Anyone using rhel6 ssg for centos6?

Simon Lukasik slukasik at redhat.com
Tue Jul 1 11:05:10 UTC 2014


On 06/18/2014 03:41 PM, Rui Pedro Bernardino wrote:
> … it seems OpenSCAP is using it’s own ‘openscap-cpe-dict.xml’ and that’s
> why the SSG platform check “works”. The checks in
> ‘ssg-rhel6-cpe-dictionary.xml’ fail always.
>

Hello,

I am sorry for the late response, but I would like to put a bit of light 
into this.

OpenSCAP uses its inbuilt CPE dictionary when the CPE is not provided 
from the outside. This behavior is in line with SCAP requirements for 
certified scanner.

If you are not satisfied with inbuilt CPE name you may need to specify 
--cpe command-line option to the scanner.

For review of inbuilt CPE names run:

     # oscap --version

In OpenSCAP upstream we try to give good guidance on: how a particular 
CPE name shall be implemented [1]. We welcome comments, patches, as well 
as implementation of new platforms.

I remember, I have recently added CPE names for CentOS 5, 6, and 7. 
However, I am unsure whether this new names are been released to the 
downstreams.

[1]: OpenSCAP upstream implementation of selected CPE names: 
https://git.fedorahosted.org/cgit/openscap.git/tree/cpe/openscap-cpe-oval.xml

Best regards,

-- 
Simon Lukasik
Security Technologies, Red Hat, Inc.


More information about the scap-security-guide mailing list