Current false positve list
Shawn Wells
shawn at redhat.com
Mon Sep 16 04:03:47 UTC 2013
On 9/12/13 2:51 PM, leam hall wrote:
> Using the oscap from openscap 0.9.3-1 and the ssg content fresh from
> the repo (0.1-12) I ran:
>
> oscap xccdf eval --profile stig-rhel6-server --results
> `hostname`-ssg-results.xml --report `hostname`-ssg-results.html --cpe
> /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
>
> on my server. The output gave me stuff to work on and what seems to be
> a list of false positives. I have not found these items in the STIG.
> Could someone point me to them, or can we remove them from the scan if
> they are not present?
>
> I'm looking at the git repo but having issues with builds. So some of
> these might already be fixed.
>
> Thanks!
>
> Leam
>
> #####
>
> Configure auditd admin_space_left Action on Low Disk Space
> Disable IPv6 Networking Support Automatic Loading
> Disable Kernel Parameter for Accepting ICMP Redirects By Default
> Disable Kernel Parameter for Accepting Secure Redirects By Default
> Disable Kernel Parameter for Accepting Secure Redirects for All
> Interfaces
> Disable Kernel Parameter for Sending ICMP Redirects by Default
> Disable Modprobe Loading of USB Storage Driver
> Ensure All Files Are Owned by a Group
> Ensure All Files Are Owned by a User
> Ensure auditd Collects Unauthorized Access Attempts to Files
> (unsuccessful)
> Ensure SELinux State is Enforcing
> Implement Blank Screen Saver
> Record Events that Modify User/Group Information
> Set SSH Client Alive Count
DISA FSO wanted to retitle some of the rules, e.g. "Ensure All Files Are
Owner by a Group" they wanted to be a declarative "All Files Must be
Owned by a Group"
Within the content, we map back to the raw DISA CCI requirements through
the <ref disa=""> tags. To pull them out:
1) Find what XCCDF file/rule things map back to, e.g.:
> [shawn at SSG-RHEL6 input]$ pwd
> /var/www/html/scap-security-guide/RHEL6/input
> [shawn at SSG-RHEL6 input]$ grep -rin "Ensure SELinux State is Enforcing" *
> system/selinux.xml:107:<title>Ensure SELinux State is Enforcing</title>
2) Open the file, find the <ref> tag, to identify the DISA CCI:
> <Rule id="set_selinux_state" severity="medium">
> .......
> <ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32,26"/>
> <tested by="DS" on="20121024"/>
> </Rule>
So, in this case, "Ensure SELinux State is Enforcing" maps to DISA CCI's
22, 32, and 26.
More information about the scap-security-guide
mailing list