scan question

Shawn Wells shawn at redhat.com
Fri Sep 27 02:29:42 UTC 2013


On 9/26/13 1:16 PM, Kordell, Luke T wrote:
> Hello,.
>
>       I recently downloaded the SCAP source code and noticed there were some additional profiles listed in the profiles folder. How can I run a scan against these profiles?  For instance wen trying to run a scan against the usgcb-rhel6-server.xml (after successfully using oscap xccdf validate) I get an "unknown document type" error. I think this is because I'm using the stig profile and the ssg cpe dictionary. If so how can I add a usgcb profile and cpe dictionary to successfully scan against this profile?
>
> Thank you for the help.
Good question!

There are a few profiles in the RHEL6/input/profiles/ directory which 
are still being completed, for example the FISMA, and a few which likely 
should be deleted (e.g. desktop).

To list out which profiles are compiled in:
> $ grep "<Profile" output/ssg-rhel6-xccdf.xml
>   <Profile id="test">
>   <Profile id="CS2">
>   <Profile id="common">
>   <Profile id="desktop">
>   <Profile id="server">
>   <Profile id="ftp">
>   <Profile id="stig-rhel6-server">


Profile definitions from RHEL6/input/profiles/ are merged into the build 
process through the RHEL6/input/guide.xslt file:
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/guide.xslt

Since you're cloning the source (which is great!), I'll wager you're 
comfortable editing things. If you'd like to check out the (in progress) 
USGCB, add a line where you see the other apply-templates:
> |<xsl:apply-templates select="document('profiles/||usgcb-rhel6-server.xml')" />|

 From there, re-run 'make content' in the RHEL6 directory and you'll see 
an updated XCCDF in the output/ directory

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130926/afb00d65/attachment-0001.html>


More information about the scap-security-guide mailing list