Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

Shawn Wells shawn at redhat.com
Thu Nov 1 21:07:58 UTC 2012


On 11/1/12 4:05 PM, Brian Peake wrote:
> Shawn,
> Just a little feedback. Caught me at the end of the day. I had emailed 
> you previously and you know I had tried to use OpenSCAP 0.9.1 and was 
> having some problems. I was using the SCC 3.02 tool avail from DISA as 
> an interim.
If you have instructions on how to use SCC for either the RHEL5 STIG or 
the SCAP Security Guide content, please post them! I put a few hours in 
this week trying to get SCC to work (via cscc) and no luck.


> I did this real quick before leaving for the day, and haven't analyzed 
> my results, however it is working for me using oscap now and I get a 
> full scan! I will play with it some more tomorrow :)
Excellent! As noted the --cpe-dict is exposing some errors in our OVAL 
code that we'll need to clean up (but then, we haven't exactly done much 
Q&A on the OVAL yet so this is expected). Michele Newman also was able 
to test things and all appears well. I'll go ahead and cut the new 
release RPM.
_*

*__*For those who want to test it out:*_
NOTE: You'll need the EPEL version of OpenSCAP. We're coding against the 
OpenSCAP 0.9.1 since that's what will ship in RHEL 6.4, which GA's 
slightly before the STIG is released. Wanted to ensure proper 
functionality between our release and RHEL.

(1) Download the new development release RPM
$ wget -O /tmp/scap-security-guide-0.1-7.noarch.rpm \
http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-7.noarch.rpm

$ sudo sh -c "yum localinstall /tmp/scap-security-guide-0.1-7.noarch.rpm

(2) Run a scan. Some results will inappropriately fail or pass, we're 
working on those.
$ oscap xccdf eval --profile stig-server \
--cpe-dict /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml


> BZ!!! (that's Navy talk for good job).
If Peter didn't wave the Captain Obvious flag about --cpe-dict I doubt 
this would have been resolved so quickly. Thank you, Peter!

-Shawn
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121101/d83e122f/attachment.html>


More information about the scap-security-guide mailing list