Cross-referencing CCE's and Remediation scripts
shawn at redhat.com
Mon May 19 20:26:51 UTC 2014
On 5/19/14, 4:09 PM, Shawn Wells wrote:
> On 5/19/14, 3:44 PM, Greg Elin wrote:
>> I've put together a web page to show which RHEL 6 CCE's have a remediation script from Aqueduct and SSG.
>> It is interesting that a number of rules are missing CCE Idents. It is also easier to see the coverage of fix scripts.
>> Would love feedback and thoughts in how to improve coverage.
> This is very, very cool. Did you use some sort of XSLT for this, and
> if so, is it sharable? Shipping something like this seems valuable,
> with a link back to govready for a dynamic version.
> It doesn't seem to be picking up a few CCEs:
> aide_build_database - CCE 27135-3 (since 2013-10-30)
> bios_disable_usb_boot - CCE 26923-3 (since 2013-10-30)
> Is a refresh needed?
Went through a few more of the XCCDF rules manually and double checked
on the CCEs. All *appears* well.
The code we use to transform out the CCEs from each XCCDF rule lives here:
And generates this HTML table:
Now that I'm done fretting if proper CCE assignments exist (mini heart
attack due to the pending SSG inclusion in RHEL 6.6), I'd like to
re-iterate, this is very cool!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the scap-security-guide