Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

Bueschel, Eric W CTR (US) eric.w.bueschel.ctr at mail.mil
Thu Nov 1 21:11:54 UTC 2012


Thanks!

I really appreciate the feedback on this.  Will be moving forward with testing 
the new SCC rpm, and the EPEL oscap packages.

Eric

-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org 
[mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Shawn 
Wells
Sent: Thursday, November 01, 2012 2:08 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

On 11/1/12 4:05 PM, Brian Peake wrote:


	Shawn,
	Just a little feedback. Caught me at the end of the day. I had emailed you 
previously and you know I had tried to use OpenSCAP 0.9.1 and was having some 
problems. I was using the SCC 3.02 tool avail from DISA as an interim.

If you have instructions on how to use SCC for either the RHEL5 STIG or the 
SCAP Security Guide content, please post them! I put a few hours in this week 
trying to get SCC to work (via cscc) and no luck.




	I did this real quick before leaving for the day, and haven't analyzed my 
results, however it is working for me using oscap now and I get a full scan! I 
will play with it some more tomorrow :)

Excellent! As noted the --cpe-dict is exposing some errors in our OVAL code 
that we'll need to clean up (but then, we haven't exactly done much Q&A on the 
OVAL yet so this is expected). Michele Newman also was able to test things and 
all appears well. I'll go ahead and cut the new release RPM.


For those who want to test it out:
NOTE: You'll need the EPEL version of OpenSCAP. We're coding against the 
OpenSCAP 0.9.1 since that's what will ship in RHEL 6.4, which GA's slightly 
before the STIG is released. Wanted to ensure proper functionality between our 
release and RHEL.

(1) Download the new development release RPM $ wget -O 
/tmp/scap-security-guide-0.1-7.noarch.rpm \ 
http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-7.noarch.rpm

$ sudo sh -c "yum localinstall /tmp/scap-security-guide-0.1-7.noarch.rpm

(2) Run a scan. Some results will inappropriately fail or pass, we're working 
on those.
$ oscap xccdf eval --profile stig-server \ --cpe-dict 
/usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ 
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml




	BZ!!! (that's Navy talk for good job).

If Peter didn't wave the Captain Obvious flag about --cpe-dict I doubt this 
would have been resolved so quickly. Thank you, Peter!

-Shawn

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5649 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121101/0b2438c4/attachment.bin>


More information about the scap-security-guide mailing list