scap-security-guide 0.1-10 help

Rodrian, Logan P (IS) Logan.Rodrian at ngc.com
Thu Mar 7 19:21:45 UTC 2013


Has this always been the case that the CPE/Dictionary is needed for oscap execution?  I ask because if this is a new feature, I will ping the SecState list about when they will be including the Dictionary as an argument to their program.  Currently, secstate imports only an xccdf and will not work with the SSG v0.1-10....trying to resolve why this is.


Logan Rodrian
________________________________
From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Shawn Wells [shawn at redhat.com]
Sent: Thursday, March 07, 2013 11:05
To: scap-security-guide at lists.fedorahosted.org
Subject: EXT :Re: scap-security-guide 0.1-10 help

On 3/7/13 8:51 AM, Rodrian, Logan P (IS) wrote:
It appears that the full command is needed.  The scan won't run without the cpe/dictionary reference.  The minimal command needed is as follows:

oscap xccdf eval --profile <profile> \
--cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

Ah, yes. The --cpe is *very* much needed as it provides some platform checks. The others (--report, etc) are optional.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130307/36e820b0/attachment-0001.html>


More information about the scap-security-guide mailing list