G'Morning. New to the list & getting spun up on SSG for RHEL-6. Couple
quick questions:
In the current content, the rules fail even if the supporting package is
not installed (e.g. shows vulnerable for postfix checks even if postfix is
not installed).
1. Are there currently any mappings between OVAL tests and the RPMs that
are dependencies (e.g. "test_postfix_server_banner" requires postfix-x-x.rpm
to be installed)? If not, I can start mapping this out in a
spreadsheet/CSV to get started.
2. Would the correct way to handle this be in the individual OVAL checks
("AND" the current test and an RPM test for the package)? Or is there a
more elegant way to handle this with OVAL_CPE?
Thanks.
~Ed
Show replies by date