using SCC/CSCC with SSG content

Peter Vrabec pvrabec at redhat.com
Mon Nov 12 12:54:52 UTC 2012


Hi Brian,

we have identified a bug in our sysctl probe. It explains why it fails 
for you.

tracking at:
https://fedorahosted.org/openscap/ticket/271

---

Please note that there is also problem in the content. At least 
"enable_randomize_va_space" is not very robust. It only consider value 
"1" to be correct, but it could be "2" as well.


Peter.







On 11/07/2012 03:56 PM, Brian Peake wrote:
> Peter,
>
> A list that passes on my test VM using SCC w/ SSG content (from the
> scap-security-guide-0.1-7.src.rpm) but FAILS using opscap 0.9.1 w/ SSG:
>
> PASSES w/ SCC. FAILS w/ oscap
>
> 1. Set_bootloader_password
> 2. Enable_auditd_bootloader
> 3. Limit_password_reuse
> 4. All the pam_cracklib.so settings you already mentioned...
>
>
> Below is due to OVAL perhaps (tbh I don't know without digging)?
>
> Set properly with sysctl and in /etc/sysctl.conf, but fails w/ OpenSCAP
> (non of the kernel parameters are checked with SCC tool, returns all
> errors during run)
> 1. enable_randomize_va_space
> 2. enable_execshield
> 3. set_sysctl_net_ipv4_conf_all_log_martians
> 4. set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
> 5. set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
> 6. set_sysctl_net_ipv4_tcp_syncookies
> 7. set_sysctl_net_ipv4_conf_all_rp_filter
> 8. set_sysctl_net_ipv4_conf_default_rp_filter
>
> Other parameters that fail also, that I KNOW are set properly:
> 1. kernel_module_bluetooth_disabled
> 2. sshd_set_idle_timeout
> 3. sshd_disable_empty_passwords
> 4. sshd_do_not_permit_user_env
>
> For the life of me - /etc/issue is set correctly (using the full DoD
> warning), but I cannot get it to passŠ
> I am also using GDM and have a working login banner, but that also failsŠ
>
>
> Very Respectfully,
>
> Brian Peake
>
>
>
> On 11/6/12 9:55 PM, "Shawn Wells" <shawn at redhat.com> wrote:
>
>> On 11/6/12 10:16 AM, Brian Peake wrote:
>>> Thanks for the info Peter! I will get back when I get some time,
>>> hopefully
>>> tomorrow, with some examples.
>>
>>
>> I was able to run a scan tonight using the latest git clone of SSG
>> against the SCC tool. I've posted the output here:
>> http://people.redhat.com/swells/random/cscc.out.txt
>>
>> oscap output of the same content here:
>> http://people.redhat.com/swells/random/oscap.out.txt
>>
>> I'll drop the OVAL results somewhere shortly -- it generated 300MB of
>> output!! Try not to laugh (cry?) at all our OVAL errors. Please keep in
>> mind we haven't made OVAL a focus yet!
>>
>> Also, SCC took forever to run on a 2x 2.4GHz 6GB RAM virtual machine:
>> real    21m59.028s
>> user    21m17.791s
>> sys    0m33.558s
>>
>> Compared against oscap:
>> real    0m39.854s
>> user    0m27.210s
>> sys    0m12.671s
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>



More information about the scap-security-guide mailing list