using SCC/CSCC with SSG content

Brian Peake PEAKE at HIPKLLC.COM
Tue Nov 6 15:16:00 UTC 2012


Thanks for the info Peter! I will get back when I get some time, hopefully
tomorrow, with some examples.

Very Respectfully,

Brian Peake




On 11/6/12 9:50 AM, "Peter Vrabec" <pvrabec at redhat.com> wrote:

>Hi Brian,
>
>we have fixed the issue with pam_cracklib.so retry(dcredit,
>ucredit, ocredit, lcredit) recently. The fix will be available in new
>openscap release 0.9.2.
>
>Also, Could you please provide an example of a rule that is not
>processed(not selected) by SCC but processed by OpenSCAP. I'd like to
>check if our behaviour is correct.
>
>If you find any differences between results from SSC and OpenSCAP please
>don't hesitate to contact us.
>
>thnx. a lot,
>Peter.
>
>
>On 11/02/2012 02:22 PM, Brian Peake wrote:
>> Shawn,
>> First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC),
>>the
>> documentation is in /opt/scc/documentation. There is a cscc-Readme.txt
>>and
>> a SCC_UserManual_RHEL.pdf.
>>
>> I have been using the GUI SCC version of it, however, I just ran ./cscc,
>> and it also works, however I had already done my configuration through
>>the
>> GUI?
>> 1. ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml
>> ssg-hel6-oval.xml ssg-rhel6-xccdf.xml
>> 2. Start SCC (hopefully you have X windows installed). cd /opt/scc  then
>> ./scc (yea I am root - and it does not work from gnome menu).
>> 3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and
>> then select SCAP Content. SCAP Content window opens.
>> 4. Uncheck the RHEL5 content. Click on the Add (top left button), select
>> your ZIP file from step 1, open. Now it is imported (BTW it places it in
>> /opt/scc/resources/content)
>> 5. Select/Check ssg-rhel6, then click on the "test" profile to change it
>> to server, stig-server or what ever. Select OK. (test is the first
>> profile, that is why it gets used initially)
>> 6. Select Local Computer (if local) and select Analyze Selected
>>Computers.
>> 7. Once it runs, Select Results from the Menu -> Recent Reports ->
>> yourReport to view it in html.
>>
>> (note- if you run the stig-server option, it will hang at the end trying
>> to generate the reports (due to size?), however "server" profile does
>>run
>> to finish. I can monitor the
>> /opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the
>> reports to finish and then Cancel Analysis in the SCC GUI.)
>>
>> The cscc-Readme goes into how to import content and configure the
>> /opt/scc/options.xml, but again I have not gotten into that much and
>> probably won't now I have OpenSCAP working.
>>
>> I just did a compare between OpenScap results vs. SCC3.02 results using
>> SSG content. Significant differences. Using the SSG with OpenSCAP is
>> nearly complete, whereas using it with SSC many of the checks are not
>>run
>> (Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) .
>> Things that passed with SCC (for example pam_cracklib.so retry, dcredit,
>> ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and
>>SGG
>> content, they are failing. Not sure why yet of course.
>>
>> Hopefully this is helpfully and you can run SCC using your content AND
>> hopefully SPAWAR is paying attention and will update their SCC tool to
>>run
>> the SGG content!
>>
>> Very Respectfully,
>>
>> Brian
>>
>>
>>
>> On 11/1/12 10:56 PM, "Shawn Wells" <shawn at redhat.com> wrote:
>>
>>> On 11/1/12 6:43 PM, Brian Peake wrote:
>>>> Shawn,
>>>> I just checked the DISA website for SCC 3.02 and there is
>>>> documentation avail in PDF. Unfortunately, it is PKI (CAC) required to
>>>> download. Because of this, I cannot send to you.
>>>>
>>>> However, I'll type up a quick howto to run your content with SCC tool
>>>> tomorrow AM. Send to you or post on the list?
>>> I have a copy of SCC but haven't been able to make it work yet. Tried
>>> manually editing the options.xml file, creating a zip.... clearly I'm
>>> doing something wrong. Sending out your notes would be incredibly
>>> helpful and could lay the foundation for us documenting how the RHEL6
>>> STIG & SSG can be used with SCC; please feel free to post to the list
>>>as
>>> it's very on topic.
>>>
>>>> Key piece is to zip the SSG content (the 4 XML files) and then use the
>>>> SCC tool to import it. Click on the "test" profile to change it to
>>>> server etc... After that I can select analyze and it gives me the
>>>> results in HTML format and XML.
>>>>
>>>> I will be playing tomorrow and will compare results between using SCC
>>>> and OpenSCAP with SSG content to see if they agree etc...
>>> That'd be incredibly helpful, thank you!
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>>
>>
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>
>_______________________________________________
>scap-security-guide mailing list
>scap-security-guide at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>




More information about the scap-security-guide mailing list