On Tue, Nov 21, 2017 at 3:28 PM, Olivier BONHOMME <obonhomme(a)nerim.net>
I'm still working in checking how many STIG rules have implemented
checks in OpenSCAP profiles. When executing oscap eval command, I
identified that there are several checks in status notchecked.
After some investigation, I identified that there was no oval checks
availables for these rules. After reading some documentation about OVAL
language, I was wondering if it will be possible to implement a check
for these rules.
For example, for the rule "homedirs must exist", the check consists in
doing a "pwchk -r" in order to identify if the homedirs exists or not.
With a shell script I know how to do that but in OVAL, i'm not sure if
it is possible.
So I have several questions about these kind of checks :
- Is it possible to implement them using OVAL with an oval rule which
can do result command checks ?
Yes it is.
- Is it possible to implement these checks using another language.
heard about SCE but it seems to be only for OpenSCAP.
You can definitely do that, but it won't be taken advantage of by Nessus
and other scanners that use SCAP
- Will these checks stay manual checks with notchecked status on SSG
The plan is that these checks will have OVAL and remediation scripts in the
It is really a matter of time, effort, and resources. There are tickets
already open for each of them already.
You can see them at
Getting the XCCDF into SSG is the easy part. The rest takes time.
So if you or anyone is willing and able to help get us there, PRs are
Thanks for your answers.
scap-security-guide mailing list -- scap-security-guide@lists.
To unsubscribe send an email to scap-security-guide-leave@