Hi Ed,
Current focus is on making sure that the list of "requirements" in the
STIG-server profile represents a DoD consensus, and revving the XCCDF
accordingly. However, patches are welcome if you've got a sticking
point and want it fixed sooner:
https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper
While there's definitely a significant body of OVAL content, QA for it
is not top priority at this moment, but we definitely appreciate bug
reports / identification, and OVAL QA should begin before too long.
We'd be happy to get any research that helps create high-quality OVAL.
You may want to check out:
RHEL6/input/checks/templates/README
for how some of the other dependencies issues were handled (via
extend_definition).
I haven't studied CPE applicability yet to know if it represents a
solution. Maybe others know better.
The intent of the check is worth keeping in mind, too. For example, we
want Postfix to be installed in the existing Profiles that I can think
of. But granularity can be worked to serve other use cases; as you
suggest, it's reasonable to assert that a Rule which requires a Banner
could pass if there is no service from which to present that banner.
Jeff
On 10/23/2012 11:10 AM, Ed Sealing wrote:
G'Morning. New to the list & getting spun up on SSG for
RHEL-6. Couple
quick questions:
In the current content, the rules fail even if the supporting package is
not installed (e.g. shows vulnerable for postfix checks even if postfix
is not installed).
1. Are there currently any mappings between OVAL tests and the RPMs that
are dependencies (e.g. "test_postfix_server_banner" requires
postfix-x-x.rpm to be installed)? If not, I can start mapping this out
in a spreadsheet/CSV to get started.
2. Would the correct way to handle this be in the individual OVAL checks
("AND" the current test and an RPM test for the package)? Or is there a
more elegant way to handle this with OVAL_CPE?
Thanks.
~Ed
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide