Various False Positives?

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 3 16:17:17 UTC 2013


Huh, OK. I don't think that's what's going wrong here, since Shawn is 
talking about the content of /etc/issue (and since everyone is using the 
same interpreter), but I can go ahead and remove them from the small 
handful of checks that use it.

- Maura Dailey

On 09/03/2013 12:14 PM, Shane Shaffer wrote:
> Modifier spans like (?i) and (?-i) aren't supported in OVAL, though 
> they will probably work in some interpreters depending on the regex 
> implementation.
> Shane Shaffer
> G2, Inc.
> shane.shaffer at g2-inc.com <mailto:shane.shaffer at g2-inc.com>
>
>
> On Tue, Sep 3, 2013 at 11:49 AM, Maura Dailey <maura at eclipse.ncsc.mil 
> <mailto:maura at eclipse.ncsc.mil>> wrote:
>
>>>             240  /etc/ssh/sshd_config Banner
>>>             The OVAL check was definitely working on my system when
>>>             I last tested it. I'm able to reproduce...
>>>
>>>             [root at rhel6 checks]# cat /etc/issue
>>>             You are accessing a U.S. Government (USG) Information
>>>             System (IS) that is provided for USG-authorized use
>>>             only. By using this IS (which includes any device
>>>             attached to this IS), you consent to the following
>>>             conditions:
>>>             -The USG routinely intercepts and monitors
>>>             communications on this IS for purposes including, but
>>>             not limited to, penetration testing, COMSEC monitoring,
>>>             network operations and defense, personnel misconduct
>>>             (PM), law enforcement (LE), and counterintelligence (CI)
>>>             investigations.
>>>             -At any time, the USG may inspect and seize data stored
>>>             on this IS.
>>>             -Communications using, or data stored on, this IS are
>>>             not private, are subject to routine monitoring,
>>>             interception, and search, and may be disclosed or used
>>>             for any USG-authorized purpose.
>>>             -This IS includes security measures (e.g.,
>>>             authentication and access controls) to protect USG
>>>             interests -- not for your personal benefit or privacy.
>>>             -Notwithstanding the above, using this IS does not
>>>             constitute consent to PM, LE or CI investigative
>>>             searching or monitoring of the content of privileged
>>>             communications, or work product, related to personal
>>>             representation or services by attorneys,
>>>             psychotherapists, or clergy, and their assistants. Such
>>>             communications and work product are private and
>>>             confidential. See User Agreement for details.
>>>
>>>             [root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
>>>             Evaluating with OVAL tempfile :
>>>             /tmp/sshd_banner_setXKCJxI.xml
>>>             Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
>>>             Definition oval:scap-security-guide.testing:def:193: false
>>>             Definition oval:scap-security-guide.testing:def:191: false
>>>             Definition oval:scap-security-guide.testing:def:190: false
>>>             Evaluation done.
>>>
>>>             Maura, do you want to take a stab at this (noticed your
>>>             signoff on the OVAL)?
>>>
>>>             FWIW, if I used the USGCB banner everything worked OK.
>>>
>
>     The ONLY thing the check is doing is checking that the line
>     'Banner /etc/issue' exists in /etc/ssh/sshd_config or that sshd is
>     disabled. It doesn't care about the content of /etc/issue at all.
>     I have no idea why it's failing for both of you guys. Full check
>     is below my signature for comparison.
>
>     - Maura Dailey
>
>     <def-group>
>       <definition class="compliance" id="sshd_banner_set" version="1">
>         <metadata>
>           <title>Enable a Warning Banner</title>
>           <affected family="unix">
>             <platform>Red Hat Enterprise Linux 6</platform>
>           </affected>
>           <description>SSH warning banner should be enabled (and
>     dependencies are
>           met)</description>
>           <reference source="MED" ref_id="20130813"
>     ref_url="test_attestation" />
>         </metadata>
>         <criteria comment="SSH is not being used or conditions are met"
>         operator="OR">
>           <extend_definition comment="sshd service is disabled"
>           definition_ref="service_sshd_disabled" />
>           <criterion comment="Check Banner in /etc/ssh/sshd_config"
>           test_ref="test_sshd_banner_set" />
>         </criteria>
>       </definition>
>       <ind:textfilecontent54_test check="all" check_existence="all_exist"
>       comment="Tests the value of the Banner[\s]+/etc/issue setting in
>     the /etc/ssh/sshd_config file"
>       id="test_sshd_banner_set" version="1">
>         <ind:object object_ref="obj_sshd_banner_set" />
>       </ind:textfilecontent54_test>
>       <ind:textfilecontent54_object id="obj_sshd_banner_set" version="1">
>         <ind:path>/etc/ssh</ind:path>
>         <ind:filename>sshd_config</ind:filename>
>         <ind:pattern operation="pattern
>     match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
>
>         <ind:instance datatype="int">1</ind:instance>
>       </ind:textfilecontent54_object>
>     </def-group>
>
>     _______________________________________________
>     scap-security-guide mailing list
>     scap-security-guide at lists.fedorahosted.org
>     <mailto:scap-security-guide at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/7aedda37/attachment-0001.html>


More information about the scap-security-guide mailing list