oscap & jboss on Fedora
Ivan Saez Scheihing
saezscheihing at gmail.com
Fri May 2 11:28:12 UTC 2014
I did reply (to the list) but my email has been retained by the moderator
for three days now. I'll reply directly to you.
On Tue, Apr 29, 2014 at 1:29 PM, Martin Preisler <mpreisle at redhat.com>wrote:
> ----- Original Message -----
> > From: "Ivan Saez Scheihing" <saezscheihing at gmail.com>
> > To: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
> > Sent: Tuesday, April 22, 2014 8:00:39 PM
> > Subject: Re: oscap & jboss on Fedora
> > Martin,
> > I was able to run xccdf and oscan after editing the eap5-xccdf.xml file.
> > did comment out all '<platform idref="cpe:/a:redhat..' lines (5 lines in
> > total).
> > java -jar xccdfexec.jar -result bla.xml --report bla.html --profile
> > eap5_full -c eap5-cpe-oval.xml -C eap5-cpe-dictionary.xl -P eap5_full
> No idea what xccdfexec.jar is. Is it a wrapper around oscap? The arguments
> look familiar.
> > Did run and asked me a lot's of questions. The same questions as can be
> > found in the JBossEAP5_Guide.html document. Based on my answers it
> > generated a few xml files. But am I mistaken or doesn't xccdfexec cheeck
> > anything?
> > Oscap did check some things by it self (by inspecting jboss xml files I
> > supose). I run it with the following options:
> > oscap xccdf eval --results bla.xml --report bla.html --profile eap5-full
> > -cpe eap5-cpe-dictionary.xml eap5-xccdf.xml
> > It generated the bla.html file and most of the checks were done.
> > I did check the Jboss by hand and I think oscap is not very meticulous.
> > Some checks did get the passed status and I'm sure it should have failed.
> > Any comments on this/
> We need more specifics, else I can't comment. Give us a particular rule
> that passed and shouldn't have. Post your xccdf result file, post your oval
> Martin Preisler
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the scap-security-guide