using SCC/CSCC with SSG content

Peter Vrabec pvrabec at redhat.com
Tue Nov 6 14:50:42 UTC 2012


Hi Brian,

we have fixed the issue with pam_cracklib.so retry(dcredit,
ucredit, ocredit, lcredit) recently. The fix will be available in new 
openscap release 0.9.2.

Also, Could you please provide an example of a rule that is not 
processed(not selected) by SCC but processed by OpenSCAP. I'd like to 
check if our behaviour is correct.

If you find any differences between results from SSC and OpenSCAP please 
don't hesitate to contact us.

thnx. a lot,
Peter.


On 11/02/2012 02:22 PM, Brian Peake wrote:
> Shawn,
> First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC), the
> documentation is in /opt/scc/documentation. There is a cscc-Readme.txt and
> a SCC_UserManual_RHEL.pdf.
>
> I have been using the GUI SCC version of it, however, I just ran ./cscc,
> and it also works, however I had already done my configuration through the
> GUIĀŠ
> 1. ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml
> ssg-hel6-oval.xml ssg-rhel6-xccdf.xml
> 2. Start SCC (hopefully you have X windows installed). cd /opt/scc  then
> ./scc (yea I am root - and it does not work from gnome menu).
> 3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and
> then select SCAP Content. SCAP Content window opens.
> 4. Uncheck the RHEL5 content. Click on the Add (top left button), select
> your ZIP file from step 1, open. Now it is imported (BTW it places it in
> /opt/scc/resources/content)
> 5. Select/Check ssg-rhel6, then click on the "test" profile to change it
> to server, stig-server or what ever. Select OK. (test is the first
> profile, that is why it gets used initially)
> 6. Select Local Computer (if local) and select Analyze Selected Computers.
> 7. Once it runs, Select Results from the Menu -> Recent Reports ->
> yourReport to view it in html.
>
> (note- if you run the stig-server option, it will hang at the end trying
> to generate the reports (due to size?), however "server" profile does run
> to finish. I can monitor the
> /opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the
> reports to finish and then Cancel Analysis in the SCC GUI.)
>
> The cscc-Readme goes into how to import content and configure the
> /opt/scc/options.xml, but again I have not gotten into that much and
> probably won't now I have OpenSCAP working.
>
> I just did a compare between OpenScap results vs. SCC3.02 results using
> SSG content. Significant differences. Using the SSG with OpenSCAP is
> nearly complete, whereas using it with SSC many of the checks are not run
> (Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) .
> Things that passed with SCC (for example pam_cracklib.so retry, dcredit,
> ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and SGG
> content, they are failing. Not sure why yet of course.
>
> Hopefully this is helpfully and you can run SCC using your content AND
> hopefully SPAWAR is paying attention and will update their SCC tool to run
> the SGG content!
>
> Very Respectfully,
>
> Brian
>
>
>
> On 11/1/12 10:56 PM, "Shawn Wells" <shawn at redhat.com> wrote:
>
>> On 11/1/12 6:43 PM, Brian Peake wrote:
>>> Shawn,
>>> I just checked the DISA website for SCC 3.02 and there is
>>> documentation avail in PDF. Unfortunately, it is PKI (CAC) required to
>>> download. Because of this, I cannot send to you.
>>>
>>> However, I'll type up a quick howto to run your content with SCC tool
>>> tomorrow AM. Send to you or post on the list?
>> I have a copy of SCC but haven't been able to make it work yet. Tried
>> manually editing the options.xml file, creating a zip.... clearly I'm
>> doing something wrong. Sending out your notes would be incredibly
>> helpful and could lay the foundation for us documenting how the RHEL6
>> STIG & SSG can be used with SCC; please feel free to post to the list as
>> it's very on topic.
>>
>>> Key piece is to zip the SSG content (the 4 XML files) and then use the
>>> SCC tool to import it. Click on the "test" profile to change it to
>>> server etc... After that I can select analyze and it gives me the
>>> results in HTML format and XML.
>>>
>>> I will be playing tomorrow and will compare results between using SCC
>>> and OpenSCAP with SSG content to see if they agree etc...
>> That'd be incredibly helpful, thank you!
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>



More information about the scap-security-guide mailing list