@Shawn/Shannon: Thanks a lot for explaining OVAL vs. XCCDF.
@Jeffrey : this goes beyond simply re-running the files trough tidy &
xmllint so I'll leave it at this. If there's anything I can do just
let me know.
Regards,
Willem.
On Wed, Aug 8, 2012 at 12:04 AM, Shawn Wells <shawn(a)redhat.com> wrote:
Shannon hit it on the head. The xccdf-manual includes
"procedural" checks
that can not be automated with OVAL. An example of that would be there are
government policies mandating proper backups, however there isn't a single
system flag or command that can verify this. The intent is to process
"procedural checks" is to use OCIL, however that is still very much
evolving.
Note that the disa-stig-* files are included for us to reference while we
build out content for the RHEL6 STIG. As a community we wanted to ensure
that we inherited RHEL5 STIG controls where appropriate, so we dropped the
disa-stig-* files into the RHEL6/references directory to allow developers to
double check things. Those files absolutely should not be considered
official DISA content!
In regards to SSG output things will still be dropped into
rhel6-xccdf-scap-security-guide.xml.
-Shawn
On 8/7/12 4:14 PM, Shannon Mitchell wrote:
I'm just guessing here, but it looks like the manual is meant to be the full
thing. The oval language seems very limited on what it can do, so it only
takes care of a small subset of the full set of checks. The bad thing is
that it looks like the nessus scans that I have seen run against my systems
check for all of them and not just the 350 in the benchmark.
On Tue, Aug 7, 2012 at 4:03 PM, Willem Bos <whbos(a)xs4all.nl> wrote:
>
> Hi Shannon,
>
> Thanks. OK, so where do the extra id's come from? I grep-ed the whole
> scap-security-guide directory on a id from the *-manual.xml file but -
> apart from the file itself - got no results...
>
> Regards,
> Willem.
>
> On Tue, Aug 7, 2012 at 9:20 PM, Shannon Mitchell
> <shannon.mitchell(a)merlintechs.com> wrote:
> > Every gen Id in the benchmark is in the manual. The manual contains all
> > 350
> > plus an extra 219.
> >
> > On Aug 7, 2012 1:41 PM, "Willem Bos" <whbos(a)xs4all.nl> wrote:
> >>
> >> Hi Jeffrey,
> >>
> >> Are you sure disa-stig-rhel5-v1r0.6-xccdf-manual.xml is based on
> >> disa-stig-rhel5-v1r0.6-xccdf.xml?
> >>
> >> The *-manual.xml file contains a lot more <title>GEN*</title>
tags :
> >>
> >> grep -c '<title>GEN'
U_RedHat_5_V1R0.6_STIG_Benchmark-xccdf.xml
> >> 350
> >>
> >> grep -c '<title>GEN'
> >> scap-security-guide/RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf.xml
> >> 350
> >>
> >> grep -c '<title>GEN'
> >>
> >>
> >>
scap-security-guide/RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
> >> 569
> >>
> >> Maybe I'm missing something obvious but like I said, I'm new to
this
> >> stuff
> >> :)
> >>
> >> Regards,
> >> Willem.
> >>
> >>
> >> On Mon, Aug 6, 2012 at 4:20 PM, Jeffrey Blank
<blank(a)eclipse.ncsc.mil>
> >> wrote:
> >> > This should be the same semantically (as the authoritative version
> >> > from
> >> >
iase.disa.mil) -- I just ran it through xmllint (or was it tidy?) to
> >> > make it readable in a text editor. (And yes, I should have
> >> > documented
> >> > this.)
> >> >
> >> > I really can't remember which, but if you'd like to do a quick
re-run
> >> > of
> >> > each and compare, it would certainly be good for us to document its
> >> > congruence with the official version :)
> >> >
> >> > (Also note that we are not the maintainers of that content for RHEL
> >> > 5.)
> >> >
> >> >
> >> >
> >> >
> >> > On 08/06/2012 03:00 AM, Willem Bos wrote:
> >> >> Hi All,
> >> >>
> >> >> The GIT repo contains the file
> >> >> RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml. This is
> >> >> not
> >> >> part of the zipfile you can download from
> >> >>
> >> >>
http://web.nvd.nist.gov/view/ncp/repository/checklist/download?id=1059.
> >> >>
> >> >> I could not find a Makefile target that creates it. What is its
> >> >> origin?
> >> >>
> >> >> Regards,
> >> >> Willem.
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide