RHEL6
Shawn Wells
shawn at redhat.com
Wed Apr 24 01:11:09 UTC 2013
On 4/23/13 4:51 PM, Moessbauer, David wrote:
> Please see attached for requested full output.
>
> Utilizing your zip, I loaded the benchmark 'ssg-rhel6-oval.xml' and set the Profile to "stig-rhel6-server" and it seemed to run well in the SPAWAR SCC, (though it presented me with a sub-par compliance rating of 43% - ughhh!)
I had trouble getting the SCC content to work properly too. Back in
February John U., one of the SCC tool developers, created the attached
script for me to follow. Perhaps it'll be of some use to you (and thanks
again to John for writing up these procedures!).
> The other Content option presented was 'eap5', which did not run so well - kicked multiple errors and did not complete.
I'm not aware of anyone who has tested the content with SCC.... feedback
welcome.
> As these were the only presented OVAL files when selecting SCAP Content, I'm assuming the others I noted in zip were for alternate tools???
Correct. OpenSCAP, a tool shipped within the operating system, has been
submitted to become SCAP 1.2 certified through NIST [1]. Admittedly much
of SSG's development and testing is performed against OpenSCAP, however
every attempt to support broader tooling is made.
[1]
http://www.redhat.com/about/news/archive/2013/3/red-hat-openscap-under-evaluation-to-meet-scap-1-2-nist-standard
-------------- next part --------------
SCREEN LOGS - CSCC content install, run configuration and run.
--------------------------------------------------------------------------------
[root at localhost scc]# cd /opt/scc
[root at localhost scc]# ./cscc -is /home/testUser/Desktop/ssg_scc.zip
Extracted: /opt/scc/Resources/Content/ssg-rhel6-cpe-oval.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-cpe-dictionary.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-ocil.xml.
Extracted: /opt/scc/Resources/Content/ssg-rhel6-oval.xml.
SCAP Content successfully installed to the Resources/Content directory.
Please enable content by running CSCC with the '--config' option.
[root at localhost scc]#
[root at localhost scc]#
--------------------------------------------------------------------------------
[root at localhost scc]# cd /opt/scc
[root at localhost scc]# ./cscc --config
SCC 3.1 RC2 configuration edit menu.
Make menu selection:
1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes
SCAP Processing is Enabled
- 0 of 3 SCAP streams are enabled
OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled
Enter menu selection: 1
--------------------------------------------------------------------------------
SCC 3.1 RC2 Available SCAP Content
All content paths are relative to the installation directory at: /opt/scc/Resources
1. [ ] ssg-rhel6 2013-02-01-05:00 0.1
path: Content/
profile: test
2. [ ] U_RedHat_5_V1R2_STIG_Benchmark 2013-01-17 1
path: Content/
profile: MAC-1_Classified
3. [ ] usgcb-rhel5desktop 2011-09-30 1.0.5.0
path: Content/USGCB-RHEL5-1.0.5.0/
profile: united_states_government_configuration_baseline
SCAP Content 0 of 3 enabled.
Enter content number to enable or disable content
('all', 'clear', or ranges N-N are allowed, type 'back' or '0' to return): 1
--------------------------------------------------------------------------------
SCC 3.1 RC2 Available SCAP Content
All content paths are relative to the installation directory at: /opt/scc/Resources
1. [X] ssg-rhel6 2013-02-01-05:00 0.1
path: Content/
profile: test
2. [ ] U_RedHat_5_V1R2_STIG_Benchmark 2013-01-17 1
path: Content/
profile: MAC-1_Classified
3. [ ] usgcb-rhel5desktop 2011-09-30 1.0.5.0
path: Content/USGCB-RHEL5-1.0.5.0/
profile: united_states_government_configuration_baseline
SCAP Content 1 of 3 enabled.
Enter content number to enable or disable content
('all', 'clear', or ranges N-N are allowed, type 'back' or '0' to return): 0
--------------------------------------------------------------------------------
SCC 3.1 RC2 configuration edit menu.
Make menu selection:
1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes
SCAP Processing is Enabled
- 1 of 3 SCAP streams are enabled
OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled
Enter menu selection: 2
--------------------------------------------------------------------------------
Select SCAP Content to view available profiles
1. [X] ssg-rhel6 2013-02-01-05:00 0.1
path: Content/
profile: stig-rhel6-server
Enter content number to view available profiles (type 'back' or '0' to return): 1
--------------------------------------------------------------------------------
Available Profiles for ssg-rhel6 2013-02-01-05:00 0.1
1. [ ] test
2. [ ] common
3. [ ] desktop
4. [ ] server
5. [ ] ftp
6. [ ] ftp
7. [X] stig-rhel6-server
Enter profile number to set selected profile (type 'back' or '0' to return): 7
--------------------------------------------------------------------------------
Select SCAP Content to view available profiles
1. [X] ssg-rhel6 2013-02-01-05:00 0.1
path: Content/
profile: stig-rhel6-server
Enter content number to view available profiles (type 'back' or '0' to return): 0
--------------------------------------------------------------------------------
SCC 3.1 RC2 configuration edit menu.
Make menu selection:
1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes
SCAP Processing is Enabled
- 1 of 3 SCAP streams are enabled
OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled
Enter menu selection: 6
--------------------------------------------------------------------------------
SCC 3.1 RC2 Options menu.
Make menu selection:
Content Scan Methods
1. [X] Perform SCAP Scan
2. [ ] Perform OVAL Scan
Select Reports
3. [X] Generate 'All Settings' report
4. [ ] Generate 'All Settings Summary' report
5. [X] Generate 'Non-Compliance' report
6. [ ] Generate 'Non-Compliance Summary' report
Report File Types
7. [X] Generate reports as HTML
8. [ ] Generate reports as Text
Logging and Debugging
9. [ ] Save screen logs
10. [ ] Save debug logs
11. [ ] Suppress warnings
XML Results
12. [X] Save generated XCCDF OXML files
13. [X] Save generated OVAL XML files
14. [ ] Create ARF XML output
15. [ ] Validate XML output files
16. [ ] Save failed CPE XML results files
Content Processing
17. [ ] Scan content directories on application load
18. [ ] Validate content stream(s) XML files
Data Directory
19. /opt/scc
OVAL Processing Options
20. [X] Ignore remote fileSystems
21. [X] Enable item creation threshold
22. Item creation threshold: 50000
23. [X] Ignore file extended ACL attributes
Enter menu selection (type 'back' or '0' to return):
--------------------------------------------------------------------------------
SCC 3.1 RC2 configuration edit menu.
Make menu selection:
1. Configure SCAP content
2. Configure SCAP profiles
3. Delete SCAP content
4. Configure OVAL content
5. Delete OVAL content
6. Configure Options
7. Configure SSH Options
8. Exit and save changes
9. Exit without saving changes
SCAP Processing is Enabled
- 1 of 3 SCAP streams are enabled
OVAL Processing is Disabled
- 0 of 0 OVAL streams are enabled
Enter menu selection: 8
Saving changes.
[root at localhost scc]#
--------------------------------------------------------------------------------
SCC runs as expected, ending like:
localhost: Processing (391 of 411) Configure Dovecot to Use the SSL Certificate file
localhost: Processing (392 of 411) Configure Dovecot to Use the SSL Key file
localhost: Processing (393 of 411) Disable Plaintext Authentication - (CCE-27144-5)
localhost: Processing (394 of 411) Disable Samba - (CCE-27143-7)
localhost: Processing (395 of 411) Disable Root Access
localhost: Processing (396 of 411) Disable Root Access
localhost: Processing (397 of 411) Require Client SMB Packet Signing, if using smbclient - (CCE-26328-5)
localhost: Processing (398 of 411) Require Client SMB Packet Signing, if using mount.cifs - (CCE-26792-2)
localhost: Processing (399 of 411) Disable Squid - (CCE-27146-0)
localhost: Processing (400 of 411) Uninstall squid Package - (CCE-26977-9)
localhost: Processing (401 of 411) Disable snmpd Service - (CCE-26906-8)
localhost: Processing (402 of 411) Uninstall net-snmp Package - (CCE-26332-7)
localhost: Processing (403 of 411) Configure SNMP Service to Use Only SNMPv3 or Newer
localhost: Processing (404 of 411) Ensure Default Password Is Not Used
localhost: Processing (405 of 411) Product Meets this Requirement
localhost: Processing (406 of 411) Product Meets this Requirement
localhost: Processing (407 of 411) Product Meets this Requirement
localhost: Processing (408 of 411) Guidance Does Not Meet this Requirement Due to Impracticality or Scope
localhost: Processing (409 of 411) Implementation of the Requirement is Not Supported
localhost: Processing (410 of 411) Guidance Does Not Meet this Requirement Due to Impracticality or Scope
localhost: Processing (411 of 411) A process for prompt installation of OS updates must exist.
localhost: Calculating scores
localhost: User: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_OVAL-Results_ssg-rhel6.xml
localhost: OCIL Schema Version: 2.0
localhost: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_OCIL-Results_ssg-rhel6.xml
localhost: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_OVAL-Variables_ssg-rhel6.xml
localhost: Saving testUser_SCC-3.1_RC2_2013-02-04_145218_XCCDF-Results_ssg-rhel6.xml
localhost: Generating report testUser_SCC-3.1_RC2_2013-02-04_145218_All-Settings_ssg-rhel6.htm
localhost: Generating report testUser_SCC-3.1_RC2_2013-02-04_145218_Non-Compliance_ssg-rhel6.htm
localhost: Adjusted Score - 0% [RED]
localhost: Original Score - 0% [RED]
Total Errors: 11
Total Warnings: 2
Review complete.
Results, if any, are located in the following directory:
/opt/scc/Results
Logs, if any, are located in the following directory:
/opt/scc/Logs
[root at localhost scc]#
More information about the scap-security-guide
mailing list