Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

Brian Peake PEAKE at HIPKLLC.COM
Thu Nov 1 20:05:50 UTC 2012


Shawn,
Just a little feedback. Caught me at the end of the day. I had emailed you
previously and you know I had tried to use OpenSCAP 0.9.1 and was having
some problems. I was using the SCC 3.02 tool avail from DISA as an interim.

I did this real quick before leaving for the day, and haven't analyzed my
results, however it is working for me using oscap now and I get a full scan!
I will play with it some more tomorrow :)

BZ!!! (that's Navy talk for good job).

Very Respectfully,

Brian Peake

From:  Shawn Wells <shawn at redhat.com>
Organization:  Red Hat
Reply-To:  <scap-security-guide at lists.fedorahosted.org>
Date:  Thu, 01 Nov 2012 15:18:01 -0400
To:  <scap-security-guide at lists.fedorahosted.org>
Subject:  Re: Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

    
 
On 11/1/12 1:00 PM, Peter Vrabec wrote:
 
 
> Hi Shawn, 
>  
>  if you see all the rules with notapplicable results it's because we start
> supporting CPE applicability processing.
>  
>  I see this in the content:
>  <platform idref="cpe:/o:redhat:enterprise_linux:6"/>
>  
>  <platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
>  
>  
>  Please use "--cpe-dict" option. I have just found out that it's missing in a
> man page. Well I need kick someone. :)
>  
>  --cpe-dict ssg-rhel6-cpe-dictionary.xml
>  
>  should work for you if you are on RHEL6 system.
>  
>  If for some reason you don't want cpe applicability check you need to remove
> <platform> elements from the content.
 
 Thank you Peter! 
 
 I've pushed a few patches (per David's ack) which solve our immediate
content problems and cut a new RPM.
 
 Eric (+interested parties): Can you download the following RPM and provide
feedback? If users report back this fixes their issue I'll cut a new
(official) release and put it on the wiki.
http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS
/noarch/scap-security-guide-0.1-7.noarch.rpm
 
 As Peter mentioned above, be sure to use the --cpe-dict flag, e.g.:
 $ oscap xccdf eval --profile stig-server --cpe-dict
ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml
 
 PLEASE NOTE the now proper execution of CPE exposes some errors in our
OVAL. Some rules will pass/fail while others will throw errors. We'll work
on fixing these now, e.g.:
 $ oscap xccdf eval --profile stig-server --cpe-dict
RHEL6/output/ssg-rhel6-cpe-dictionary.xml RHEL6/output/ssg-rhel6-xccdf.xml
 ....
 Title   Ensure All World-Writable Directories Are Owned by a System Account
 Rule    world_writable_files_system_ownership
 Ident   CCE-14794-2
 Result  fail
 
 Title   Ensure tftp Daemon Uses Secure Mode
 Rule    tftpd_uses_secure_mode
 Ident   CCE-TODO
 Result  pass
 
 Title   Enable Logging of All FTP Transactions
 Rule    ftp_log_transactions
 Ident   CCE-4549-2
 Result  notchecked
 
 Title   Ensure the Default Bash Umask is Set Correctly
 Rule    user_umask_bashrc
 Ident   CCE-3844-8
 Result  error
 
 
 
_______________________________________________ scap-security-guide mailing
list scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121101/cb4e00ba/attachment-0001.html>


More information about the scap-security-guide mailing list