EXTERNAL: Re:

Kordell, Luke T luke.t.kordell at lmco.com
Tue Feb 18 18:41:43 UTC 2014


Hello. 

     I managed to generate the my-results-xccdf.xml file but oscap is still not able to recognize the remediate argument. It gives me a "no such module 'remediate' error. Any idea of what might be causing this? 

Luke 
________________________________________
From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Shawn Wells [shawn at redhat.com]
Sent: Monday, February 17, 2014 12:51 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: EXTERNAL: Re:

On 2/17/14, 1:45 PM, Kordell, Luke T wrote:
> Thank you for the input Shawn. I guess the sites I have been referencing are a little dated. Since we are not imbedding bash in the rule .xml file how do we point oscap toward the script during the remediation phase. I tried passing the --remediate argument to oscap but it gave an "unrecognized option" error.

You may find Šimon Lukašík's blog on OpenSCAP Remediation helpful:
http://isimluk.livejournal.com/3573.html

In short:
$ oscap xccdf eval --result ~/my-results-xccdf.xml
/usr/share/scap/my-policy-xccdf.xml
$ oscap xccdf remediate --results ~/my-results-xccdf.xml
~/my-results-xccdf.xml

> Also, how are the rules pointing to the remediation scripts in the fixes directory if we are no longer using fix tags?
The build process will take all XCCDF rules, look for a bash script
matching the XCCDF rule name, and then create the fix tag in the final
output.

Ref
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/combinefixes.py
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/xccdf-addfixes.xslt

To see this in action:
[shawn at SSG-RHEL6 6]$ pwd
/var/www/html/scap-security-guide/RHEL/6
[shawn at SSG-RHEL6 6]$ make content
[shawn at SSG-RHEL6 6]$ grep -rin "<fix" output/ssg-rhel6-xccdf.xml

..... and then find the line numbers in the output/ssg-rhel6-xccdf.xml file
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list