Various False Positives?
Maura Dailey
maura at eclipse.ncsc.mil
Tue Sep 3 15:49:51 UTC 2013
>> 240 /etc/ssh/sshd_config Banner
>> The OVAL check was definitely working on my system when I
>> last tested it. I'm able to reproduce...
>>
>> [root at rhel6 checks]# cat /etc/issue
>> You are accessing a U.S. Government (USG) Information System
>> (IS) that is provided for USG-authorized use only. By using
>> this IS (which includes any device attached to this IS), you
>> consent to the following conditions:
>> -The USG routinely intercepts and monitors communications on
>> this IS for purposes including, but not limited to,
>> penetration testing, COMSEC monitoring, network operations
>> and defense, personnel misconduct (PM), law enforcement (LE),
>> and counterintelligence (CI) investigations.
>> -At any time, the USG may inspect and seize data stored on
>> this IS.
>> -Communications using, or data stored on, this IS are not
>> private, are subject to routine monitoring, interception, and
>> search, and may be disclosed or used for any USG-authorized
>> purpose.
>> -This IS includes security measures (e.g., authentication and
>> access controls) to protect USG interests -- not for your
>> personal benefit or privacy.
>> -Notwithstanding the above, using this IS does not constitute
>> consent to PM, LE or CI investigative searching or monitoring
>> of the content of privileged communications, or work product,
>> related to personal representation or services by attorneys,
>> psychotherapists, or clergy, and their assistants. Such
>> communications and work product are private and confidential.
>> See User Agreement for details.
>>
>> [root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
>> Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
>> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
>> Definition oval:scap-security-guide.testing:def:193: false
>> Definition oval:scap-security-guide.testing:def:191: false
>> Definition oval:scap-security-guide.testing:def:190: false
>> Evaluation done.
>>
>> Maura, do you want to take a stab at this (noticed your
>> signoff on the OVAL)?
>>
>> FWIW, if I used the USGCB banner everything worked OK.
>>
The ONLY thing the check is doing is checking that the line 'Banner
/etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled. It
doesn't care about the content of /etc/issue at all. I have no idea why
it's failing for both of you guys. Full check is below my signature for
comparison.
- Maura Dailey
<def-group>
<definition class="compliance" id="sshd_banner_set" version="1">
<metadata>
<title>Enable a Warning Banner</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>SSH warning banner should be enabled (and
dependencies are
met)</description>
<reference source="MED" ref_id="20130813"
ref_url="test_attestation" />
</metadata>
<criteria comment="SSH is not being used or conditions are met"
operator="OR">
<extend_definition comment="sshd service is disabled"
definition_ref="service_sshd_disabled" />
<criterion comment="Check Banner in /etc/ssh/sshd_config"
test_ref="test_sshd_banner_set" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Tests the value of the Banner[\s]+/etc/issue setting in the
/etc/ssh/sshd_config file"
id="test_sshd_banner_set" version="1">
<ind:object object_ref="obj_sshd_banner_set" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sshd_banner_set" version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/64e6dfc6/attachment.html>
More information about the scap-security-guide
mailing list