CentOS / PCI DSS / Vulnerability Scans etc

Greg Elin gregelin at gitmachines.com
Tue Apr 21 20:03:06 UTC 2015


Nathanael,

I had the same problem getting started with scanning and auditing. Below
are a couple of starting points.

*Getting Started with scanning/auditing CentOS 6 with SCAP-Security-Guide*
*=============================================================*
For a quick start on auditing CentOS, see the CentOS 6 QuickStart in the
README at: https://github.com/GovReady/govready

The QuickStart installs my pure Bourne shell app, "GovReady," which
installs OpenSCAP, SCAP-Security-Guide (SSG). Follow the QuickStart steps
to make the adjustments in the OVAL test so the SSG tests for RedHat will
run correctly on CentOS instead of returning "not applicable" results.

The GovReady toolkit displays all OpenSCAP commands it runs, so it can be
helpful little training tool to acquaint you the specifics of using
OpenSCAP.

*Getting Started with SCAP-Security-Guide in General*
*===========================================*
Forgive me if this is too basic, but I think it is good to start from zero.

The SCAP-Security-Guide project is a project to produced open-source SCAP
(Security Content Automation Protocol) for RedHat and now other Linux
systems.

SCAP is best thought of machine-readable "security content". That is, XML
content describing machine-readable checks for software configuration and
vulnerabilities.

SCAP is composed of several interrelated XML standards (XCCDF, OVAL, OCIL,
ARF, CCE, CPE, CVE, CVSS, CCSS) -- but trying to understand how the why and
how of these separate standards is confusing.

What you really want to do is audit your CentOS server for vulnerabilities
and configuration settings, right? To do that, you need the following:

1. "scanning software" that non-intrusively ​scans and audits ​server nerd
knob settings;

 2. "security content" (or "SCAP content") that describes the tests to
apply to audit the server;

3. "security report" that indicates which tests passed, which tests failed,
and why.


Examples of "scanning software" include RedHat's OpenSCAP, OpenVAS,
FarnHall Ventures's jOVAL and Teneble's Nessus. Most "security content" is
provided either by a software vendor or by a third party such as Tenable
that sells enterprise scanning software. This list, of course, offers
SCAP-Security-Guide, which is security content in SCAP format with an open
source license (Hurray!).
​ ​

The "security reports" indicating which tests have passed is generally a
module built into the scanning software. Most scanning software also
produces standardized XML reporting results so the content can be
aggregated in other tools.

Scanning/auditing a system is not really any different from installing
Virus scanning software and Virus signatures content to scan your computer
for viruses.  But it's been my experience that SCAP feels much more
complicated.  I think there are three reasons why. First, the government
cyber security community is a bit insular by nature. Second, scanning
software is designed for scanning thousands of "end points" in the
enterprise and a lot of knowledge is assumed. Finally, SCAP has not yet
been packaged to be user friendly and has a steep learning curve as a
standard. (It's easy to get to over 8 standards when you are trying to
juggle different platforms, supporting variables, standardized tracking of
vulnerabilities, etc.)

Anyway, the whole point of SCAP is to automate security scanning, to have
computers check other computers. That process involves the following steps:

1. Install NIST-certified SCAP scanning software
2. Download/install desired SCAP Content (e.g. security content) for your
platform
3. Choose the correct profile (e.g., checklist of tests)
4. Run the scan
5. Look at results
6. Fix results
7. Repeat as necessary

Here are some links that discuss the specifics of these seven steps.

- http://github.com/govready - a toolkit designed to make server auditing
friendly to developers use to work with Git.
- http://myopensourcelife.com/2013/09/08/scap-and-remediation/ (ignore the
installation information and jump down to "running a scan" to see commands
-
http://people.redhat.com/swells/docs/en-US/SCAP_Security_Guide/0.1/html-single/User_Guide/index.html
- the SSG manual

It is pretty easy to install the scanning software of your choice, but it
can be a real challenge to finding the SCAP content for your platform. Lots
of SCAP is proprietary, but the SCAP-Security-Guide is working to make more
scanning content available for more platforms under open source licenses.
(Or at least, I think of it that way.)

A big gotcha that I ran into with SCAP-Security-Guide is the fact that
tests are associated with RedHat platform specifically. (One of the SCAP
standards, CPE, or Common Platform Enumeration, provides an explicit way of
universally identifying a platform. And the SSG basic distribution tests
for RedHat. So it is necessary to adjust CPE-dictionary file and the
associated CPE test in the OVAL XML to get RedHat SSG tests to work
properly on CentOS.)

Send more questions if you have them...

best,

Greg Elin
GovReady PBC
e gregelin at gitmachines
m 917-304-3488


On Mon, Apr 20, 2015 at 2:24 PM, Nathanael D. Noblet <nathanael at gnat.ca>
wrote:

> Hello,
>
>   We tend to use CentOS for most of our servers. All legacy servers are
> 6, we have two new v7 servers.
>
>   I would like to learn how to perform some of these audits that the
> guide provides. I looked at it a few months back but never got to the
> point of having it work successfully.
>
>   Does anyone know of documentation on how to use the guide with CentOS?
> I know v7 isn't quite ready? I'm also wondering if there are public
> locations for standards like PCI DSS, HIPAA, or other high security
> 'generally accepted' standards etc.
>
> --
> Nathanael
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150421/7b724dba/attachment.html>


More information about the scap-security-guide mailing list