Thanks for the info Peter! I will get back when I get some time, hopefully
tomorrow, with some examples.
On 11/6/12 9:50 AM, "Peter Vrabec" <pvrabec(a)redhat.com> wrote:
we have fixed the issue with pam_cracklib.so retry(dcredit,
ucredit, ocredit, lcredit) recently. The fix will be available in new
openscap release 0.9.2.
Also, Could you please provide an example of a rule that is not
processed(not selected) by SCC but processed by OpenSCAP. I'd like to
check if our behaviour is correct.
If you find any differences between results from SSC and OpenSCAP please
don't hesitate to contact us.
thnx. a lot,
On 11/02/2012 02:22 PM, Brian Peake wrote:
> First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC),
> documentation is in /opt/scc/documentation. There is a cscc-Readme.txt
> a SCC_UserManual_RHEL.pdf.
> I have been using the GUI SCC version of it, however, I just ran ./cscc,
> and it also works, however I had already done my configuration through
> 1. ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml
> ssg-hel6-oval.xml ssg-rhel6-xccdf.xml
> 2. Start SCC (hopefully you have X windows installed). cd /opt/scc then
> ./scc (yea I am root - and it does not work from gnome menu).
> 3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and
> then select SCAP Content. SCAP Content window opens.
> 4. Uncheck the RHEL5 content. Click on the Add (top left button), select
> your ZIP file from step 1, open. Now it is imported (BTW it places it in
> 5. Select/Check ssg-rhel6, then click on the "test" profile to change it
> to server, stig-server or what ever. Select OK. (test is the first
> profile, that is why it gets used initially)
> 6. Select Local Computer (if local) and select Analyze Selected
> 7. Once it runs, Select Results from the Menu -> Recent Reports ->
> yourReport to view it in html.
> (note- if you run the stig-server option, it will hang at the end trying
> to generate the reports (due to size?), however "server" profile does
> to finish. I can monitor the
> /opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the
> reports to finish and then Cancel Analysis in the SCC GUI.)
> The cscc-Readme goes into how to import content and configure the
> /opt/scc/options.xml, but again I have not gotten into that much and
> probably won't now I have OpenSCAP working.
> I just did a compare between OpenScap results vs. SCC3.02 results using
> SSG content. Significant differences. Using the SSG with OpenSCAP is
> nearly complete, whereas using it with SSC many of the checks are not
> (Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) .
> Things that passed with SCC (for example pam_cracklib.so retry, dcredit,
> ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and
> content, they are failing. Not sure why yet of course.
> Hopefully this is helpfully and you can run SCC using your content AND
> hopefully SPAWAR is paying attention and will update their SCC tool to
> the SGG content!
> Very Respectfully,
> On 11/1/12 10:56 PM, "Shawn Wells" <shawn(a)redhat.com> wrote:
>> On 11/1/12 6:43 PM, Brian Peake wrote:
>>> I just checked the DISA website for SCC 3.02 and there is
>>> documentation avail in PDF. Unfortunately, it is PKI (CAC) required to
>>> download. Because of this, I cannot send to you.
>>> However, I'll type up a quick howto to run your content with SCC tool
>>> tomorrow AM. Send to you or post on the list?
>> I have a copy of SCC but haven't been able to make it work yet. Tried
>> manually editing the options.xml file, creating a zip.... clearly I'm
>> doing something wrong. Sending out your notes would be incredibly
>> helpful and could lay the foundation for us documenting how the RHEL6
>> STIG & SSG can be used with SCC; please feel free to post to the list
>> it's very on topic.
>>> Key piece is to zip the SSG content (the 4 XML files) and then use the
>>> SCC tool to import it. Click on the "test" profile to change it to
>>> server etc... After that I can select analyze and it gives me the
>>> results in HTML format and XML.
>>> I will be playing tomorrow and will compare results between using SCC
>>> and OpenSCAP with SSG content to see if they agree etc...
>> That'd be incredibly helpful, thank you!
>> scap-security-guide mailing list
> scap-security-guide mailing list
scap-security-guide mailing list