Anyone using rhel6 ssg for centos6?

Greg Elin gregelin at gitmachines.com
Thu Aug 14 20:46:51 UTC 2014


I would like to start this thread up again.

Any good Urls to explanations on all this is appreciated!

I'm about to spend the rest of the day trying to understand CPE and why I
was able to get results scanning CentOS 6.5 on one AMI I configured back in
Jan/Feb without rebuilding the source but and now getting "not applicable"
across the board for CentOS 6.5. (I may have git cloned the Fedora Repo in
Jan/Feb while I am using EPEL repos more recently.)

My plan is to examine the respective installs, read whatever docs I can
find, and look at NIST SP 800-126 (the SCAP spec -
http://csrc.nist.gov/publications/nistpubs/800-126-rev2/SP800-126r2.pdf).

Help in anyway to speed me on my journey is appreciated!

Greg Elin
http://govready.org - Making FISMA compliance easier for innovators

email: gregelin at gitmachines.com
phone: 917-304-3488






On Thu, Jul 3, 2014 at 11:35 AM, Stuart Green <stuart.green at doccentrics.com>
wrote:

>
>  ----- Original Message -----
>>
>>> From: "Stuart Green" <stuart.green at doccentrics.com>
>>> To: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
>>> Sent: Wednesday, July 2, 2014 2:54:57 PM
>>> Subject: Re: Anyone using rhel6 ssg for centos6?
>>>
>>>
>>>
>>>  ----- Original Message -----
>>>>
>>>>> From: "Simon Lukasik" <slukasik at redhat.com>
>>>>> To: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
>>>>> Sent: Tuesday, July 1, 2014 1:05:10 PM
>>>>> Subject: Re: Anyone using rhel6 ssg for centos6?
>>>>>
>>>>> On 06/18/2014 03:41 PM, Rui Pedro Bernardino wrote:
>>>>>
>>>>>> … it seems OpenSCAP is using it’s own ‘openscap-cpe-dict.xml’ and
>>>>>> that’s
>>>>>> why the SSG platform check “works”. The checks in
>>>>>> ‘ssg-rhel6-cpe-dictionary.xml’ fail always.
>>>>>>
>>>>>>  Hello,
>>>>>
>>>>> I am sorry for the late response, but I would like to put a bit of
>>>>> light
>>>>> into this.
>>>>>
>>>>> OpenSCAP uses its inbuilt CPE dictionary when the CPE is not provided
>>>>> from the outside. This behavior is in line with SCAP requirements for
>>>>> certified scanner.
>>>>>
>>>>> If you are not satisfied with inbuilt CPE name you may need to specify
>>>>> --cpe command-line option to the scanner.
>>>>>
>>>>> For review of inbuilt CPE names run:
>>>>>
>>>>>        # oscap --version
>>>>>
>>>>> In OpenSCAP upstream we try to give good guidance on: how a particular
>>>>> CPE name shall be implemented [1]. We welcome comments, patches, as
>>>>> well
>>>>> as implementation of new platforms.
>>>>>
>>>>> I remember, I have recently added CPE names for CentOS 5, 6, and 7.
>>>>> However, I am unsure whether this new names are been released to the
>>>>> downstreams.
>>>>>
>>>> This is the commit in question:
>>>>
>>>> https://git.fedorahosted.org/cgit/openscap.git/commit/?id=
>>>> e09f29496081a0525cda0b18299bccb9803baf76
>>>>
>>>> It is part of the master branch, there have been no releases that
>>>> contain
>>>> it yet. The next release with this change will be openscap 1.1.0. This
>>>> commit may be a good candidate for a downstream patch in the CentOS
>>>> package.
>>>>
>>>>  Yes please!!
>>>
>> Please lobby at the appropriate place - https://bugs.centos.org
>>
> To clarify, you're asking me to raise a request detailing Simon's commit
> on bugs.centos.org?
>
>
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140814/f4f45f04/attachment-0001.html>


More information about the scap-security-guide mailing list