Various False Positives?

Shane Shaffer shane.shaffer at g2-inc.com
Tue Sep 3 16:14:32 UTC 2013


Modifier spans like (?i) and (?-i) aren't supported in OVAL, though they
will probably work in some interpreters depending on the regex
implementation.


Shane Shaffer
G2, Inc.
shane.shaffer at g2-inc.com


On Tue, Sep 3, 2013 at 11:49 AM, Maura Dailey <maura at eclipse.ncsc.mil>wrote:

>      240  /etc/ssh/sshd_config Banner
>>  The OVAL check was definitely working on my system when I last tested
>> it. I'm able to reproduce...
>>
>> [root at rhel6 checks]# cat /etc/issue
>> You are accessing a U.S. Government (USG) Information System (IS) that is
>> provided for USG-authorized use only. By using this IS (which includes any
>> device attached to this IS), you consent to the following conditions:
>> -The USG routinely intercepts and monitors communications on this IS for
>> purposes including, but not limited to, penetration testing, COMSEC
>> monitoring, network operations and defense, personnel misconduct (PM), law
>> enforcement (LE), and counterintelligence (CI) investigations.
>> -At any time, the USG may inspect and seize data stored on this IS.
>> -Communications using, or data stored on, this IS are not private, are
>> subject to routine monitoring, interception, and search, and may be
>> disclosed or used for any USG-authorized purpose.
>> -This IS includes security measures (e.g., authentication and access
>> controls) to protect USG interests -- not for your personal benefit or
>> privacy.
>> -Notwithstanding the above, using this IS does not constitute consent to
>> PM, LE or CI investigative searching or monitoring of the content of
>> privileged communications, or work product, related to personal
>> representation or services by attorneys, psychotherapists, or clergy, and
>> their assistants. Such communications and work product are private and
>> confidential. See User Agreement for details.
>>
>> [root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
>> Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
>> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
>> Definition oval:scap-security-guide.testing:def:193: false
>> Definition oval:scap-security-guide.testing:def:191: false
>> Definition oval:scap-security-guide.testing:def:190: false
>> Evaluation done.
>>
>> Maura, do you want to take a stab at this (noticed your signoff on the
>> OVAL)?
>>
>> FWIW, if I used the USGCB banner everything worked OK.
>>
>>
> The ONLY thing the check is doing is checking that the line 'Banner
> /etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled. It
> doesn't care about the content of /etc/issue at all. I have no idea why
> it's failing for both of you guys. Full check is below my signature for
> comparison.
>
> - Maura Dailey
>
> <def-group>
>   <definition class="compliance" id="sshd_banner_set" version="1">
>     <metadata>
>       <title>Enable a Warning Banner</title>
>       <affected family="unix">
>         <platform>Red Hat Enterprise Linux 6</platform>
>       </affected>
>       <description>SSH warning banner should be enabled (and dependencies
> are
>       met)</description>
>       <reference source="MED" ref_id="20130813" ref_url="test_attestation"
> />
>     </metadata>
>     <criteria comment="SSH is not being used or conditions are met"
>     operator="OR">
>       <extend_definition comment="sshd service is disabled"
>       definition_ref="service_sshd_disabled" />
>       <criterion comment="Check Banner in /etc/ssh/sshd_config"
>       test_ref="test_sshd_banner_set" />
>     </criteria>
>   </definition>
>   <ind:textfilecontent54_test check="all" check_existence="all_exist"
>   comment="Tests the value of the Banner[\s]+/etc/issue setting in the
> /etc/ssh/sshd_config file"
>   id="test_sshd_banner_set" version="1">
>     <ind:object object_ref="obj_sshd_banner_set" />
>   </ind:textfilecontent54_test>
>   <ind:textfilecontent54_object id="obj_sshd_banner_set" version="1">
>     <ind:path>/etc/ssh</ind:path>
>     <ind:filename>sshd_config</ind:filename>
>     <ind:pattern operation="pattern
> match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
>
>     <ind:instance datatype="int">1</ind:instance>
>   </ind:textfilecontent54_object>
> </def-group>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/18b92fb3/attachment.html>


More information about the scap-security-guide mailing list