Anyone using rhel6 ssg for centos6?
Simon Lukasik
slukasik at redhat.com
Tue Jul 1 11:05:10 UTC 2014
On 06/18/2014 03:41 PM, Rui Pedro Bernardino wrote:
> … it seems OpenSCAP is using it’s own ‘openscap-cpe-dict.xml’ and that’s
> why the SSG platform check “works”. The checks in
> ‘ssg-rhel6-cpe-dictionary.xml’ fail always.
>
Hello,
I am sorry for the late response, but I would like to put a bit of light
into this.
OpenSCAP uses its inbuilt CPE dictionary when the CPE is not provided
from the outside. This behavior is in line with SCAP requirements for
certified scanner.
If you are not satisfied with inbuilt CPE name you may need to specify
--cpe command-line option to the scanner.
For review of inbuilt CPE names run:
# oscap --version
In OpenSCAP upstream we try to give good guidance on: how a particular
CPE name shall be implemented [1]. We welcome comments, patches, as well
as implementation of new platforms.
I remember, I have recently added CPE names for CentOS 5, 6, and 7.
However, I am unsure whether this new names are been released to the
downstreams.
[1]: OpenSCAP upstream implementation of selected CPE names:
https://git.fedorahosted.org/cgit/openscap.git/tree/cpe/openscap-cpe-oval.xml
Best regards,
--
Simon Lukasik
Security Technologies, Red Hat, Inc.
More information about the scap-security-guide
mailing list