SCC (UNCLASSIFIED)

Shaw, Ray V CTR USARMY ARL (US) ray.v.shaw.ctr at mail.mil
Mon May 12 19:14:37 UTC 2014


Classification: UNCLASSIFIED
Caveats: NONE

My results were...interesting.  I ran make in the latest git tree to generate 
a zip file, then got the following error when attempting to import it from the 
command line:

bash-4.1# ./cscc -is /home/username/scap-security-guide-0.1.16.zip
Stream ssg-ocilrefs-rhel6- is not a valid stream, therefore will not be 
installed.

None of the content appeared in the menus.  However, when I imported it using 
the GUI, it accepted the content, and I was able to proceed with the remaining 
steps.  They seem very similar to what I've been doing in the GUI, so I wasn't 
surprised when I got similar scan results:

bash-4.1# ./cscc

********************************************************************************
* 
*
*                      SCAP Compliance Checker (SCC) 3.1.2 
*
* 
*
*                                 Developed By 
*
*                        SPAWAR Systems Center Atlantic 
*
* 
*
********************************************************************************
Connecting to HOSTNAME.EXAMPLE.COM...

Stream Version :0.9
Stream:ssg-rhel6
Profile:stig-rhel6-server-upstream
Time:2014-05-12_150548


HOSTNAME.EXAMPLE.COM: Loading ssg-rhel6-cpe-oval.xml
HOSTNAME.EXAMPLE.COM: OVAL Schema Version: 5.10
[ERROR] Invalid content.  No OVAL object value found for package 'NAME'.
    Target System:       HOSTNAME.EXAMPLE.COM
    Selected Profile:    stig-rhel6-server-upstream
    Stream Name:         ssg-rhel6-
    Stream Version:      0.9
    Stream Date:         2014-05-12
    SCAP Stream:         ssg-rhel6
    Profile ID:          stig-rhel6-server-upstream
    Definition ID:       oval:ssg:def:100
    Test ID:             oval:ssg:tst:3135
    Object ID:           oval:ssg:obj:3136
HOSTNAME.EXAMPLE.COM: Saving 
HOSTNAME.EXAMPLE.COM_SCC-3.1.2_2014-05-12_150548_OVAL-CPE-Results_ssg-rhel6.xml
HOSTNAME.EXAMPLE.COM: Loading ssg-rhel6-cpe-dictionary.xml
HOSTNAME.EXAMPLE.COM: The SCAP content stream <ssg-rhel6-> is not applicable 
to this platform per the CPE definitions

Total Errors: 1
Total Warnings: 0
Review complete.
Results, if any, are located in the following directory:
/home/username/SCC/Results

Logs, if any, are located in the following directory:
/home/username/SCC/Logs

--
Ray Shaw (Contractor, STG)
Army Research Laboratory
CIO, Unix Support


> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-
> security-guide-bounces at lists.fedorahosted.org] On Behalf Of Shawn Wells
> Sent: Monday, May 12, 2014 12:34 PM
> To: scap-security-guide at lists.fedorahosted.org
> Subject: Re: SCC (UNCLASSIFIED)
>
>
> On 5/9/14, 9:28 AM, Shaw, Ray V CTR USARMY ARL (US) wrote:
> > Classification: UNCLASSIFIED
> > Caveats: NONE
> >
> > I remember that there were issues with the SSG content and RHEL6 (due
> > to SCC not supporting a sufficient version of...XCCDF?  SCAP?).  But
> > previously, I could still use SCC with the SSG content; it would just
> > generate a few more false positives than using OpenSCAP.  Admittedly,
> > it has been a while since I tried.
> >
> > Now, when trying SCC 3.1.2, I can't make it run at all.  After
> > importing the zip file (generated from git) and selecting the
> > stig-rhel6-server-upstream profile, a scan finishes almost
> immediately with:
> >
> > 	The SCAP content stream <ssg-rhel6-> is not applicable to this
> > platform per the CPE definitions
> >
> > I've tried on both RHEL6 Workstation and Server, and I've also tried
> > stripping the <platform> information from the XML files.
> >
> > I'm attempting this for two reasons, as otherwise I'm perfectly happy
> > scanning with OpenSCAP.  SCC has the ability to run a check on a
> > single rule at a time, which is useful.  Also, I have an inspection
> > soon, and they may want me to use it.
>
> Through feedback and active dialog with SPAWAR, we wrote a quick "SCC
> Usage" guide back in Nov 2013 [1]. Could you give it a skim, and if
> you're still having problems, I'll download a copy of the latest SCC
> and see if I can duplicate. The existing docs were written against SCC
> 3.1 RC2, so in theory there should be minimal differences against the
> GA
> release:
> http://people.redhat.com/swells/scap-security-
> guide/docs/User_Guide/tmp/en-US/html-single/#sect-User_Guide-Alt_Tools-
> SCC
>
>
> [1]
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-
> November/004468.html
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Classification: UNCLASSIFIED
Caveats: NONE


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5621 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140512/ec85e81c/attachment.bin>


More information about the scap-security-guide mailing list