SSG Audit + Aqueduct Remediation Linking

Francisco Slavin fslavin at tresys.com
Thu Sep 6 22:25:48 UTC 2012


Hello,

As you may be aware, one of the key use cases for SecState has been automated remediation.  We have shifted away from Puppet remediation to BASH remediation in response to community input & direction.  At this time our core target is enabling users to use SSG content to audit a system and Aqueduct content to remediate a system.  As we move forward with designing the "glue" to link the content together we would appreciate input from the community about the approach we're planning for this.  We want to help find an approach for this which is agreeable to the content maintainers and lets us meet our use cases.

We are planning to continue using the <fix> tag with a custom system attribute string to indicate that the <fix> tag contains BASH remediation content.  We are currently considering JSON notation as the leading candidate for writing the <fix> content because it is both easy to write and easy to parse.  The information we want to make sure we cover for running a remediation script is:

 * Path to the script
 * Environment variables to define
 * Positional arguments to pass in to the script

Using JSON notation in a <fix> tag, this would be the representation of that info:

<fix system="urn:xccdf:fix:script:bash">
{
    "script" : "/usr/libexec/ssg/scripts/remediate_foo.sh"
    "environment-variables" : {"FOO" : "12", "TEST" : "<sub idref="xccdf_variable_foo" />"}
    "positional-args" : ["test","<sub idref=" other_xccdf_variable" />"]
}
</fix>

The array of positional-args would be assumed to be ordered.  So this example would call:
FOO=12 TEST=<value of xccdf_variable_foo> /bin/bash /usr/libexec/ssg/scripts/remediate_foo.sh test <value of other_xccdf_variable>

We would appreciate any input & feedback regarding this approach.

Thank you
- Francisco Slavin



More information about the scap-security-guide mailing list