Classification: UNCLASSIFIED
Caveats: NONE
My results were...interesting. I ran make in the latest git tree to generate
a zip file, then got the following error when attempting to import it from the
command line:
bash-4.1# ./cscc -is /home/username/scap-security-guide-0.1.16.zip
Stream ssg-ocilrefs-rhel6- is not a valid stream, therefore will not be
installed.
None of the content appeared in the menus. However, when I imported it using
the GUI, it accepted the content, and I was able to proceed with the remaining
steps. They seem very similar to what I've been doing in the GUI, so I wasn't
surprised when I got similar scan results:
bash-4.1# ./cscc
********************************************************************************
*
*
* SCAP Compliance Checker (SCC) 3.1.2
*
*
*
* Developed By
*
* SPAWAR Systems Center Atlantic
*
*
*
********************************************************************************
Connecting to HOSTNAME.EXAMPLE.COM...
Stream Version :0.9
Stream:ssg-rhel6
Profile:stig-rhel6-server-upstream
Time:2014-05-12_150548
HOSTNAME.EXAMPLE.COM: Loading ssg-rhel6-cpe-oval.xml
HOSTNAME.EXAMPLE.COM: OVAL Schema Version: 5.10
[ERROR] Invalid content. No OVAL object value found for package 'NAME'.
Target System:
HOSTNAME.EXAMPLE.COM
Selected Profile: stig-rhel6-server-upstream
Stream Name: ssg-rhel6-
Stream Version: 0.9
Stream Date: 2014-05-12
SCAP Stream: ssg-rhel6
Profile ID: stig-rhel6-server-upstream
Definition ID: oval:ssg:def:100
Test ID: oval:ssg:tst:3135
Object ID: oval:ssg:obj:3136
HOSTNAME.EXAMPLE.COM: Saving
HOSTNAME.EXAMPLE.COM_SCC-3.1.2_2014-05-12_150548_OVAL-CPE-Results_ssg-rhel6.xml
HOSTNAME.EXAMPLE.COM: Loading ssg-rhel6-cpe-dictionary.xml
HOSTNAME.EXAMPLE.COM: The SCAP content stream <ssg-rhel6-> is not applicable
to this platform per the CPE definitions
Total Errors: 1
Total Warnings: 0
Review complete.
Results, if any, are located in the following directory:
/home/username/SCC/Results
Logs, if any, are located in the following directory:
/home/username/SCC/Logs
--
Ray Shaw (Contractor, STG)
Army Research Laboratory
CIO, Unix Support
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap-
security-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Shawn Wells
Sent: Monday, May 12, 2014 12:34 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: SCC (UNCLASSIFIED)
On 5/9/14, 9:28 AM, Shaw, Ray V CTR USARMY ARL (US) wrote:
> Classification: UNCLASSIFIED
> Caveats: NONE
>
> I remember that there were issues with the SSG content and RHEL6 (due
> to SCC not supporting a sufficient version of...XCCDF? SCAP?). But
> previously, I could still use SCC with the SSG content; it would just
> generate a few more false positives than using OpenSCAP. Admittedly,
> it has been a while since I tried.
>
> Now, when trying SCC 3.1.2, I can't make it run at all. After
> importing the zip file (generated from git) and selecting the
> stig-rhel6-server-upstream profile, a scan finishes almost
immediately with:
>
> The SCAP content stream <ssg-rhel6-> is not applicable to this
> platform per the CPE definitions
>
> I've tried on both RHEL6 Workstation and Server, and I've also tried
> stripping the <platform> information from the XML files.
>
> I'm attempting this for two reasons, as otherwise I'm perfectly happy
> scanning with OpenSCAP. SCC has the ability to run a check on a
> single rule at a time, which is useful. Also, I have an inspection
> soon, and they may want me to use it.
Through feedback and active dialog with SPAWAR, we wrote a quick "SCC
Usage" guide back in Nov 2013 [1]. Could you give it a skim, and if
you're still having problems, I'll download a copy of the latest SCC
and see if I can duplicate. The existing docs were written against SCC
3.1 RC2, so in theory there should be minimal differences against the
GA
release:
http://people.redhat.com/swells/scap-security-
guide/docs/User_Guide/tmp/en-US/html-single/#sect-User_Guide-Alt_Tools-
SCC
[1]
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-
November/004468.html
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Classification: UNCLASSIFIED
Caveats: NONE