EXTERNAL: Re: scan question

Shawn Wells shawn at redhat.com
Mon Sep 30 02:40:39 UTC 2013


On 9/29/13 10:16 PM, Shawn Wells wrote:
> On 9/27/13 6:11 PM, Kordell, Luke T wrote:
>> Thank you for responding!  I'm actually getting a bunch of unlinked files in my output directory.
> The Make process involves several iterative XSLT transforms, which 
> generate the unlinked-* files. If you're looking for something usable, 
> they can be completely ignored.
>
> The final content is reflected in the ssg-rhel6-* files under the 
> output/ directory after you do a 'make content'.  Alternatively, you 
> could do a 'make dist' which may be easier to consume:
>
> [shawn at SSG-RHEL6 RHEL6]$ pwd
> /var/www/html/scap-security-guide/RHEL6
>
> [shawn at SSG-RHEL6 RHEL6]$ make dist
> /...... build process runs ...../
>
> [shawn at SSG-RHEL6 RHEL6]$ ll dist/
> total 12
> drwxrwxr-x. 2 shawn shawn 4096 Sep 29 22:06 content
> drwxrwxr-x. 2 shawn shawn 4096 Sep 29 22:06 guide
> drwxrwxr-x. 2 shawn shawn 4096 Sep 29 22:06 policytables
> [shawn at SSG-RHEL6 RHEL6]$ ll dist/content/
> total 1892
> -rw-rw-r--. 1 shawn shawn     600 Sep 29 22:07 
> ssg-rhel6-cpe-dictionary.xml
> -rw-rw-r--. 1 shawn shawn    3640 Sep 29 22:07 ssg-rhel6-cpe-oval.xml
> -rw-rw-r--. 1 shawn shawn  751809 Sep 29 22:07 ssg-rhel6-oval.xml
> -rw-rw-r--. 1 shawn shawn 1172552 Sep 29 22:07 ssg-rhel6-xccdf.xml
>
>
>> Should the usgcb file be usgcb-rhel6-server-xccdf.xml?
> The profile will be included within ssg-rhel6-xccdf.xml. You could 
> verify that by grepping the ssg-rhel6-xccdf.xml file:
> $ grep "<Profile" output/ssg-rhel6-xccdf.xml
>    <Profile id="test">
>    <Profile id="CS2">
>    <Profile id="common">
>    <Profile id="desktop">
>    <Profile id="server">
>    <Profile id="ftp">
>    <Profile id="stig-rhel6-server">
>    <Profile id="usgcb-rhel6-server">
>
>
> Note that the USGCB is *very* rough and does not [yet] reflect a 
> comprehensive profile. But if people are willing to test it, then it 
> makes sense to begin including it... lemme whip up a patch....

Created a patch to add USGCB to the build process.... if ACK'd, you'll 
be able to just do:

> oscap xccdf eval --profile usgcb-rhel6-server \
> --results /var/www/html/ssg-results/results.xml \
> --report /var/www/html/ssg-results/report.html \
> --cpe-dict ssg-rhel6-cpe-dictionary.xml \
> ssg-rhel6-xccdf.xml

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130929/5a11167b/attachment.html>


More information about the scap-security-guide mailing list