RHEL6

Shawn Wells shawn at redhat.com
Wed Apr 24 01:11:09 UTC 2013


On 4/23/13 4:51 PM, Moessbauer, David wrote:
> Please see attached for requested full output.
>
> Utilizing your zip, I loaded the benchmark 'ssg-rhel6-oval.xml' and set the Profile to "stig-rhel6-server" and it seemed to run well in the SPAWAR SCC, (though it presented me with a sub-par compliance rating of 43% - ughhh!)
I had trouble getting the SCC content to work properly too. Back in 
February John U., one of the SCC tool developers, created the attached 
script for me to follow. Perhaps it'll be of some use to you (and thanks 
again to John for writing up these procedures!).

> The other Content option presented was 'eap5', which did not run so well - kicked multiple errors and did not complete.
I'm not aware of anyone who has tested the content with SCC.... feedback 
welcome.


> As these were the only presented OVAL files when selecting SCAP Content, I'm assuming the others I noted in zip were for alternate tools???
Correct. OpenSCAP, a tool shipped within the operating system, has been 
submitted to become SCAP 1.2 certified through NIST [1]. Admittedly much 
of SSG's development and testing is performed against OpenSCAP, however 
every attempt to support broader tooling is made.

[1] 
http://www.redhat.com/about/news/archive/2013/3/red-hat-openscap-under-evaluation-to-meet-scap-1-2-nist-standard
-------------- next part --------------
SCREEN LOGS - CSCC content install, run configuration and run.
--------------------------------------------------------------------------------
[root at localhost scc]# cd /opt/scc
[root at localhost scc]# ./cscc -is /home/testUser/Desktop/ssg_scc.zip 
Extracted: /opt/scc/Resources/Content/ssg-rhel6-cpe-oval.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-cpe-dictionary.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-ocil.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-oval.xml.
SCAP Content successfully installed to the Resources/Content directory.
Please enable content by running CSCC with the '--config' option.
[root at localhost scc]# 
[root at localhost scc]#

--------------------------------------------------------------------------------
[root at localhost scc]# cd /opt/scc
[root at localhost scc]# ./cscc --config

SCC 3.1 RC2 configuration edit menu.
Make menu selection:

1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes

SCAP Processing is Enabled
- 0 of 3 SCAP streams are enabled

OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled

Enter menu selection: 1
--------------------------------------------------------------------------------
SCC 3.1 RC2 Available SCAP Content
All content paths are relative to the installation directory at: /opt/scc/Resources

1.  [ ] ssg-rhel6   2013-02-01-05:00   0.1
        path: Content/
        profile: test
2.  [ ] U_RedHat_5_V1R2_STIG_Benchmark   2013-01-17   1
        path: Content/
        profile: MAC-1_Classified
3.  [ ] usgcb-rhel5desktop   2011-09-30   1.0.5.0
        path: Content/USGCB-RHEL5-1.0.5.0/
        profile: united_states_government_configuration_baseline
SCAP Content 0 of 3 enabled.

Enter content number to enable or disable content
('all', 'clear', or ranges N-N are allowed, type 'back' or '0' to return): 1

--------------------------------------------------------------------------------
SCC 3.1 RC2 Available SCAP Content
All content paths are relative to the installation directory at: /opt/scc/Resources

1.  [X] ssg-rhel6   2013-02-01-05:00   0.1
        path: Content/
        profile: test
2.  [ ] U_RedHat_5_V1R2_STIG_Benchmark   2013-01-17   1
        path: Content/
        profile: MAC-1_Classified
3.  [ ] usgcb-rhel5desktop   2011-09-30   1.0.5.0
        path: Content/USGCB-RHEL5-1.0.5.0/
        profile: united_states_government_configuration_baseline
SCAP Content 1 of 3 enabled.

Enter content number to enable or disable content
('all', 'clear', or ranges N-N are allowed, type 'back' or '0' to return): 0

--------------------------------------------------------------------------------
SCC 3.1 RC2 configuration edit menu.
Make menu selection:

1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes

SCAP Processing is Enabled
- 1 of 3 SCAP streams are enabled

OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled

Enter menu selection: 2

--------------------------------------------------------------------------------
Select SCAP Content to view available profiles
1.  [X] ssg-rhel6   2013-02-01-05:00   0.1
        path: Content/
        profile: stig-rhel6-server

Enter content number to view available profiles (type 'back' or '0' to return): 1

--------------------------------------------------------------------------------
Available Profiles for ssg-rhel6 2013-02-01-05:00 0.1
1.  [ ] test
2.  [ ] common
3.  [ ] desktop
4.  [ ] server
5.  [ ] ftp
6.  [ ] ftp
7.  [X] stig-rhel6-server
Enter profile number to set selected profile (type 'back' or '0' to return): 7

--------------------------------------------------------------------------------
Select SCAP Content to view available profiles
1.  [X] ssg-rhel6   2013-02-01-05:00   0.1
        path: Content/
        profile: stig-rhel6-server

Enter content number to view available profiles (type 'back' or '0' to return): 0

--------------------------------------------------------------------------------
SCC 3.1 RC2 configuration edit menu.
Make menu selection:

1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes

SCAP Processing is Enabled
- 1 of 3 SCAP streams are enabled

OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled

Enter menu selection: 6

--------------------------------------------------------------------------------
SCC 3.1 RC2 Options menu.
Make menu selection:

Content Scan Methods
 1. [X] Perform SCAP Scan
 2. [ ] Perform OVAL Scan

Select Reports
 3. [X] Generate 'All Settings' report
 4. [ ] Generate 'All Settings Summary' report
 5. [X] Generate 'Non-Compliance' report
 6. [ ] Generate 'Non-Compliance Summary' report

Report File Types
 7. [X] Generate reports as HTML
 8. [ ] Generate reports as Text

Logging and Debugging
 9.  [ ] Save screen logs
 10. [ ] Save debug logs
 11. [ ] Suppress warnings

XML Results
 12. [X] Save generated XCCDF OXML files
 13. [X] Save generated OVAL XML files
 14. [ ] Create ARF XML output
 15. [ ] Validate XML output files
 16. [ ] Save failed CPE XML results files

Content Processing
 17. [ ] Scan content directories on application load
 18. [ ] Validate content stream(s) XML files

Data Directory
 19. /opt/scc

OVAL Processing Options
 20. [X] Ignore remote fileSystems
 21. [X] Enable item creation threshold
 22. Item creation threshold: 50000
 23. [X] Ignore file extended ACL attributes

Enter menu selection (type 'back' or '0' to return): 

--------------------------------------------------------------------------------
SCC 3.1 RC2 configuration edit menu.
Make menu selection:

1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes

SCAP Processing is Enabled
- 1 of 3 SCAP streams are enabled

OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled

Enter menu selection: 8
Saving changes.
[root at localhost scc]# 

--------------------------------------------------------------------------------
SCC runs as expected, ending like:

localhost: Processing (391 of 411) Configure Dovecot to Use the SSL Certificate file
localhost: Processing (392 of 411) Configure Dovecot to Use the SSL Key file
localhost: Processing (393 of 411) Disable Plaintext Authentication - (CCE-27144-5)
localhost: Processing (394 of 411) Disable Samba - (CCE-27143-7)
localhost: Processing (395 of 411) Disable Root Access
localhost: Processing (396 of 411) Disable Root Access
localhost: Processing (397 of 411) Require Client SMB Packet Signing, if using smbclient - (CCE-26328-5)
localhost: Processing (398 of 411) Require Client SMB Packet Signing, if using mount.cifs - (CCE-26792-2)
localhost: Processing (399 of 411) Disable Squid - (CCE-27146-0)
localhost: Processing (400 of 411) Uninstall squid Package - (CCE-26977-9)
localhost: Processing (401 of 411) Disable snmpd Service - (CCE-26906-8)
localhost: Processing (402 of 411) Uninstall net-snmp Package - (CCE-26332-7)
localhost: Processing (403 of 411) Configure SNMP Service to Use Only SNMPv3 or Newer 
localhost: Processing (404 of 411) Ensure Default Password Is Not Used
localhost: Processing (405 of 411) Product Meets this Requirement
localhost: Processing (406 of 411) Product Meets this Requirement
localhost: Processing (407 of 411) Product Meets this Requirement
localhost: Processing (408 of 411) Guidance Does Not Meet this Requirement Due to Impracticality or Scope
localhost: Processing (409 of 411) Implementation of the Requirement is Not Supported
localhost: Processing (410 of 411) Guidance Does Not Meet this Requirement Due to Impracticality or Scope
localhost: Processing (411 of 411) A process for prompt installation of OS updates must exist.
localhost: Calculating scores
localhost: User: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_OVAL-Results_ssg-rhel6.xml
localhost: OCIL Schema Version: 2.0
localhost: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_OCIL-Results_ssg-rhel6.xml
localhost: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_OVAL-Variables_ssg-rhel6.xml
localhost: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_XCCDF-Results_ssg-rhel6.xml
localhost: Generating report testUser_SCC-3.1_RC2_2013-02-04_145218_All-Settings_ssg-rhel6.htm
localhost: Generating report testUser_SCC-3.1_RC2_2013-02-04_145218_Non-Compliance_ssg-rhel6.htm

localhost: Adjusted Score - 0% [RED]
localhost: Original Score - 0% [RED]


Total Errors: 11
Total Warnings: 2
Review complete.
Results, if any, are located in the following directory:
/opt/scc/Results

Logs, if any, are located in the following directory:
/opt/scc/Logs

[root at localhost scc]# 


More information about the scap-security-guide mailing list