Various False Positives?
Maura Dailey
maura at eclipse.ncsc.mil
Tue Sep 3 16:17:17 UTC 2013
Huh, OK. I don't think that's what's going wrong here, since Shawn is
talking about the content of /etc/issue (and since everyone is using the
same interpreter), but I can go ahead and remove them from the small
handful of checks that use it.
- Maura Dailey
On 09/03/2013 12:14 PM, Shane Shaffer wrote:
> Modifier spans like (?i) and (?-i) aren't supported in OVAL, though
> they will probably work in some interpreters depending on the regex
> implementation.
> Shane Shaffer
> G2, Inc.
> shane.shaffer at g2-inc.com <mailto:shane.shaffer at g2-inc.com>
>
>
> On Tue, Sep 3, 2013 at 11:49 AM, Maura Dailey <maura at eclipse.ncsc.mil
> <mailto:maura at eclipse.ncsc.mil>> wrote:
>
>>> 240 /etc/ssh/sshd_config Banner
>>> The OVAL check was definitely working on my system when
>>> I last tested it. I'm able to reproduce...
>>>
>>> [root at rhel6 checks]# cat /etc/issue
>>> You are accessing a U.S. Government (USG) Information
>>> System (IS) that is provided for USG-authorized use
>>> only. By using this IS (which includes any device
>>> attached to this IS), you consent to the following
>>> conditions:
>>> -The USG routinely intercepts and monitors
>>> communications on this IS for purposes including, but
>>> not limited to, penetration testing, COMSEC monitoring,
>>> network operations and defense, personnel misconduct
>>> (PM), law enforcement (LE), and counterintelligence (CI)
>>> investigations.
>>> -At any time, the USG may inspect and seize data stored
>>> on this IS.
>>> -Communications using, or data stored on, this IS are
>>> not private, are subject to routine monitoring,
>>> interception, and search, and may be disclosed or used
>>> for any USG-authorized purpose.
>>> -This IS includes security measures (e.g.,
>>> authentication and access controls) to protect USG
>>> interests -- not for your personal benefit or privacy.
>>> -Notwithstanding the above, using this IS does not
>>> constitute consent to PM, LE or CI investigative
>>> searching or monitoring of the content of privileged
>>> communications, or work product, related to personal
>>> representation or services by attorneys,
>>> psychotherapists, or clergy, and their assistants. Such
>>> communications and work product are private and
>>> confidential. See User Agreement for details.
>>>
>>> [root at rhel6 checks]# ./testcheck.py sshd_banner_set.xml
>>> Evaluating with OVAL tempfile :
>>> /tmp/sshd_banner_setXKCJxI.xml
>>> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
>>> Definition oval:scap-security-guide.testing:def:193: false
>>> Definition oval:scap-security-guide.testing:def:191: false
>>> Definition oval:scap-security-guide.testing:def:190: false
>>> Evaluation done.
>>>
>>> Maura, do you want to take a stab at this (noticed your
>>> signoff on the OVAL)?
>>>
>>> FWIW, if I used the USGCB banner everything worked OK.
>>>
>
> The ONLY thing the check is doing is checking that the line
> 'Banner /etc/issue' exists in /etc/ssh/sshd_config or that sshd is
> disabled. It doesn't care about the content of /etc/issue at all.
> I have no idea why it's failing for both of you guys. Full check
> is below my signature for comparison.
>
> - Maura Dailey
>
> <def-group>
> <definition class="compliance" id="sshd_banner_set" version="1">
> <metadata>
> <title>Enable a Warning Banner</title>
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>
> <description>SSH warning banner should be enabled (and
> dependencies are
> met)</description>
> <reference source="MED" ref_id="20130813"
> ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> <extend_definition comment="sshd service is disabled"
> definition_ref="service_sshd_disabled" />
> <criterion comment="Check Banner in /etc/ssh/sshd_config"
> test_ref="test_sshd_banner_set" />
> </criteria>
> </definition>
> <ind:textfilecontent54_test check="all" check_existence="all_exist"
> comment="Tests the value of the Banner[\s]+/etc/issue setting in
> the /etc/ssh/sshd_config file"
> id="test_sshd_banner_set" version="1">
> <ind:object object_ref="obj_sshd_banner_set" />
> </ind:textfilecontent54_test>
> <ind:textfilecontent54_object id="obj_sshd_banner_set" version="1">
> <ind:path>/etc/ssh</ind:path>
> <ind:filename>sshd_config</ind:filename>
> <ind:pattern operation="pattern
> match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> <mailto:scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130903/7aedda37/attachment-0001.html>
More information about the scap-security-guide
mailing list