Anyone using rhel6 ssg for centos6?

Trey Henefield trey.henefield at ultra-ats.com
Wed Jun 18 16:04:05 UTC 2014


You are correct sir. It does support Res, but apparently it is picky when evaluating them in the way it was defined.

Here is one more change that I have verified does ensure it gets detected on RHEL 6. CentOS 6 support should still be intact.

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com

From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Rui Pedro Bernardino
Sent: Wednesday, June 18, 2014 10:33 AM
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

My point with your initial CentOS suggestion is that it should work, but it doesn’t because SSG RHEL’s CPEs are broken.

This version works perfectly on CentOS but gets an error on RHEL:
<system_data>
          <lin-sys:rpminfo_item id="1069901" status="error">
            <lin-sys:name>redhat-release-(?:workstation|server)</lin-sys:name>
          </lin-sys:rpminfo_item>
</system_data>

Can you use REs in the rpminfo object name?


From: scap-security-guide-bounces at lists.fedorahosted.org<mailto:scap-security-guide-bounces at lists.fedorahosted.org> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Trey Henefield
Sent: quarta-feira, 18 de Junho de 2014 15:59
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

Yes, I don’t have CentOS 6 installed so I couldn’t verify, but from looking at the package on their site, it appeared as if the version indicated would work.

I am not sure about how the openscap software itself resolves CPE entries, or if it does at all. But from creating other SSGs, it has been my experience that you could pretty much define any CPE name. The key is in the cpe-oval check it is attached to by the cpe-dictionary.

The previous change I did will remove support for Red Hat.

Here is an updated file that should allow being used for both Red Hat 6 and CentOS 6.

Best regards,


Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com<mailto:Trey.Henefield at ultra-ats.com>
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com<http://www.ultra-ats.com>

From: scap-security-guide-bounces at lists.fedorahosted.org<mailto:scap-security-guide-bounces at lists.fedorahosted.org> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Rui Pedro Bernardino
Sent: Wednesday, June 18, 2014 9:39 AM
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

I’m also building from the GIT version.

Anyway, using your file:
# cat /etc/redhat-release
CentOS release 6.2 (Final)
# oscap oval eval --results ssg-rhel6-cpe-oval.results.xml ssg-rhel6-cpe-oval.xml
Definition oval:ssg:def:100: false
Evaluation done.

When I edit the file and replace
<linux:version operation="pattern match">^6\.\d+$</linux:version>
by
<linux:version operation="pattern match">^6</linux:version>

And re-run:
# oscap oval eval --results ssg-rhel6-cpe-oval.results.xml ssg-rhel6-cpe-oval.xml
Definition oval:ssg:def:100: true
Evaluation done.

Also have a look at the end of  “ssg-rhel6-cpe-oval.results.xml”. “lin-sys:version” is “6” not “6.2”.

SSG’s platform check doesn’t work on Red Hat either; using scap-security-guid/RHEL/6/dist/content:
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.5 (Santiago)
# oscap oval eval  ssg-rhel6-cpe-oval.xml
Definition oval:ssg:def:100: false
Evaluation done.

And it will work if I edit the “pattern match” as on CentOS.

I think the platform CPE get defined through OpenSCAP’s CPE OVAL, not SSG’s. Just try move /usr/share/openscap/cpe/openscap-cpe-dict.xml to something else and try to run a xccdf eval.

Or am I messing things up?

Best regards

From: scap-security-guide-bounces at lists.fedorahosted.org<mailto:scap-security-guide-bounces at lists.fedorahosted.org> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Trey Henefield
Sent: quarta-feira, 18 de Junho de 2014 15:04
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

Ah, this is because you are using the prebuilt release package which has slightly different checks than what is on the trunk.

Try the attached file in place of you existing one.

The prebuilt package looks for redhat-release-workstation and redhat-release-server packages.

CentOS does not offer these similar packages. So instead I modified both of those to indicate centos-release, which is a valid package. Versioning should match up as is.

That is all that is needed.

I would not go any further as to create new checks inside the prebuilt package as this may mess up the numbering schema for all the checks created when the SSG package is built.

However, a check could easily be added in the source location I previously mentioned to also accept CentOS 6 as a valid target. Or a new CentOS6 check could be added as described and referenced in the CPE dictionary:

scap-security-guide\RHEL\6\input\checks\platform\rhel6-cpe-dictionary.xml

Best regards,


Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com<mailto:Trey.Henefield at ultra-ats.com>
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com<http://www.ultra-ats.com>

From: scap-security-guide-bounces at lists.fedorahosted.org<mailto:scap-security-guide-bounces at lists.fedorahosted.org> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Rui Pedro Bernardino
Sent: Wednesday, June 18, 2014 7:21 AM
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?

It requires an extra hack because ‘version’ on CentOS won’t match the specified pattern; here is how I did it to keep it compatible with RHEL:
  1. Add an extra criterion:
      <criteria operator="OR">
        <criterion comment="Red Hat Enterprise Linux 6 Workstation is installed" test_ref="test_rhel_workstation" />
        <criterion comment="Red Hat Enterprise Linux 6 Server is installed"      test_ref="test_rhel_server" />
        <criterion comment="CentOS 6 is installed"                               test_ref="test_centos" />
      </criteria>
2. Add an extra test:
  <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="test_centos" version="1">
    <linux:object object_ref="obj_centos" />
    <linux:state state_ref="state_centos" />
  </linux:rpminfo_test>
  <linux:rpminfo_state id="state_centos" version="1">
    <linux:version operation="pattern match">^6</linux:version>
  </linux:rpminfo_state>
  <linux:rpminfo_object id="obj_centos" version="1">
    <linux:name>centos-release</linux:name>
  </linux:rpminfo_object>


Another weirder issue on the original SSG check: I don’t think this check works on ‘pure’ RHEL6 either but the platform still matches for some reason I do not understand.

When I use ‘—oval-results’, the CPE result file (ssg-rhel6-cpe-oval.xml.result.xml), the test_rhel_* tests all fail for the same reason, i.e:
<lin-sys:version>6Server</lin-sys:version>
Won’t match:
<lin-def:version operation="pattern match">^6\.\d+$</lin-def:version>

Thus resulting in ‘false’ for test_rhel_server:
<test test_id="oval:ssg:tst:103" version="1" check="all" result="false">
   <tested_item item_id="1046111" result="false"/>
</test>

and consequently for installed_OS_is_rhel6:
<definition definition_id="oval:ssg:def:100" result="false" version="1">

But the definition still works ok, although it doesn’t on CentOS… What am I getting wrong were?

Thanks!



From: scap-security-guide-bounces at lists.fedorahosted.org<mailto:scap-security-guide-bounces at lists.fedorahosted.org> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Trey Henefield
Sent: quarta-feira, 18 de Junho de 2014 12:31
To: SCAP Security Guide
Subject: RE: Anyone using rhel6 ssg for centos6?



The check for Red Hat 6 is pulled from:

scap-security-guide\RHEL\6\input\checks\installed_OS_is_rhel6.xml

Simply change the two references to 'redhat-release' to state 'centos-release' instead. Then rebuild.

That should do it.

Best regards,


Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com<mailto:Trey.Henefield at ultra-ats.com>
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com<http://www.ultra-ats.com>

-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org<mailto:scap-security-guide-bounces at lists.fedorahosted.org> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Pettorino, Jeffrey D CTR USAF USAFA USAFA/DFAN
Sent: Tuesday, June 17, 2014 4:01 PM
To: 'scap-security-guide at lists.fedorahosted.org'
Subject: Anyone using rhel6 ssg for centos6?

I have been trying to get oscap working on my CentOS6.5 network core, without luck.

Everything comes back with "Result notapplicable".

I am pretty new to SCAP and XCCDF, but am a long-time user of Nessus and Security Center (prior to ACAS program by DISA).

Does anyone have suggestions where I can find some in depth guidance to adjust the rhel6 configs to CentOS?

--
Jeff

v/r,
Jeffrey D. Pettorino, GCIH, CISSP
Systems Engineer
High Performance Computing Research Center United States Air Force Academy Jeffrey.Pettorino.ctr at USAFA.edu<mailto:Jeffrey.Pettorino.ctr at USAFA.edu>
719/333-9391
----
The use of the Unix philosophy just for UNIX was a great waste.
Fortunately, Linux came along.
- Bellevue Linux User Group member, 2005

Disclaimer
The information contained in this communication from trey.henefield at ultra-ats.com<mailto:trey.henefield at ultra-ats.com> sent at 2014-06-18 07:30:57 is private and may be legally privileged or export controlled. It is intended solely for use by scap-security-guide at lists.fedorahosted.org<mailto:scap-security-guide at lists.fedorahosted.org> and others authorized to receive it. If you are not scap-security-guide at lists.fedorahosted.org<mailto:scap-security-guide at lists.fedorahosted.org> you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140618/ecc03010/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ssg-rhel6-cpe-oval.xml
Type: application/xml
Size: 3709 bytes
Desc: ssg-rhel6-cpe-oval.xml
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140618/ecc03010/attachment-0001.wsdl>


More information about the scap-security-guide mailing list