using SCC/CSCC with SSG content

Brian Peake PEAKE at HIPKLLC.COM
Wed Nov 7 14:56:49 UTC 2012


Peter,

A list that passes on my test VM using SCC w/ SSG content (from the
scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:

PASSES w/ SCC. FAILS w/ oscap

1. Set_bootloader_password
2. Enable_auditd_bootloader
3. Limit_password_reuse
4. All the pam_cracklib.so settings you already mentioned...


Below is due to OVAL perhaps (tbh I don't know without digging)?

Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP
(non of the kernel parameters are checked with SCC tool, returns all
errors during run)
1. enable_randomize_va_space
2. enable_execshield
3. set_sysctl_net_ipv4_conf_all_log_martians
4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
6. set_sysctl_net_ipv4_tcp_syncookies
7. set_sysctl_net_ipv4_conf_all_rp_filter
8. set_sysctl_net_ipv4_conf_default_rp_filter

Other parameters that fail also, that I KNOW are set properly:
1. kernel_module_bluetooth_disabled
2. sshd_set_idle_timeout
3. sshd_disable_empty_passwords
4. sshd_do_not_permit_user_env

For the life of me - /etc/issue is set correctly (using the full DoD
warning), but I cannot get it to passŠ
I am also using GDM and have a working login banner, but that also failsŠ


Very Respectfully,

Brian Peake



On 11/6/12 9:55 PM, "Shawn Wells" <shawn at redhat.com> wrote:

>On 11/6/12 10:16 AM, Brian Peake wrote:
>> Thanks for the info Peter! I will get back when I get some time,
>>hopefully
>> tomorrow, with some examples.
>
>
>I was able to run a scan tonight using the latest git clone of SSG
>against the SCC tool. I've posted the output here:
>http://people.redhat.com/swells/random/cscc.out.txt
>
>oscap output of the same content here:
>http://people.redhat.com/swells/random/oscap.out.txt
>
>I'll drop the OVAL results somewhere shortly -- it generated 300MB of
>output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in
>mind we haven't made OVAL a focus yet!
>
>Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine:
>real    21m59.028s
>user    21m17.791s
>sys    0m33.558s
>
>Compared against oscap:
>real    0m39.854s
>user    0m27.210s
>sys    0m12.671s
>_______________________________________________
>scap-security-guide mailing list
>scap-security-guide at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>




More information about the scap-security-guide mailing list