Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

Shawn Wells shawn at redhat.com
Thu Nov 1 19:18:01 UTC 2012


On 11/1/12 1:00 PM, Peter Vrabec wrote:
> Hi Shawn,
>
> if you see all the rules with notapplicable results it's because we 
> start supporting CPE applicability processing.
>
> I see this in the content:
> <platform idref="cpe:/o:redhat:enterprise_linux:6"/>
>
> <platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
>
>
> Please use "--cpe-dict" option. I have just found out that it's 
> missing in a man page. Well I need kick someone. :)
>
> --cpe-dict ssg-rhel6-cpe-dictionary.xml
>
> should work for you if you are on RHEL6 system.
>
> If for some reason you don't want cpe applicability check you need to 
> remove <platform> elements from the content. 

Thank you Peter!

I've pushed a few patches (per David's ack) which solve our immediate 
content problems and cut a new RPM.

Eric (+interested parties): Can you download the following RPM and 
provide feedback? If users report back this fixes their issue I'll cut a 
new (official) release and put it on the wiki.
http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-7.noarch.rpm

As Peter mentioned above, be sure to use the --cpe-dict flag, e.g.:
$ oscap xccdf eval --profile stig-server --cpe-dict 
ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml

_*PLEASE NOTE*_ the now proper execution of CPE exposes some errors in 
our OVAL. Some rules will pass/fail while others will throw errors. 
We'll work on fixing these now, e.g.:
$ oscap xccdf eval --profile stig-server --cpe-dict 
RHEL6/output/ssg-rhel6-cpe-dictionary.xml RHEL6/output/ssg-rhel6-xccdf.xml
....
Title   Ensure All World-Writable Directories Are Owned by a System Account
Rule    world_writable_files_system_ownership
Ident   CCE-14794-2
Result  fail

Title   Ensure tftp Daemon Uses Secure Mode
Rule    tftpd_uses_secure_mode
Ident   CCE-TODO
Result  pass

Title   Enable Logging of All FTP Transactions
Rule    ftp_log_transactions
Ident   CCE-4549-2
Result  notchecked

Title   Ensure the Default Bash Umask is Set Correctly
Rule    user_umask_bashrc
Ident   CCE-3844-8
Result  error


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121101/a8a6a6a4/attachment.html>


More information about the scap-security-guide mailing list