> >>> Compared against oscap:
> >>> real 0m39.854s
> >>> user 0m27.210s
> >>> sys 0m12.671s
> >>> _______________________________________________
> >>> scap-security-guide mailing list
> >>> scap-security-guide(a)lists.fedorahosted.org
> >>>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >>>
> >>
> >>
> >> _______________________________________________
> >> scap-security-guide mailing list
> >> scap-security-guide(a)lists.fedorahosted.org
> >>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >>
> >
> >_______________________________________________
> >scap-security-guide mailing list
> >scap-security-guide(a)lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide