using SCC/CSCC with SSG content

Brian Peake PEAKE at HIPKLLC.COM
Fri Nov 9 16:29:37 UTC 2012


I should have caught that myself Peter, thanks.

Anyone have an idea why I cannot get rid of:
prelink: /usr/lib64/libgnome-bluetooth.so.7.0.2: at least one of file's
dependancies has changed since pre linking

It is keeping the rpm_verify_permissions from passing? # rpm -Va | grep
'^.M' is returning the above ^^ line.

I tried turning prelink off and running # pre link -au as per
https://access.redhat.com/knowledge/solutions/25215 and it did clear all
the other prelink problems the box I am on had, except the above one...
 


Very Respectfully,

Brian Peake




On 11/8/12 4:45 PM, "Peter Vrabec" <pvrabec at redhat.com> wrote:

>Ooops my mistake,
>
>on -> off, intention is to turn it off(kernel_module_bluetooth_disabled).
>
>alias bluetooth off
>alias net-pf-31 off
>
>:)
>
>
>----- Original Message -----
>> From: "Brian Peake" <PEAKE at HIPKLLC.COM>
>> To: scap-security-guide at lists.fedorahosted.org
>> Sent: Thursday, November 8, 2012 7:13:52 PM
>> Subject: Re: using SCC/CSCC with SSG content
>> 
>> Thanks Peter for the feedback! Comments belowŠ
>> 
>> Very Respectfully,
>> Brian Peake
>> 
>> On 11/8/12 11:39 AM, "Peter Vrabec" <pvrabec at redhat.com> wrote:
>> 
>> >Hi Brian,
>> >
>> >thnx. for the feedback. I have reviewed couple of your findings.
>> >
>> > > 1. Set_bootloader_password
>> > > 2. Enable_auditd_bootloader
>> > > 3. Limit_password_reuse
>> > > 4. All the pam_cracklib.so settings you already mentioned...
>> >
>> >
>> >These all ^^^ should be already fixed when we fixed #4. It's a same
>> >problem - textfilecontent54 on symlink.
>> 
>> Excellent news. Looking fwd to 0.9.2
>> >
>> > > Other parameters that fail also, that I KNOW are set properly:
>> > > 1. kernel_module_bluetooth_disabled
>> > > 2. sshd_set_idle_timeout
>> > > 3. sshd_disable_empty_passwords
>> > > 4. sshd_do_not_permit_user_env
>> >
>> >I have reviewed #1 so far. Unfortunately(or fortunately :)) I can't
>> >reproduce the fail you can see.
>> >
>> >If I put
>> >"
>> >alias bluetooth on
>> >alias net-pf-31 on
>> >"
>> >into "dist.conf" file and run the scan I get
>> >...
>> >Title   Disable Bluetooth Kernel Modules
>> >Rule    kernel_module_bluetooth_disabled
>> >Ident   CCE-14948-4
>> >Result  pass
>> >....
>> 
>> Well I was using /etc/modprobe.d/modprobe.confŠ I tried adding to
>> distro.conf
>> 
>> alias bluetooth on
>> alias net-pf-31 on
>> 
>> With same results.
>> # grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
>> grep: /etc/modprobe.conf: No such file or directory
>> /etc/modprobe.d/dist.conf:alias bluetooth on
>> /etc/modprobe.d/modprobe.conf:install bluetooth /bin/true
>> 
>> Grep reports the same for net-pf-31, So I am not sure why it is
>> failing
>> for me.
>> 
>> 
>> >
>> >I'll take a look at the rest.
>> >
>> >Peter.
>> >
>> >
>> >On 11/07/2012 03:56 PM, Brian Peake wrote:
>> >> Peter,
>> >>
>> >> A list that passes on my test VM using SCC w/ SSG content (from
>> >> the
>> >> scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/
>> >> SSG:
>> >>
>> >> PASSES w/ SCC. FAILS w/ oscap
>> >>
>> >> 1. Set_bootloader_password
>> >> 2. Enable_auditd_bootloader
>> >> 3. Limit_password_reuse
>> >> 4. All the pam_cracklib.so settings you already mentioned...
>> >>
>> >>
>> >> Below is due to OVAL perhaps (tbh I don't know without digging)?
>> >>
>> >> Set properly with sysctl and in /etc/sysctl.conf, but fails w/
>> >> OpenSCAP
>> >> (non of the kernel parameters are checked with SCC tool, returns
>> >> all
>> >> errors during run)
>> >> 1. enable_randomize_va_space
>> >> 2. enable_execshield
>> >> 3. set_sysctl_net_ipv4_conf_all_log_martians
>> >> 4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
>> >> 5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
>> >> 6. set_sysctl_net_ipv4_tcp_syncookies
>> >> 7. set_sysctl_net_ipv4_conf_all_rp_filter
>> >> 8. set_sysctl_net_ipv4_conf_default_rp_filter
>> >>
>> >> Other parameters that fail also, that I KNOW are set properly:
>> >> 1. kernel_module_bluetooth_disabled
>> >> 2. sshd_set_idle_timeout
>> >> 3. sshd_disable_empty_passwords
>> >> 4. sshd_do_not_permit_user_env
>> >>
>> >> For the life of me - /etc/issue is set correctly (using the full
>> >> DoD
>> >> warning), but I cannot get it to pass?
>> >> I am also using GDM and have a working login banner, but that also
>> >>fails?
>> >>
>> >>
>> >> Very Respectfully,
>> >>
>> >> Brian Peake
>> >>
>> >>
>> >>
>> >> On 11/6/12 9:55 PM, "Shawn Wells" <shawn at redhat.com> wrote:
>> >>
>> >>> On 11/6/12 10:16 AM, Brian Peake wrote:
>> >>>> Thanks for the info Peter! I will get back when I get some time,
>> >>>> hopefully
>> >>>> tomorrow, with some examples.
>> >>>
>> >>>
>> >>> I was able to run a scan tonight using the latest git clone of
>> >>> SSG
>> >>> against the SCC tool. I've posted the output here:
>> >>> http://people.redhat.com/swells/random/cscc.out.txt
>> >>>
>> >>> oscap output of the same content here:
>> >>> http://people.redhat.com/swells/random/oscap.out.txt
>> >>>
>> >>> I'll drop the OVAL results somewhere shortly -- it generated
>> >>> 300MB of
>> >>> output!! Try not to laugh (cry?) at all our OVAL errors. Please
>> >>> keep in
>> >>> mind we haven't made OVAL a focus yet!
>> >>>
>> >>> Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual
>> >>> machine:
>> >>> real    21m59.028s
>> >>> user    21m17.791s
>> >>> sys    0m33.558s
>> >>>
>> >>> Compared against oscap:
>> >>> real    0m39.854s
>> >>> user    0m27.210s
>> >>> sys    0m12.671s
>> >>> _______________________________________________
>> >>> scap-security-guide mailing list
>> >>> scap-security-guide at lists.fedorahosted.org
>> >>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> >>>
>> >>
>> >>
>> >> _______________________________________________
>> >> scap-security-guide mailing list
>> >> scap-security-guide at lists.fedorahosted.org
>> >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> >>
>> >
>> >_______________________________________________
>> >scap-security-guide mailing list
>> >scap-security-guide at lists.fedorahosted.org
>> >https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> >
>> 
>> 
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> 
>_______________________________________________
>scap-security-guide mailing list
>scap-security-guide at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>




More information about the scap-security-guide mailing list