using SCC/CSCC with SSG content

Peter Vrabec pvrabec at redhat.com
Thu Nov 8 21:45:37 UTC 2012


Ooops my mistake,

on -> off, intention is to turn it off(kernel_module_bluetooth_disabled).

alias bluetooth off
alias net-pf-31 off

:)


----- Original Message -----
> From: "Brian Peake" <PEAKE at HIPKLLC.COM>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Thursday, November 8, 2012 7:13:52 PM
> Subject: Re: using SCC/CSCC with SSG content
> 
> Thanks Peter for the feedback! Comments below…
> 
> Very Respectfully,
> Brian Peake
> 
> On 11/8/12 11:39 AM, "Peter Vrabec" <pvrabec at redhat.com> wrote:
> 
> >Hi Brian,
> >
> >thnx. for the feedback. I have reviewed couple of your findings.
> >
> > > 1. Set_bootloader_password
> > > 2. Enable_auditd_bootloader
> > > 3. Limit_password_reuse
> > > 4. All the pam_cracklib.so settings you already mentioned...
> >
> >
> >These all ^^^ should be already fixed when we fixed #4. It's a same
> >problem - textfilecontent54 on symlink.
> 
> Excellent news. Looking fwd to 0.9.2
> >
> > > Other parameters that fail also, that I KNOW are set properly:
> > > 1. kernel_module_bluetooth_disabled
> > > 2. sshd_set_idle_timeout
> > > 3. sshd_disable_empty_passwords
> > > 4. sshd_do_not_permit_user_env
> >
> >I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't
> >reproduce the fail you can see.
> >
> >If I put
> >"
> >alias bluetooth on
> >alias net-pf-31 on
> >"
> >into "dist.conf" file and run the scan I get
> >...
> >Title   Disable Bluetooth Kernel Modules
> >Rule    kernel_module_bluetooth_disabled
> >Ident   CCE-14948-4
> >Result  pass
> >....
> 
> Well I was using /etc/modprobe.d/modprobe.conf… I tried adding to
> distro.conf
> 
> alias bluetooth on
> alias net-pf-31 on
> 
> With same results.
> # grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
> grep: /etc/modprobe.conf: No such file or directory
> /etc/modprobe.d/dist.conf:alias bluetooth on
> /etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
> 
> Grep reports the same for net-pf-31, So I am not sure why it is
> failing
> for me.
> 
> 
> >
> >I'll take a look at the rest.
> >
> >Peter.
> >
> >
> >On 11/07/2012 03:56 PM, Brian Peake wrote:
> >> Peter,
> >>
> >> A list that passes on my test VM using SCC w/ SSG content (from
> >> the
> >> scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/
> >> SSG:
> >>
> >> PASSES w/ SCC. FAILS w/ oscap
> >>
> >> 1. Set_bootloader_password
> >> 2. Enable_auditd_bootloader
> >> 3. Limit_password_reuse
> >> 4. All the pam_cracklib.so settings you already mentioned...
> >>
> >>
> >> Below is due to OVAL perhaps (tbh I don't know without digging)?
> >>
> >> Set properly with sysctl and in /etc/sysctl.conf, but fails w/
> >> OpenSCAP
> >> (non of the kernel parameters are checked with SCC tool, returns
> >> all
> >> errors during run)
> >> 1. enable_randomize_va_space
> >> 2. enable_execshield
> >> 3. set_sysctl_net_ipv4_conf_all_log_martians
> >> 4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
> >> 5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
> >> 6. set_sysctl_net_ipv4_tcp_syncookies
> >> 7. set_sysctl_net_ipv4_conf_all_rp_filter
> >> 8. set_sysctl_net_ipv4_conf_default_rp_filter
> >>
> >> Other parameters that fail also, that I KNOW are set properly:
> >> 1. kernel_module_bluetooth_disabled
> >> 2. sshd_set_idle_timeout
> >> 3. sshd_disable_empty_passwords
> >> 4. sshd_do_not_permit_user_env
> >>
> >> For the life of me - /etc/issue is set correctly (using the full
> >> DoD
> >> warning), but I cannot get it to pass?
> >> I am also using GDM and have a working login banner, but that also
> >>fails?
> >>
> >>
> >> Very Respectfully,
> >>
> >> Brian Peake
> >>
> >>
> >>
> >> On 11/6/12 9:55 PM, "Shawn Wells" <shawn at redhat.com> wrote:
> >>
> >>> On 11/6/12 10:16 AM, Brian Peake wrote:
> >>>> Thanks for the info Peter! I will get back when I get some time,
> >>>> hopefully
> >>>> tomorrow, with some examples.
> >>>
> >>>
> >>> I was able to run a scan tonight using the latest git clone of
> >>> SSG
> >>> against the SCC tool. I've posted the output here:
> >>> http://people.redhat.com/swells/random/cscc.out.txt
> >>>
> >>> oscap output of the same content here:
> >>> http://people.redhat.com/swells/random/oscap.out.txt
> >>>
> >>> I'll drop the OVAL results somewhere shortly -- it generated
> >>> 300MB of
> >>> output!! Try not to laugh (cry?) at all our OVAL errors. Please
> >>> keep in
> >>> mind we haven't made OVAL a focus yet!
> >>>
> >>> Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual
> >>> machine:
> >>> real    21m59.028s
> >>> user    21m17.791s
> >>> sys    0m33.558s
> >>>
> >>> Compared against oscap:
> >>> real    0m39.854s
> >>> user    0m27.210s
> >>> sys    0m12.671s
> >>> _______________________________________________
> >>> scap-security-guide mailing list
> >>> scap-security-guide at lists.fedorahosted.org
> >>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >>>
> >>
> >>
> >> _______________________________________________
> >> scap-security-guide mailing list
> >> scap-security-guide at lists.fedorahosted.org
> >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >>
> >
> >_______________________________________________
> >scap-security-guide mailing list
> >scap-security-guide at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list