Various False Positives?

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 3 15:49:51 UTC 2013


>>         240  /etc/ssh/sshd_config Banner
>>         The OVAL check was definitely working on my system when I
>>         last tested it. I'm able to reproduce...
>>
>>         [root at rhel6 checks]# cat /etc/issue
>>         You are accessing a U.S. Government (USG) Information System
>>         (IS) that is provided for USG-authorized use only. By using
>>         this IS (which includes any device attached to this IS), you
>>         consent to the following conditions:
>>         -The USG routinely intercepts and monitors communications on
>>         this IS for purposes including, but not limited to,
>>         penetration testing, COMSEC monitoring, network operations
>>         and defense, personnel misconduct (PM), law enforcement (LE),
>>         and counterintelligence (CI) investigations.
>>         -At any time, the USG may inspect and seize data stored on
>>         this IS.
>>         -Communications using, or data stored on, this IS are not
>>         private, are subject to routine monitoring, interception, and
>>         search, and may be disclosed or used for any USG-authorized
>>         purpose.
>>         -This IS includes security measures (e.g., authentication and
>>         access controls) to protect USG interests -- not for your
>>         personal benefit or privacy.
>>         -Notwithstanding the above, using this IS does not constitute
>>         consent to PM, LE or CI investigative searching or monitoring
>>         of the content of privileged communications, or work product,
>>         related to personal representation or services by attorneys,
>>         psychotherapists, or clergy, and their assistants. Such
>>         communications and work product are private and confidential.
>>         See User Agreement for details.
>>
>>         [root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
>>         Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
>>         Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
>>         Definition oval:scap-security-guide.testing:def:193: false
>>         Definition oval:scap-security-guide.testing:def:191: false
>>         Definition oval:scap-security-guide.testing:def:190: false
>>         Evaluation done.
>>
>>         Maura, do you want to take a stab at this (noticed your
>>         signoff on the OVAL)?
>>
>>         FWIW, if I used the USGCB banner everything worked OK.
>>

The ONLY thing the check is doing is checking that the line 'Banner 
/etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled. It 
doesn't care about the content of /etc/issue at all. I have no idea why 
it's failing for both of you guys. Full check is below my signature for 
comparison.

- Maura Dailey

<def-group>
   <definition class="compliance" id="sshd_banner_set" version="1">
     <metadata>
       <title>Enable a Warning Banner</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>SSH warning banner should be enabled (and 
dependencies are
       met)</description>
       <reference source="MED" ref_id="20130813" 
ref_url="test_attestation" />
     </metadata>
     <criteria comment="SSH is not being used or conditions are met"
     operator="OR">
       <extend_definition comment="sshd service is disabled"
       definition_ref="service_sshd_disabled" />
       <criterion comment="Check Banner in /etc/ssh/sshd_config"
       test_ref="test_sshd_banner_set" />
     </criteria>
   </definition>
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
   comment="Tests the value of the Banner[\s]+/etc/issue setting in the 
/etc/ssh/sshd_config file"
   id="test_sshd_banner_set" version="1">
     <ind:object object_ref="obj_sshd_banner_set" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_sshd_banner_set" version="1">
     <ind:path>/etc/ssh</ind:path>
     <ind:filename>sshd_config</ind:filename>
     <ind:pattern operation="pattern 
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
</def-group>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/64e6dfc6/attachment.html>


More information about the scap-security-guide mailing list