Just upgraded from the 0.1-1 rpm to the 0.1-6 rpm. System is a RHEL 6.3 system, openscap-utils is version 8.0. I am attempting to run, from the /usr/share/xml/scap//ssg/content directory:
oscap xccdf eval --profile server --results xccdf-results.xml ssg-rhel6-xccdf.xml
I have also tried the stig-server profile. In each case the results field is "null". It also generates multiple errors at the end of the eval:
1 1871 In file 'xccdf-results.xml' on line 15992: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 15995: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 15998: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 16001: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 16008: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 16011: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 16014: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 16769: Element '{http://checklists.nist.gov/xccdf/1.1%7DTestResult': Missing child element(s). Expected is one of ( {http://checklists.nist.gov/xccdf/1.1%7Drule-result, {http://checklists.nist.gov/xccdf/1.1%7Dscore ). XCCDF Results are NOT exported correctly. OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark.
The prior version, 0.1-1, generated a useful output which I was able to convert to a useable document with:
oscap xccdf generate report xccdf-results.xml > $HOSTNAME-openscap.html
I would appreciate any help possible,
Eric B
On 10/31/12 7:19 PM, Bueschel, Eric W CTR (US) wrote:
OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark.
The prior version, 0.1-1, generated a useful output which I was able to convert to a useable document with:
oscap xccdf generate report xccdf-results.xml > $HOSTNAME-openscap.html
I would appreciate any help possible,
Hmm. I went and did a fresh clone & make:
$ git clone -b RHEL6 ssh://shawndwells@git.fedorahosted.org/git/scap-security-guide.git $ cd scap-security-guide/RHEL6 $ make all
And ran a scan. I get the garbled output, however my error is slightly different: $ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml ..... OpenSCAP Error: Selector ID(service_postfix_enabled) does not exist in Benchmark. [xccdf_policy.c:2059]
$ grep -in "service_postfix_enabled" output/ssg-rhel6-xccdf.xml 412: <select idref="service_postfix_enabled" selected="true"/>
.... <select>'s within that range are indicating the rule is part of some profile, however there must be a matching rule. Probably a typo.
$ grep -in "service_postfix" output/ssg-rhel6-xccdf.xml 412: <select idref="service_postfix_enabled" selected="true"/> 13535: <Rule id="service_postfix_enable" severity="low" selected="false">
Went ahead and patched, recompiled the guide, and re-ran the scan: $ make clean; make all $ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml ...... OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark. [xccdf_policy.c:2059]
At least now our errors match up. I'll continue looking at this in the morning.
On Thursday, November 01, 2012 01:01:01 AM Shawn Wells wrote:
Went ahead and patched, recompiled the guide, and re-ran the scan: $ make clean; make all $ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml ...... OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark. [xccdf_policy.c:2059]
At least now our errors match up. I'll continue looking at this in the morning.
I have no idea if a bug in openscap might be causing this, but the latest test release is 0.9.1. I'd try to recreate the problem with that one.
Thanks, -Steve
On 11/1/12 10:02 AM, Steve Grubb wrote:
On Thursday, November 01, 2012 01:01:01 AM Shawn Wells wrote:
Went ahead and patched, recompiled the guide, and re-ran the scan: $ make clean; make all $ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml ...... OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark. [xccdf_policy.c:2059]
At least now our errors match up. I'll continue looking at this in the morning.
I have no idea if a bug in openscap might be causing this, but the latest test release is 0.9.1. I'd try to recreate the problem with that one.
It's still there on the latest EPEL:
$ rpm -qv openscap openscap-utils openscap-0.9.1-1.el6.x86_64 openscap-utils-0.9.1-1.el6.x86_64
Hi folks,
why do you consider this an openscap bug? I suppose it's a bug in the content. The profile you want to evaluate reference to not existing rule.
Peter.
On 11/01/2012 04:56 PM, Shawn Wells wrote:
On 11/1/12 10:02 AM, Steve Grubb wrote:
On Thursday, November 01, 2012 01:01:01 AM Shawn Wells wrote:
Went ahead and patched, recompiled the guide, and re-ran the scan: $ make clean; make all $ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml ...... OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark. [xccdf_policy.c:2059]
At least now our errors match up. I'll continue looking at this in the morning.
I have no idea if a bug in openscap might be causing this, but the latest test release is 0.9.1. I'd try to recreate the problem with that one.
It's still there on the latest EPEL:
$ rpm -qv openscap openscap-utils openscap-0.9.1-1.el6.x86_64 openscap-utils-0.9.1-1.el6.x86_64 _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On Thursday, November 01, 2012 05:31:00 PM Peter Vrabec wrote:
why do you consider this an openscap bug? I suppose it's a bug in the content. The profile you want to evaluate reference to not existing rule.
Well, the original poster was using 0.8 and I know bugs have been fixed since then. So, in troubleshooting the issue, its a simple step to just update to the latest and see if its still there or its fixed. They said its still there, so its time to look deeper at the content.
Maybe git bisect is helpful if it is known to have worked sometime in the past.
-Steve
On 11/1/12 12:34 PM, Steve Grubb wrote:
On Thursday, November 01, 2012 05:31:00 PM Peter Vrabec wrote:
why do you consider this an openscap bug? I suppose it's a bug in the content. The profile you want to evaluate reference to not existing rule.
Well, the original poster was using 0.8 and I know bugs have been fixed since then. So, in troubleshooting the issue, its a simple step to just update to the latest and see if its still there or its fixed. They said its still there, so its time to look deeper at the content.
Maybe git bisect is helpful if it is known to have worked sometime in the past.
There's a two part problem. Yes, some errors are caused by the bugs in RHEL6 openscap (v0.8?). Specifically:
1 1871 In file 'xccdf-results.xml' on line 15992: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 15995: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ).
With that said, there are errors in the XCCDF content itself. Patches coming soon.
On 11/1/12 12:42 PM, Shawn Wells wrote:
On 11/1/12 12:34 PM, Steve Grubb wrote:
On Thursday, November 01, 2012 05:31:00 PM Peter Vrabec wrote:
why do you consider this an openscap bug? I suppose it's a bug in the content. The profile you want to evaluate reference to not existing
rule.
Well, the original poster was using 0.8 and I know bugs have been fixed since then. So, in troubleshooting the issue, its a simple step to just update to the latest and see if its still there or its fixed. They said its still there, so its time to look deeper at the content.
Maybe git bisect is helpful if it is known to have worked sometime in the past.
There's a two part problem. Yes, some errors are caused by the bugs in RHEL6 openscap (v0.8?). Specifically:
1 1871 In file 'xccdf-results.xml' on line 15992: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 15995: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ).
With that said, there are errors in the XCCDF content itself. Patches coming soon.
Just sent out a few patches which clears up the errors, however the rules now all state "notapplicable"
....continuing to investigate. Thoughts/patches welcome!
$ oscap xccdf eval --profile stig-server RHEL6/output/ssg-rhel6-xccdf.xml Title Verify No netrc Files Exist Rule no_netrc_files Ident CCE-TODO Result notapplicable
Title Create Warning Banners for All FTP Users Rule ftp_present_banner Ident CCE-4554-2 Result notapplicable
Hi Shawn,
if you see all the rules with notapplicable results it's because we start supporting CPE applicability processing.
I see this in the content: <platform idref="cpe:/o:redhat:enterprise_linux:6"/>
<platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
Please use "--cpe-dict" option. I have just found out that it's missing in a man page. Well I need kick someone. :)
--cpe-dict ssg-rhel6-cpe-dictionary.xml
should work for you if you are on RHEL6 system.
If for some reason you don't want cpe applicability check you need to remove <platform> elements from the content.
Peter.
On 11/01/2012 05:48 PM, Shawn Wells wrote:
On 11/1/12 12:42 PM, Shawn Wells wrote:
On 11/1/12 12:34 PM, Steve Grubb wrote:
On Thursday, November 01, 2012 05:31:00 PM Peter Vrabec wrote:
why do you consider this an openscap bug? I suppose it's a bug in the content. The profile you want to evaluate reference to not existing
rule.
Well, the original poster was using 0.8 and I know bugs have been fixed since then. So, in troubleshooting the issue, its a simple step to just update to the latest and see if its still there or its fixed. They said its still there, so its time to look deeper at the content.
Maybe git bisect is helpful if it is known to have worked sometime in the past.
There's a two part problem. Yes, some errors are caused by the bugs in RHEL6 openscap (v0.8?). Specifically:
1 1871 In file 'xccdf-results.xml' on line 15992: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ). 1 1871 In file 'xccdf-results.xml' on line 15995: Element '{http://checklists.nist.gov/xccdf/1.1%7Dident': This element is not expected. Expected is ( {http://checklists.nist.gov/xccdf/1.1%7Dresult ).
With that said, there are errors in the XCCDF content itself. Patches coming soon.
Just sent out a few patches which clears up the errors, however the rules now all state "notapplicable"
....continuing to investigate. Thoughts/patches welcome!
$ oscap xccdf eval --profile stig-server RHEL6/output/ssg-rhel6-xccdf.xml Title Verify No netrc Files Exist Rule no_netrc_files Ident CCE-TODO Result notapplicable
Title Create Warning Banners for All FTP Users Rule ftp_present_banner Ident CCE-4554-2 Result notapplicable
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 11/1/12 1:00 PM, Peter Vrabec wrote:
Hi Shawn,
if you see all the rules with notapplicable results it's because we start supporting CPE applicability processing.
I see this in the content:
<platform idref="cpe:/o:redhat:enterprise_linux:6"/>
<platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
Please use "--cpe-dict" option. I have just found out that it's missing in a man page. Well I need kick someone. :)
--cpe-dict ssg-rhel6-cpe-dictionary.xml
should work for you if you are on RHEL6 system.
If for some reason you don't want cpe applicability check you need to remove <platform> elements from the content.
Thank you Peter!
I've pushed a few patches (per David's ack) which solve our immediate content problems and cut a new RPM.
Eric (+interested parties): Can you download the following RPM and provide feedback? If users report back this fixes their issue I'll cut a new (official) release and put it on the wiki. http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS...
As Peter mentioned above, be sure to use the --cpe-dict flag, e.g.: $ oscap xccdf eval --profile stig-server --cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml
_*PLEASE NOTE*_ the now proper execution of CPE exposes some errors in our OVAL. Some rules will pass/fail while others will throw errors. We'll work on fixing these now, e.g.: $ oscap xccdf eval --profile stig-server --cpe-dict RHEL6/output/ssg-rhel6-cpe-dictionary.xml RHEL6/output/ssg-rhel6-xccdf.xml .... Title Ensure All World-Writable Directories Are Owned by a System Account Rule world_writable_files_system_ownership Ident CCE-14794-2 Result fail
Title Ensure tftp Daemon Uses Secure Mode Rule tftpd_uses_secure_mode Ident CCE-TODO Result pass
Title Enable Logging of All FTP Transactions Rule ftp_log_transactions Ident CCE-4549-2 Result notchecked
Title Ensure the Default Bash Umask is Set Correctly Rule user_umask_bashrc Ident CCE-3844-8 Result error
Shawn, Just a little feedback. Caught me at the end of the day. I had emailed you previously and you know I had tried to use OpenSCAP 0.9.1 and was having some problems. I was using the SCC 3.02 tool avail from DISA as an interim.
I did this real quick before leaving for the day, and haven't analyzed my results, however it is working for me using oscap now and I get a full scan! I will play with it some more tomorrow :)
BZ!!! (that's Navy talk for good job).
Very Respectfully,
Brian Peake
From: Shawn Wells shawn@redhat.com Organization: Red Hat Reply-To: scap-security-guide@lists.fedorahosted.org Date: Thu, 01 Nov 2012 15:18:01 -0400 To: scap-security-guide@lists.fedorahosted.org Subject: Re: Invalid Output using the scap-security-guide-0.1-6.noarch.rpm
On 11/1/12 1:00 PM, Peter Vrabec wrote:
Hi Shawn,
if you see all the rules with notapplicable results it's because we start supporting CPE applicability processing.
I see this in the content:
<platform idref="cpe:/o:redhat:enterprise_linux:6"/>
<platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
Please use "--cpe-dict" option. I have just found out that it's missing in a man page. Well I need kick someone. :)
--cpe-dict ssg-rhel6-cpe-dictionary.xml
should work for you if you are on RHEL6 system.
If for some reason you don't want cpe applicability check you need to remove <platform> elements from the content.
Thank you Peter!
I've pushed a few patches (per David's ack) which solve our immediate content problems and cut a new RPM.
Eric (+interested parties): Can you download the following RPM and provide feedback? If users report back this fixes their issue I'll cut a new (official) release and put it on the wiki. http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS /noarch/scap-security-guide-0.1-7.noarch.rpm
As Peter mentioned above, be sure to use the --cpe-dict flag, e.g.: $ oscap xccdf eval --profile stig-server --cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml
PLEASE NOTE the now proper execution of CPE exposes some errors in our OVAL. Some rules will pass/fail while others will throw errors. We'll work on fixing these now, e.g.: $ oscap xccdf eval --profile stig-server --cpe-dict RHEL6/output/ssg-rhel6-cpe-dictionary.xml RHEL6/output/ssg-rhel6-xccdf.xml .... Title Ensure All World-Writable Directories Are Owned by a System Account Rule world_writable_files_system_ownership Ident CCE-14794-2 Result fail
Title Ensure tftp Daemon Uses Secure Mode Rule tftpd_uses_secure_mode Ident CCE-TODO Result pass
Title Enable Logging of All FTP Transactions Rule ftp_log_transactions Ident CCE-4549-2 Result notchecked
Title Ensure the Default Bash Umask is Set Correctly Rule user_umask_bashrc Ident CCE-3844-8 Result error
_______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 11/1/12 4:05 PM, Brian Peake wrote:
Shawn, Just a little feedback. Caught me at the end of the day. I had emailed you previously and you know I had tried to use OpenSCAP 0.9.1 and was having some problems. I was using the SCC 3.02 tool avail from DISA as an interim.
If you have instructions on how to use SCC for either the RHEL5 STIG or the SCAP Security Guide content, please post them! I put a few hours in this week trying to get SCC to work (via cscc) and no luck.
I did this real quick before leaving for the day, and haven't analyzed my results, however it is working for me using oscap now and I get a full scan! I will play with it some more tomorrow :)
Excellent! As noted the --cpe-dict is exposing some errors in our OVAL code that we'll need to clean up (but then, we haven't exactly done much Q&A on the OVAL yet so this is expected). Michele Newman also was able to test things and all appears well. I'll go ahead and cut the new release RPM. _*
*__*For those who want to test it out:*_ NOTE: You'll need the EPEL version of OpenSCAP. We're coding against the OpenSCAP 0.9.1 since that's what will ship in RHEL 6.4, which GA's slightly before the STIG is released. Wanted to ensure proper functionality between our release and RHEL.
(1) Download the new development release RPM $ wget -O /tmp/scap-security-guide-0.1-7.noarch.rpm \ http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS...
$ sudo sh -c "yum localinstall /tmp/scap-security-guide-0.1-7.noarch.rpm
(2) Run a scan. Some results will inappropriately fail or pass, we're working on those. $ oscap xccdf eval --profile stig-server \ --cpe-dict /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
BZ!!! (that's Navy talk for good job).
If Peter didn't wave the Captain Obvious flag about --cpe-dict I doubt this would have been resolved so quickly. Thank you, Peter!
-Shawn
Thanks!
I really appreciate the feedback on this. Will be moving forward with testing the new SCC rpm, and the EPEL oscap packages.
Eric
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: Thursday, November 01, 2012 2:08 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: Invalid Output using the scap-security-guide-0.1-6.noarch.rpm
On 11/1/12 4:05 PM, Brian Peake wrote:
Shawn, Just a little feedback. Caught me at the end of the day. I had emailed you previously and you know I had tried to use OpenSCAP 0.9.1 and was having some problems. I was using the SCC 3.02 tool avail from DISA as an interim.
If you have instructions on how to use SCC for either the RHEL5 STIG or the SCAP Security Guide content, please post them! I put a few hours in this week trying to get SCC to work (via cscc) and no luck.
I did this real quick before leaving for the day, and haven't analyzed my results, however it is working for me using oscap now and I get a full scan! I will play with it some more tomorrow :)
Excellent! As noted the --cpe-dict is exposing some errors in our OVAL code that we'll need to clean up (but then, we haven't exactly done much Q&A on the OVAL yet so this is expected). Michele Newman also was able to test things and all appears well. I'll go ahead and cut the new release RPM.
For those who want to test it out: NOTE: You'll need the EPEL version of OpenSCAP. We're coding against the OpenSCAP 0.9.1 since that's what will ship in RHEL 6.4, which GA's slightly before the STIG is released. Wanted to ensure proper functionality between our release and RHEL.
(1) Download the new development release RPM $ wget -O /tmp/scap-security-guide-0.1-7.noarch.rpm \ http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS...
$ sudo sh -c "yum localinstall /tmp/scap-security-guide-0.1-7.noarch.rpm
(2) Run a scan. Some results will inappropriately fail or pass, we're working on those. $ oscap xccdf eval --profile stig-server \ --cpe-dict /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
BZ!!! (that's Navy talk for good job).
If Peter didn't wave the Captain Obvious flag about --cpe-dict I doubt this would have been resolved so quickly. Thank you, Peter!
-Shawn
Shawn, I just checked the DISA website for SCC 3.02 and there is documentation avail in PDF. Unfortunately, it is PKI (CAC) required to download. Because of this, I cannot send to you.
However, I'll type up a quick howto to run your content with SCC tool tomorrow AM. Send to you or post on the list?
Key piece is to zip the SSG content (the 4 XML files) and then use the SCC tool to import it. Click on the "test" profile to change it to server etc... After that I can select analyze and it gives me the results in HTML format and XML.
I will be playing tomorrow and will compare results between using SCC and OpenSCAP with SSG content to see if they agree etc...
R/ Brian Peake
On Nov 1, 2012, at 5:07 PM, Shawn Wells shawn@redhat.com wrote:
On 11/1/12 4:05 PM, Brian Peake wrote:
Shawn, Just a little feedback. Caught me at the end of the day. I had emailed you previously and you know I had tried to use OpenSCAP 0.9.1 and was having some problems. I was using the SCC 3.02 tool avail from DISA as an interim.
If you have instructions on how to use SCC for either the RHEL5 STIG or the SCAP Security Guide content, please post them! I put a few hours in this week trying to get SCC to work (via cscc) and no luck.
I did this real quick before leaving for the day, and haven't analyzed my results, however it is working for me using oscap now and I get a full scan! I will play with it some more tomorrow :)
Excellent! As noted the --cpe-dict is exposing some errors in our OVAL code that we'll need to clean up (but then, we haven't exactly done much Q&A on the OVAL yet so this is expected). Michele Newman also was able to test things and all appears well. I'll go ahead and cut the new release RPM.
For those who want to test it out: NOTE: You'll need the EPEL version of OpenSCAP. We're coding against the OpenSCAP 0.9.1 since that's what will ship in RHEL 6.4, which GA's slightly before the STIG is released. Wanted to ensure proper functionality between our release and RHEL.
(1) Download the new development release RPM $ wget -O /tmp/scap-security-guide-0.1-7.noarch.rpm \ http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS...
$ sudo sh -c "yum localinstall /tmp/scap-security-guide-0.1-7.noarch.rpm
(2) Run a scan. Some results will inappropriately fail or pass, we're working on those. $ oscap xccdf eval --profile stig-server \ --cpe-dict /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
BZ!!! (that's Navy talk for good job).
If Peter didn't wave the Captain Obvious flag about --cpe-dict I doubt this would have been resolved so quickly. Thank you, Peter!
-Shawn _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 11/1/12 6:43 PM, Brian Peake wrote:
Shawn, I just checked the DISA website for SCC 3.02 and there is documentation avail in PDF. Unfortunately, it is PKI (CAC) required to download. Because of this, I cannot send to you.
However, I'll type up a quick howto to run your content with SCC tool tomorrow AM. Send to you or post on the list?
I have a copy of SCC but haven't been able to make it work yet. Tried manually editing the options.xml file, creating a zip.... clearly I'm doing something wrong. Sending out your notes would be incredibly helpful and could lay the foundation for us documenting how the RHEL6 STIG & SSG can be used with SCC; please feel free to post to the list as it's very on topic.
Key piece is to zip the SSG content (the 4 XML files) and then use the SCC tool to import it. Click on the "test" profile to change it to server etc... After that I can select analyze and it gives me the results in HTML format and XML.
I will be playing tomorrow and will compare results between using SCC and OpenSCAP with SSG content to see if they agree etc...
That'd be incredibly helpful, thank you!
Shawn, First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC), the documentation is in /opt/scc/documentation. There is a cscc-Readme.txt and a SCC_UserManual_RHEL.pdf.
I have been using the GUI SCC version of it, however, I just ran ./cscc, and it also works, however I had already done my configuration through the GUI 1. ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml ssg-hel6-oval.xml ssg-rhel6-xccdf.xml 2. Start SCC (hopefully you have X windows installed). cd /opt/scc then ./scc (yea I am root - and it does not work from gnome menu). 3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and then select SCAP Content. SCAP Content window opens. 4. Uncheck the RHEL5 content. Click on the Add (top left button), select your ZIP file from step 1, open. Now it is imported (BTW it places it in /opt/scc/resources/content) 5. Select/Check ssg-rhel6, then click on the "test" profile to change it to server, stig-server or what ever. Select OK. (test is the first profile, that is why it gets used initially) 6. Select Local Computer (if local) and select Analyze Selected Computers. 7. Once it runs, Select Results from the Menu -> Recent Reports -> yourReport to view it in html.
(note- if you run the stig-server option, it will hang at the end trying to generate the reports (due to size?), however "server" profile does run to finish. I can monitor the /opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the reports to finish and then Cancel Analysis in the SCC GUI.)
The cscc-Readme goes into how to import content and configure the /opt/scc/options.xml, but again I have not gotten into that much and probably won't now I have OpenSCAP working.
I just did a compare between OpenScap results vs. SCC3.02 results using SSG content. Significant differences. Using the SSG with OpenSCAP is nearly complete, whereas using it with SSC many of the checks are not run (Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) . Things that passed with SCC (for example pam_cracklib.so retry, dcredit, ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and SGG content, they are failing. Not sure why yet of course.
Hopefully this is helpfully and you can run SCC using your content AND hopefully SPAWAR is paying attention and will update their SCC tool to run the SGG content!
Very Respectfully,
Brian
On 11/1/12 10:56 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/1/12 6:43 PM, Brian Peake wrote:
Shawn, I just checked the DISA website for SCC 3.02 and there is documentation avail in PDF. Unfortunately, it is PKI (CAC) required to download. Because of this, I cannot send to you.
However, I'll type up a quick howto to run your content with SCC tool tomorrow AM. Send to you or post on the list?
I have a copy of SCC but haven't been able to make it work yet. Tried manually editing the options.xml file, creating a zip.... clearly I'm doing something wrong. Sending out your notes would be incredibly helpful and could lay the foundation for us documenting how the RHEL6 STIG & SSG can be used with SCC; please feel free to post to the list as it's very on topic.
Key piece is to zip the SSG content (the 4 XML files) and then use the SCC tool to import it. Click on the "test" profile to change it to server etc... After that I can select analyze and it gives me the results in HTML format and XML.
I will be playing tomorrow and will compare results between using SCC and OpenSCAP with SSG content to see if they agree etc...
That'd be incredibly helpful, thank you! _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Hi Brian,
we have fixed the issue with pam_cracklib.so retry(dcredit, ucredit, ocredit, lcredit) recently. The fix will be available in new openscap release 0.9.2.
Also, Could you please provide an example of a rule that is not processed(not selected) by SCC but processed by OpenSCAP. I'd like to check if our behaviour is correct.
If you find any differences between results from SSC and OpenSCAP please don't hesitate to contact us.
thnx. a lot, Peter.
On 11/02/2012 02:22 PM, Brian Peake wrote:
Shawn, First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC), the documentation is in /opt/scc/documentation. There is a cscc-Readme.txt and a SCC_UserManual_RHEL.pdf.
I have been using the GUI SCC version of it, however, I just ran ./cscc, and it also works, however I had already done my configuration through the GUI
- ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml
ssg-hel6-oval.xml ssg-rhel6-xccdf.xml 2. Start SCC (hopefully you have X windows installed). cd /opt/scc then ./scc (yea I am root - and it does not work from gnome menu). 3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and then select SCAP Content. SCAP Content window opens. 4. Uncheck the RHEL5 content. Click on the Add (top left button), select your ZIP file from step 1, open. Now it is imported (BTW it places it in /opt/scc/resources/content) 5. Select/Check ssg-rhel6, then click on the "test" profile to change it to server, stig-server or what ever. Select OK. (test is the first profile, that is why it gets used initially) 6. Select Local Computer (if local) and select Analyze Selected Computers. 7. Once it runs, Select Results from the Menu -> Recent Reports -> yourReport to view it in html.
(note- if you run the stig-server option, it will hang at the end trying to generate the reports (due to size?), however "server" profile does run to finish. I can monitor the /opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the reports to finish and then Cancel Analysis in the SCC GUI.)
The cscc-Readme goes into how to import content and configure the /opt/scc/options.xml, but again I have not gotten into that much and probably won't now I have OpenSCAP working.
I just did a compare between OpenScap results vs. SCC3.02 results using SSG content. Significant differences. Using the SSG with OpenSCAP is nearly complete, whereas using it with SSC many of the checks are not run (Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) . Things that passed with SCC (for example pam_cracklib.so retry, dcredit, ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and SGG content, they are failing. Not sure why yet of course.
Hopefully this is helpfully and you can run SCC using your content AND hopefully SPAWAR is paying attention and will update their SCC tool to run the SGG content!
Very Respectfully,
Brian
On 11/1/12 10:56 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/1/12 6:43 PM, Brian Peake wrote:
Shawn, I just checked the DISA website for SCC 3.02 and there is documentation avail in PDF. Unfortunately, it is PKI (CAC) required to download. Because of this, I cannot send to you.
However, I'll type up a quick howto to run your content with SCC tool tomorrow AM. Send to you or post on the list?
I have a copy of SCC but haven't been able to make it work yet. Tried manually editing the options.xml file, creating a zip.... clearly I'm doing something wrong. Sending out your notes would be incredibly helpful and could lay the foundation for us documenting how the RHEL6 STIG & SSG can be used with SCC; please feel free to post to the list as it's very on topic.
Key piece is to zip the SSG content (the 4 XML files) and then use the SCC tool to import it. Click on the "test" profile to change it to server etc... After that I can select analyze and it gives me the results in HTML format and XML.
I will be playing tomorrow and will compare results between using SCC and OpenSCAP with SSG content to see if they agree etc...
That'd be incredibly helpful, thank you! _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
Very Respectfully,
Brian Peake
On 11/6/12 9:50 AM, "Peter Vrabec" pvrabec@redhat.com wrote:
Hi Brian,
we have fixed the issue with pam_cracklib.so retry(dcredit, ucredit, ocredit, lcredit) recently. The fix will be available in new openscap release 0.9.2.
Also, Could you please provide an example of a rule that is not processed(not selected) by SCC but processed by OpenSCAP. I'd like to check if our behaviour is correct.
If you find any differences between results from SSC and OpenSCAP please don't hesitate to contact us.
thnx. a lot, Peter.
On 11/02/2012 02:22 PM, Brian Peake wrote:
Shawn, First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC), the documentation is in /opt/scc/documentation. There is a cscc-Readme.txt and a SCC_UserManual_RHEL.pdf.
I have been using the GUI SCC version of it, however, I just ran ./cscc, and it also works, however I had already done my configuration through the GUI?
- ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml
ssg-hel6-oval.xml ssg-rhel6-xccdf.xml 2. Start SCC (hopefully you have X windows installed). cd /opt/scc then ./scc (yea I am root - and it does not work from gnome menu). 3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and then select SCAP Content. SCAP Content window opens. 4. Uncheck the RHEL5 content. Click on the Add (top left button), select your ZIP file from step 1, open. Now it is imported (BTW it places it in /opt/scc/resources/content) 5. Select/Check ssg-rhel6, then click on the "test" profile to change it to server, stig-server or what ever. Select OK. (test is the first profile, that is why it gets used initially) 6. Select Local Computer (if local) and select Analyze Selected Computers. 7. Once it runs, Select Results from the Menu -> Recent Reports -> yourReport to view it in html.
(note- if you run the stig-server option, it will hang at the end trying to generate the reports (due to size?), however "server" profile does run to finish. I can monitor the /opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the reports to finish and then Cancel Analysis in the SCC GUI.)
The cscc-Readme goes into how to import content and configure the /opt/scc/options.xml, but again I have not gotten into that much and probably won't now I have OpenSCAP working.
I just did a compare between OpenScap results vs. SCC3.02 results using SSG content. Significant differences. Using the SSG with OpenSCAP is nearly complete, whereas using it with SSC many of the checks are not run (Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) . Things that passed with SCC (for example pam_cracklib.so retry, dcredit, ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and SGG content, they are failing. Not sure why yet of course.
Hopefully this is helpfully and you can run SCC using your content AND hopefully SPAWAR is paying attention and will update their SCC tool to run the SGG content!
Very Respectfully,
Brian
On 11/1/12 10:56 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/1/12 6:43 PM, Brian Peake wrote:
Shawn, I just checked the DISA website for SCC 3.02 and there is documentation avail in PDF. Unfortunately, it is PKI (CAC) required to download. Because of this, I cannot send to you.
However, I'll type up a quick howto to run your content with SCC tool tomorrow AM. Send to you or post on the list?
I have a copy of SCC but haven't been able to make it work yet. Tried manually editing the options.xml file, creating a zip.... clearly I'm doing something wrong. Sending out your notes would be incredibly helpful and could lay the foundation for us documenting how the RHEL6 STIG & SSG can be used with SCC; please feel free to post to the list as it's very on topic.
Key piece is to zip the SSG content (the 4 XML files) and then use the SCC tool to import it. Click on the "test" profile to change it to server etc... After that I can select analyze and it gives me the results in HTML format and XML.
I will be playing tomorrow and will compare results between using SCC and OpenSCAP with SSG content to see if they agree etc...
That'd be incredibly helpful, thank you! _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s
Peter,
A list that passes on my test VM using SCC w/ SSG content (from the scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
PASSES w/ SCC. FAILS w/ oscap
1. Set_bootloader_password 2. Enable_auditd_bootloader 3. Limit_password_reuse 4. All the pam_cracklib.so settings you already mentioned...
Below is due to OVAL perhaps (tbh I don't know without digging)?
Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP (non of the kernel parameters are checked with SCC tool, returns all errors during run) 1. enable_randomize_va_space 2. enable_execshield 3. set_sysctl_net_ipv4_conf_all_log_martians 4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts 5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses 6. set_sysctl_net_ipv4_tcp_syncookies 7. set_sysctl_net_ipv4_conf_all_rp_filter 8. set_sysctl_net_ipv4_conf_default_rp_filter
Other parameters that fail also, that I KNOW are set properly: 1. kernel_module_bluetooth_disabled 2. sshd_set_idle_timeout 3. sshd_disable_empty_passwords 4. sshd_do_not_permit_user_env
For the life of me - /etc/issue is set correctly (using the full DoD warning), but I cannot get it to pass I am also using GDM and have a working login banner, but that also fails
Very Respectfully,
Brian Peake
On 11/6/12 9:55 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Hi Brian,
thnx. for the feedback. I have reviewed couple of your findings.
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
These all ^^^ should be already fixed when we fixed #4. It's a same problem - textfilecontent54 on symlink.
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't reproduce the fail you can see.
If I put " alias bluetooth on alias net-pf-31 on " into "dist.conf" file and run the scan I get ... Title Disable Bluetooth Kernel Modules Rule kernel_module_bluetooth_disabled Ident CCE-14948-4 Result pass ....
I'll take a look at the rest.
Peter.
On 11/07/2012 03:56 PM, Brian Peake wrote:
Peter,
A list that passes on my test VM using SCC w/ SSG content (from the scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
PASSES w/ SCC. FAILS w/ oscap
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
Below is due to OVAL perhaps (tbh I don't know without digging)?
Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP (non of the kernel parameters are checked with SCC tool, returns all errors during run)
- enable_randomize_va_space
- enable_execshield
- set_sysctl_net_ipv4_conf_all_log_martians
- set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
- set_sysctl_net_ipv4_tcp_syncookies
- set_sysctl_net_ipv4_conf_all_rp_filter
- set_sysctl_net_ipv4_conf_default_rp_filter
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
For the life of me - /etc/issue is set correctly (using the full DoD warning), but I cannot get it to pass I am also using GDM and have a working login banner, but that also fails
Very Respectfully,
Brian Peake
On 11/6/12 9:55 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Thanks Peter for the feedback! Comments below…
Very Respectfully, Brian Peake
On 11/8/12 11:39 AM, "Peter Vrabec" pvrabec@redhat.com wrote:
Hi Brian,
thnx. for the feedback. I have reviewed couple of your findings.
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
These all ^^^ should be already fixed when we fixed #4. It's a same problem - textfilecontent54 on symlink.
Excellent news. Looking fwd to 0.9.2
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't reproduce the fail you can see.
If I put " alias bluetooth on alias net-pf-31 on " into "dist.conf" file and run the scan I get ... Title Disable Bluetooth Kernel Modules Rule kernel_module_bluetooth_disabled Ident CCE-14948-4 Result pass ....
Well I was using /etc/modprobe.d/modprobe.conf… I tried adding to distro.conf
alias bluetooth on alias net-pf-31 on
With same results. # grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d grep: /etc/modprobe.conf: No such file or directory /etc/modprobe.d/dist.conf:alias bluetooth on /etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
Grep reports the same for net-pf-31, So I am not sure why it is failing for me.
I'll take a look at the rest.
Peter.
On 11/07/2012 03:56 PM, Brian Peake wrote:
Peter,
A list that passes on my test VM using SCC w/ SSG content (from the scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
PASSES w/ SCC. FAILS w/ oscap
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
Below is due to OVAL perhaps (tbh I don't know without digging)?
Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP (non of the kernel parameters are checked with SCC tool, returns all errors during run)
- enable_randomize_va_space
- enable_execshield
- set_sysctl_net_ipv4_conf_all_log_martians
- set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
- set_sysctl_net_ipv4_tcp_syncookies
- set_sysctl_net_ipv4_conf_all_rp_filter
- set_sysctl_net_ipv4_conf_default_rp_filter
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
For the life of me - /etc/issue is set correctly (using the full DoD warning), but I cannot get it to pass? I am also using GDM and have a working login banner, but that also fails?
Very Respectfully,
Brian Peake
On 11/6/12 9:55 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Ooops my mistake,
on -> off, intention is to turn it off(kernel_module_bluetooth_disabled).
alias bluetooth off alias net-pf-31 off
:)
----- Original Message -----
From: "Brian Peake" PEAKE@HIPKLLC.COM To: scap-security-guide@lists.fedorahosted.org Sent: Thursday, November 8, 2012 7:13:52 PM Subject: Re: using SCC/CSCC with SSG content
Thanks Peter for the feedback! Comments below…
Very Respectfully, Brian Peake
On 11/8/12 11:39 AM, "Peter Vrabec" pvrabec@redhat.com wrote:
Hi Brian,
thnx. for the feedback. I have reviewed couple of your findings.
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
These all ^^^ should be already fixed when we fixed #4. It's a same problem - textfilecontent54 on symlink.
Excellent news. Looking fwd to 0.9.2
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't reproduce the fail you can see.
If I put " alias bluetooth on alias net-pf-31 on " into "dist.conf" file and run the scan I get ... Title Disable Bluetooth Kernel Modules Rule kernel_module_bluetooth_disabled Ident CCE-14948-4 Result pass ....
Well I was using /etc/modprobe.d/modprobe.conf… I tried adding to distro.conf
alias bluetooth on alias net-pf-31 on
With same results. # grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d grep: /etc/modprobe.conf: No such file or directory /etc/modprobe.d/dist.conf:alias bluetooth on /etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
Grep reports the same for net-pf-31, So I am not sure why it is failing for me.
I'll take a look at the rest.
Peter.
On 11/07/2012 03:56 PM, Brian Peake wrote:
Peter,
A list that passes on my test VM using SCC w/ SSG content (from the scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
PASSES w/ SCC. FAILS w/ oscap
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
Below is due to OVAL perhaps (tbh I don't know without digging)?
Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP (non of the kernel parameters are checked with SCC tool, returns all errors during run)
- enable_randomize_va_space
- enable_execshield
- set_sysctl_net_ipv4_conf_all_log_martians
- set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
- set_sysctl_net_ipv4_tcp_syncookies
- set_sysctl_net_ipv4_conf_all_rp_filter
- set_sysctl_net_ipv4_conf_default_rp_filter
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
For the life of me - /etc/issue is set correctly (using the full DoD warning), but I cannot get it to pass? I am also using GDM and have a working login banner, but that also fails?
Very Respectfully,
Brian Peake
On 11/6/12 9:55 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
I should have caught that myself Peter, thanks.
Anyone have an idea why I cannot get rid of: prelink: /usr/lib64/libgnome-bluetooth.so.7.0.2: at least one of file's dependancies has changed since pre linking
It is keeping the rpm_verify_permissions from passing? # rpm -Va | grep '^.M' is returning the above ^^ line.
I tried turning prelink off and running # pre link -au as per https://access.redhat.com/knowledge/solutions/25215 and it did clear all the other prelink problems the box I am on had, except the above one...
Very Respectfully,
Brian Peake
On 11/8/12 4:45 PM, "Peter Vrabec" pvrabec@redhat.com wrote:
Ooops my mistake,
on -> off, intention is to turn it off(kernel_module_bluetooth_disabled).
alias bluetooth off alias net-pf-31 off
:)
----- Original Message -----
From: "Brian Peake" PEAKE@HIPKLLC.COM To: scap-security-guide@lists.fedorahosted.org Sent: Thursday, November 8, 2012 7:13:52 PM Subject: Re: using SCC/CSCC with SSG content
Thanks Peter for the feedback! Comments below
Very Respectfully, Brian Peake
On 11/8/12 11:39 AM, "Peter Vrabec" pvrabec@redhat.com wrote:
Hi Brian,
thnx. for the feedback. I have reviewed couple of your findings.
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
These all ^^^ should be already fixed when we fixed #4. It's a same problem - textfilecontent54 on symlink.
Excellent news. Looking fwd to 0.9.2
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't reproduce the fail you can see.
If I put " alias bluetooth on alias net-pf-31 on " into "dist.conf" file and run the scan I get ... Title Disable Bluetooth Kernel Modules Rule kernel_module_bluetooth_disabled Ident CCE-14948-4 Result pass ....
Well I was using /etc/modprobe.d/modprobe.conf I tried adding to distro.conf
alias bluetooth on alias net-pf-31 on
With same results. # grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d grep: /etc/modprobe.conf: No such file or directory /etc/modprobe.d/dist.conf:alias bluetooth on /etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
Grep reports the same for net-pf-31, So I am not sure why it is failing for me.
I'll take a look at the rest.
Peter.
On 11/07/2012 03:56 PM, Brian Peake wrote:
Peter,
A list that passes on my test VM using SCC w/ SSG content (from the scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
PASSES w/ SCC. FAILS w/ oscap
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
Below is due to OVAL perhaps (tbh I don't know without digging)?
Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP (non of the kernel parameters are checked with SCC tool, returns all errors during run)
- enable_randomize_va_space
- enable_execshield
- set_sysctl_net_ipv4_conf_all_log_martians
- set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
- set_sysctl_net_ipv4_tcp_syncookies
- set_sysctl_net_ipv4_conf_all_rp_filter
- set_sysctl_net_ipv4_conf_default_rp_filter
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
For the life of me - /etc/issue is set correctly (using the full DoD warning), but I cannot get it to pass? I am also using GDM and have a working login banner, but that also fails?
Very Respectfully,
Brian Peake
On 11/6/12 9:55 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
Hi Brian,
we have identified a bug in our sysctl probe. It explains why it fails for you.
tracking at: https://fedorahosted.org/openscap/ticket/271
---
Please note that there is also problem in the content. At least "enable_randomize_va_space" is not very robust. It only consider value "1" to be correct, but it could be "2" as well.
Peter.
On 11/07/2012 03:56 PM, Brian Peake wrote:
Peter,
A list that passes on my test VM using SCC w/ SSG content (from the scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
PASSES w/ SCC. FAILS w/ oscap
- Set_bootloader_password
- Enable_auditd_bootloader
- Limit_password_reuse
- All the pam_cracklib.so settings you already mentioned...
Below is due to OVAL perhaps (tbh I don't know without digging)?
Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP (non of the kernel parameters are checked with SCC tool, returns all errors during run)
- enable_randomize_va_space
- enable_execshield
- set_sysctl_net_ipv4_conf_all_log_martians
- set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
- set_sysctl_net_ipv4_tcp_syncookies
- set_sysctl_net_ipv4_conf_all_rp_filter
- set_sysctl_net_ipv4_conf_default_rp_filter
Other parameters that fail also, that I KNOW are set properly:
- kernel_module_bluetooth_disabled
- sshd_set_idle_timeout
- sshd_disable_empty_passwords
- sshd_do_not_permit_user_env
For the life of me - /etc/issue is set correctly (using the full DoD warning), but I cannot get it to pass I am also using GDM and have a working login banner, but that also fails
Very Respectfully,
Brian Peake
On 11/6/12 9:55 PM, "Shawn Wells" shawn@redhat.com wrote:
On 11/6/12 10:16 AM, Brian Peake wrote:
Thanks for the info Peter! I will get back when I get some time, hopefully tomorrow, with some examples.
I was able to run a scan tonight using the latest git clone of SSG against the SCC tool. I've posted the output here: http://people.redhat.com/swells/random/cscc.out.txt
oscap output of the same content here: http://people.redhat.com/swells/random/oscap.out.txt
I'll drop the OVAL results somewhere shortly -- it generated 300MB of output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in mind we haven't made OVAL a focus yet!
Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine: real 21m59.028s user 21m17.791s sys 0m33.558s
Compared against oscap: real 0m39.854s user 0m27.210s sys 0m12.671s _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
On 11/12/12 7:54 AM, Peter Vrabec wrote:
Hi Brian,
we have identified a bug in our sysctl probe. It explains why it fails for you.
tracking at: https://fedorahosted.org/openscap/ticket/271
Please note that there is also problem in the content. At least "enable_randomize_va_space" is not very robust. It only consider value "1" to be correct, but it could be "2" as well.
Yes, much of the existing OVAL content is infested with suck (and this is broadly acknowledged). We focused on getting the XCCDF locked in to create the RHEL6 STIG InitialDraft submission, which OVAL was not a part of. People will see much more work on the OVAL components through this and next week.
hey Shawn,
I'm taking maturity of OVAL content into consideration. I wanted to mention it here just for the record. Well, I have realized that maybe it would be better to file a ticket next time? Is it OK?
Peter.
On 11/12/2012 02:47 PM, Shawn Wells wrote:
On 11/12/12 7:54 AM, Peter Vrabec wrote:
Hi Brian,
we have identified a bug in our sysctl probe. It explains why it fails for you.
tracking at: https://fedorahosted.org/openscap/ticket/271
Please note that there is also problem in the content. At least "enable_randomize_va_space" is not very robust. It only consider value "1" to be correct, but it could be "2" as well.
Yes, much of the existing OVAL content is infested with suck (and this is broadly acknowledged). We focused on getting the XCCDF locked in to create the RHEL6 STIG InitialDraft submission, which OVAL was not a part of. People will see much more work on the OVAL components through this and next week.
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org