On Sun, 17 Feb 2013 01:41:06 -0500
Shawn Wells <shawn(a)redhat.com> wrote:
On 2/16/13 1:35 PM, Shawn Wells wrote:
> EXAMPLE USAGE:
>
> (since generate fix only produces scripts for failed rules, change all
> results to fail)
>
> if ! rpm -qa | grep -q aide; then
> yum -y install aide
> fi
>
> if rpm -qa | grep -q xinetd; then
> yum -y remove xinetd
> fi
>
> if rpm -qa | grep -q telnet-server; then
> yum -y remove telnet-server
> fi
>
> if rpm -qa | grep -q ypserv; then
> yum -y remove ypserv
> fi
My patch-push script keeps dropping things it thinks are comments.
Here's the full example workflow:
# oscap xccdf eval --profile stig-rhel6-server --results
/tmp/results.xml --oval-results --cpe-dict
output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-xccdf.xml
since `generate fix` only does so for failed rules, change everything to
failed to get sample output:
# sed -i
's/<result>pass<\/result>/<result>fail<\/result>/g'
/tmp/results.xml
# oscap xccdf generate fix --result-id
xccdf_org.open-scap_testresult_stig-rhel6-server /tmp/results.xml
#!/bin/bash
# OpenSCAP fix generator output for benchmark: DRAFT Guide to the Secure
Configuration of Red Hat Enterprise Linux 6
# XCCDF rule: install_aide
# CCE-27024-9
if ! rpm -qa | grep -q aide; then
yum -y install aide
fi
# XCCDF rule: uninstall_xinetd
# CCE-27005-8
if rpm -qa | grep -q xinetd; then
yum -y remove xinetd
fi
# XCCDF rule: uninstall_telnet_server
# CCE-27073-6
if rpm -qa | grep -q telnet-server; then
yum -y remove telnet-server
fi
# XCCDF rule: uninstall_ypserv
# CCE-27079-3
if rpm -qa | grep -q ypserv; then
yum -y remove ypserv
fi
# generated: 2013-02-16T13:40:22-05:00
# END OF SCRIPT
This looks really good. I'm ready to implement this tomorrow. I've got +-
400 "fix"es that need to be broke out so they can be maintained a bit more
easily. This is awesome.
I've been looking at the XCCDF spec, and I wish that there was a means of
having a "value-id" (as in the check-export) for a "fix". That would
allow a
remediation truly be based on a profile. The checks allow refine-values to be
adapted for each profile, but I see no way to do the same for the fixes. So I
guess a limitation to the fix is that it is a one size fits all. Unless you
all (who really know this stuff) knows of a way to add a value to a fix??
Thanks Shawn.
--
Brian Millett
"And if someone is living there?"
'Then all our races stand on the end of extinction.'
-- [ Sheridan and G'Kar (re: Z'ha'dum), "Revelations"]