Using the oscap from openscap 0.9.3-1 and the ssg content fresh from the repo (0.1-12) I ran:
oscap xccdf eval --profile stig-rhel6-server --results `hostname`-ssg-results.xml --report `hostname`-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
on my server. The output gave me stuff to work on and what seems to be a list of false positives. I have not found these items in the STIG. Could someone point me to them, or can we remove them from the scan if they are not present?
I'm looking at the git repo but having issues with builds. So some of these might already be fixed.
Thanks!
Leam
#####
Configure auditd admin_space_left Action on Low Disk Space Disable IPv6 Networking Support Automatic Loading Disable Kernel Parameter for Accepting ICMP Redirects By Default Disable Kernel Parameter for Accepting Secure Redirects By Default Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces
Disable Kernel Parameter for Sending ICMP Redirects by Default Disable Modprobe Loading of USB Storage Driver Ensure All Files Are Owned by a Group Ensure All Files Are Owned by a User Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Ensure SELinux State is Enforcing Implement Blank Screen Saver Record Events that Modify User/Group Information Set SSH Client Alive Count
Add:
Verify File Permissions with RPM
On Thu, Sep 12, 2013 at 2:51 PM, leam hall leamhall@gmail.com wrote:
Using the oscap from openscap 0.9.3-1 and the ssg content fresh from the repo (0.1-12) I ran:
oscap xccdf eval --profile stig-rhel6-server --results `hostname`-ssg-results.xml --report `hostname`-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
on my server. The output gave me stuff to work on and what seems to be a list of false positives. I have not found these items in the STIG. Could someone point me to them, or can we remove them from the scan if they are not present?
I'm looking at the git repo but having issues with builds. So some of these might already be fixed.
Thanks!
Leam
#####
Configure auditd admin_space_left Action on Low Disk Space Disable IPv6 Networking Support Automatic Loading Disable Kernel Parameter for Accepting ICMP Redirects By Default Disable Kernel Parameter for Accepting Secure Redirects By Default Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces
Disable Kernel Parameter for Sending ICMP Redirects by Default Disable Modprobe Loading of USB Storage Driver Ensure All Files Are Owned by a Group Ensure All Files Are Owned by a User Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Ensure SELinux State is Enforcing Implement Blank Screen Saver Record Events that Modify User/Group Information Set SSH Client Alive Count
-- Mind on a Mission http://leamhall.blogspot.com/
On 9/12/13 2:51 PM, leam hall wrote:
Using the oscap from openscap 0.9.3-1 and the ssg content fresh from the repo (0.1-12) I ran:
oscap xccdf eval --profile stig-rhel6-server --results `hostname`-ssg-results.xml --report `hostname`-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
on my server. The output gave me stuff to work on and what seems to be a list of false positives. I have not found these items in the STIG. Could someone point me to them, or can we remove them from the scan if they are not present?
I'm looking at the git repo but having issues with builds. So some of these might already be fixed.
Thanks!
Leam
#####
Configure auditd admin_space_left Action on Low Disk Space Disable IPv6 Networking Support Automatic Loading Disable Kernel Parameter for Accepting ICMP Redirects By Default Disable Kernel Parameter for Accepting Secure Redirects By Default Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces Disable Kernel Parameter for Sending ICMP Redirects by Default Disable Modprobe Loading of USB Storage Driver Ensure All Files Are Owned by a Group Ensure All Files Are Owned by a User Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) Ensure SELinux State is Enforcing Implement Blank Screen Saver Record Events that Modify User/Group Information Set SSH Client Alive Count
DISA FSO wanted to retitle some of the rules, e.g. "Ensure All Files Are Owner by a Group" they wanted to be a declarative "All Files Must be Owned by a Group"
Within the content, we map back to the raw DISA CCI requirements through the <ref disa=""> tags. To pull them out:
1) Find what XCCDF file/rule things map back to, e.g.:
[shawn@SSG-RHEL6 input]$ pwd /var/www/html/scap-security-guide/RHEL6/input [shawn@SSG-RHEL6 input]$ grep -rin "Ensure SELinux State is Enforcing" * system/selinux.xml:107:<title>Ensure SELinux State is Enforcing</title>
2) Open the file, find the <ref> tag, to identify the DISA CCI:
<Rule id="set_selinux_state" severity="medium"> ....... <ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32,26"/> <tested by="DS" on="20121024"/> </Rule>
So, in this case, "Ensure SELinux State is Enforcing" maps to DISA CCI's 22, 32, and 26.
scap-security-guide@lists.fedorahosted.org