SCC (UNCLASSIFIED)
Shaw, Ray V CTR USARMY ARL (US)
ray.v.shaw.ctr at mail.mil
Fri May 9 14:37:47 UTC 2014
Classification: UNCLASSIFIED
Caveats: NONE
> -----Original Message-----
> From: Jan Lieskovsky [mailto:jlieskov at redhat.com]
> Sent: Friday, May 09, 2014 9:45 AM
> To: Shaw, Ray V CTR USARMY ARL (US)
> Cc: SCAP Security Guide
> Subject: Re: SCC (UNCLASSIFIED)
>
> Hello Ray,
>
> thank you for checking with us.
>
> ----- Original Message -----
> > From: "Ray V CTR USARMY ARL Shaw (US)" <ray.v.shaw.ctr at mail.mil>
> > To: scap-security-guide at lists.fedorahosted.org
> > Sent: Friday, May 9, 2014 3:28:18 PM
> > Subject: SCC (UNCLASSIFIED)
> >
> > Classification: UNCLASSIFIED
> > Caveats: NONE
> >
> > I remember that there were issues with the SSG content and RHEL6 (due
> > to SCC not supporting a sufficient version of...XCCDF? SCAP?). But
> > previously, I could still use SCC with the SSG content; it would just
> > generate a few more false positives than using OpenSCAP. Admittedly,
> > it has been a while since I tried.
> >
> > Now, when trying SCC 3.1.2, I can't make it run at all. After
> > importing the zip file (generated from git) and selecting the
> > stig-rhel6-server-upstream profile, a scan finishes almost
> immediately with:
> >
> > The SCAP content stream <ssg-rhel6-> is not applicable to this
> > platform per the CPE definitions
> >
> > I've tried on both RHEL6 Workstation and Server, and I've also tried
> > stripping the <platform> information from the XML files.
> >
> > I'm attempting this for two reasons, as otherwise I'm perfectly happy
> > scanning with OpenSCAP. SCC has the ability to run a check on a
> > single rule at a time, which is useful. Also, I have an inspection
> > soon, and they may want me to use it.
>
> Does SCC have a possibility to check just one OVAL definition? If so,
> could you try to run the SCC alternative to the following OpenSCAP
> command and let us know it's output:?
>
> # oscap oval eval --id oval:ssg:def:100 ssg-rhel6-oval.xml
>
> The oval:ssg:def:100 definition checks if the installed version of the
> OS is
> RHEL-6 (above evaluation returns true with OpenSCAP on RHEL-6).
>
> So wondering if the not applicable problem can't come from different
> evaluation of this rule. Also, have you tried to explicitly provide
> RHEL-6 CPE file
> (ssg-rhel6-cpe-dictionary.xml) to SCC? Still the same output?
Unfortunately, as far as I can tell, SCC only has an option to evaluate a
single XCCDF rule (and then only from the command line). Which is usually
what I want! But of course, not right now. The command you provided returns
true with OpenSCAP for me as well.
I don't really see a way to specify ssg-rhel6-cpe-dictionary.xml. Basically,
it lets you import SCAP, OVAL, or OCIL content and then do a limited amount of
things with that. When I imported the SSG zip as SCAP, it copied all files to
its Resources/Content directory, but only really lets me interact with the
XCCDF (selecting a stream and running a scan).
I did try to import the OVAL file directly, enable it, and run a scan with it,
but I don't think that was an expected thing to do:
[ERROR] Could not find the external variables file for "ssg-rhel6-oval".
I'll have to see if the XML results generated by an OpenSCAP scan work with
the "next in line" set of tools (STIG viewer, etc.) I seem to recall that
being an issue before, but if it works, then maybe that will be fine. I can
live without the ability to run a single XCCDF check (though it would be super
great if OpenSCAP had this).
--
Ray Shaw (Contractor, STG)
Army Research Laboratory
CIO, Unix Support
Classification: UNCLASSIFIED
Caveats: NONE
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5621 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140509/3177e726/attachment.bin>
More information about the scap-security-guide
mailing list