Compose with the OSCAP Anaconda Addon available

Steve Grubb sgrubb at redhat.com
Fri Nov 22 20:12:12 UTC 2013


On Friday, November 22, 2013 07:45:42 AM Martin Preisler wrote:
> Hi,
> 
> > On Wednesday, November 20, 2013 10:13:45 PM Shawn Wells wrote:
> > > 2) Will Benchmark content be accepted in the future, or must content be
> > > in datastream formats? If datastream, we're looking at a fundamental
> > > change to how SSG content is expressed. That's not necessarily a bad
> > > thing, just want to start the conversation and understand your direction
> > 
> > One of the features of SCAP 1.2 is datastreams. It allows for 1 file to be
> > signed and delivered. Its much more convenient to distribute content like
> > that
> > than individual files. Simon wrote a tutorial on how to convert an
> > existing
> > collection of content into a datastream here:
> > 
> > http://isimluk.livejournal.com/3660.html?title=How to convert USGCB to
> > DataStream with OpenSCAP
> 
> I agree, it also makes it easier and more manageable to scan remote
> machines.
> 
> One downside is that you can't use XCCDF 1.1 inside a datastream.
> Datastreams only allow XCCDF 1.2.

The SSG content is already using features found only in SCAP 1.2, so I would 
hope that content being created completely embraces SCAP 1.2. SCAP is certified 
as a unit. Meaning you don't mix and match the versions of OVAL, XCCDF, CPE, 
etc. So, if SSG is not fully up to SCAP 1.2, it should be patched to be at 1.2 
for all of the SCAP standards its using.

-Steve

 
> If you are interested I could help you with the transition to XCCDF 1.2.
> The main hurdle will likely be changing all the Rule and Group IDs to the
> new enforced XCCDF 1.2 format. After that is done, we could simply use
> openscap to automatically pack up the datastream and have all of this
> be a part of the build process in scap-security-guide.
> 
> One risk I can see is that the content will no longer be XCCDF 1.1, so tools
> only implementing XCCDF 1.1 can no longer use it. Not sure how big a deal
> that is but if needed we could build both XCCDF 1.1 and 1.2 with not that
> much added complexity to the build process.



More information about the scap-security-guide mailing list