Hello Chuck,
thank you for checking.
----- Original Message -----
From: "Chuck Atkins" <chuck.atkins(a)kitware.com>
To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org>
Sent: Monday, August 1, 2016 9:19:14 PM
Subject: How do I use remote resources offline?
I'm trying to use scap-workbench to run the Upstream STIG for RHEL6
Workstation profile and it explicitly wants the RHEL6 OVAL as a remote
resource,
http://www.redhat.com/security/data/oval/Red_Hat_Enterprise_Linux_6.xml . If
I check "Fetch remote resources" then, of course, the scans and remediation
work as expected but how can i get the entire benchmark to run offline?
AFAICT the offline scan with Red_Hat_Enterprise_Linux_6.xml pre-downloaded
isn't possible right now. Not like it wouldn't be possible to implement that
(maybe it could be possible to specify some expected location, where these files
could live and use "file:///" protocol instead of "http://" one, like
doing
currently).
But the issue is right now there isn't motivation to do that. Let me explain -
the Red Hat Enterprise Linux 6 CVE OVAL changes pretty quickly (to my knowledge
it's updated every 12 hours). So instructing oscap / scap-workbench tools to
use cached XML file from some chosen location would be prone to "false sense
of security" (suppose 2 weeks outdated "Red_Hat_Enterprise_Linux_6.xml"
file
that would be used to scan the system in question rather than more recent one -
this could result in state the system wouldn't be reported as vulnerable to
pretty lot of CVE issues).
Unfortunately the way OVAL standard works isn't that flexible it would allow
something like:
if timestamp / MD5 sum on "Red_Hat_Enterprise_Linux_6.xml" file differs:
use the most recent version
else:
use the cached version
OVAL only allows to specify URI where the remote content should be retrieved
from (but there isn't some timestamp / MD5 sum checking).
Can
I download the oval info ahead of time and place it in a specific location?
Not right now. Sorry. See above for the explanation.
Maybe we could consider enhancing the current implementation (to honour
remote OVAL timestamps / MD5 sums and use cached version if possible).
But this:
* First needs scap-workbench RFE ticket,
* Itself is subject of upstream discussion, and can be closed as hard /
impossible to implement properly.
Hope this helps.
Regards, Jan
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
>
> ----------
> Chuck Atkins
> Staff R&D Engineer, Scientific Computing
> Kitware, Inc.
> (518) 881-1183
>
> --
> SCAP Security Guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedo...
>
https://github.com/OpenSCAP/scap-security-guide/
>