Hello

Shawn Wells shawn at redhat.com
Mon Jan 14 04:34:28 UTC 2013


On 1/7/13 3:27 PM, Christopher Anderson wrote:
> I'm hoping to help out where I can. I have a fairly strong background in Information Security and system hardening, although I have not had a lot of exposure to XML and git.
Those are the easy parts! Just wait until you start writing/patching 
OVAL code!

> I have been using Red Hat's products since Red Hat Linux 4.2 and Linux since 0.99.x (woo Yggdrasil and Slackware!). Also I have worked as a System Administrator for about a decade and a half, starting with Sun Solaris 2.5.1 with a slight detour through IRIX and moving as quickly as possible to Linux.
>
> On the Information Assurance side, I'm fairly familiar with the DOD STIG guidelines and the NSA guides for hardening RHEL 5 and have used them at work over the years.
>
> I'd really appreciate any starting points / pointers!

Consumption information is fairly well documented on the wiki:
https://fedorahosted.org/scap-security-guide/wiki

Feedback on how easy it was for you to figure out how to download and 
use the content would be incredibly valuable.

After that, IMO, testing of the OVAL checks would be valuable. 
Specifically, ensuring that each XCCDF rule from the stig-rhel6-server 
profile is paired with an OVAL test, and that OVAL test is performing as 
expected.

There is a utility in scap-security-guide/RHEL6/utils/ called 
verify-references.py you can look at (just vi it) which may help in 
this. For example:

[shawn at rhel6 output]$ ../utils/verify-references.py --profile 
stig-rhel6-server --rules-with-invalid-checks ssg-rhel6-xccdf.xml
Invalid OVAL definition referenced by XCCDF Rule: disable_gnome_thumbnailers
Invalid OVAL definition referenced by XCCDF Rule: no_netrc_files
Invalid OVAL definition referenced by XCCDF Rule: 
deny_password_attempts_unlock_time
Invalid OVAL definition referenced by XCCDF Rule: 
deny_password_attempts_fail_interval
Invalid OVAL definition referenced by XCCDF Rule: set_gdm_login_banner_text
Invalid OVAL definition referenced by XCCDF Rule: 
disable_logwatch_for_logserver
Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_lockd_tcp_port
Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_lockd_udp_port
Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_statd_port
Invalid OVAL definition referenced by XCCDF Rule: nfs_fixed_mountd_port
Invalid OVAL definition referenced by XCCDF Rule: 
use_root_squashing_all_exports
Invalid OVAL definition referenced by XCCDF Rule: 
restrict_nfs_clients_to_privileged_ports
Invalid OVAL definition referenced by XCCDF Rule: no_insecure_locks_exports
Invalid OVAL definition referenced by XCCDF Rule: httpd_servertokens_prod
Invalid OVAL definition referenced by XCCDF Rule: httpd_serversignature_off
Invalid OVAL definition referenced by XCCDF Rule: httpd_install_mod_ssl
Invalid OVAL definition referenced by XCCDF Rule: httpd_install_mod_security




More information about the scap-security-guide mailing list