CentOS / PCI DSS / Vulnerability Scans etc

Nathanael Noblet nathanael at gnat.ca
Sat Apr 25 05:10:02 UTC 2015


> On Apr 24, 2015, at 8:28 PM, Greg Elin <gregelin at gitmachines.com> wrote:
> 
> Replying in line...
> 
>> On Apr 24, 2015, at 12:03 PM, Nathanael D. Noblet <nathanael at gnat.ca> wrote:
>> 
>> Hello Greg,
>> 
>> This is fantastic information and nearly perfectly what I was looking
>> for. I think it would make a great first read for people trying to get
>> into this area. Apologies for the top post but most of my resulting
>> questions don't fit nicely into what you've provided.
> Glad to hear the information was useful. 
> 
> Shawn's answers to your questions are great covering importance nuances that will help you understand relationships between this and that. I'm going to add my two cents, too. 
> 
>> The remaining questions are. 
>> 
>> #1 - If Scap-Security-Guide is trying to provide OSS SCAP content, why
>> isn't CentOS included by default?
> 
> If you are really, REALLY serious about CERTIFICATION, then you are not just securing an OS, you are also demonstrating that your tools/people/processes to secure the system are secure. (And sometimes even the t/p/p that secure the t/p/p that secure the OS are secure.) 

So I’m not interested in certification really. We have a client that will be storing ‘extra’ sensitive information. We’re building the app and managing their servers and so I wanted to take extra steps to ensure that the servers follow some standard of security other than having a firewall, ids and ssh. We typically use CentOS for our servers since we’re not in the US and have no regulatory requirements that require certification.

> From a user perspective, CentOS feels like RHEL. But from a build perspective (and accountability perspective), CentOS is like a clone assembled by another company in another country. 
> 
> What Shawn details so well is that there is a whole lot of stuff that makes RHEL actually RHEL that is beyond the source code. So there is a level of promise the SCAP-Security-Guide can make about RHEL that cannot really be made about for CentOS. Sure the two are similar--but ultimately he warrants that comes from a person signing off that X only does Y on OS Z is non-transferable for a valid certification. 

So this part confuses me a little. I realize that CentOS rebuilds the src rpms RHEL produces with some of them being patched. However I fail to see the distinction as wide as is being claimed here. I’m wondering are there any clear examples of these differences? Is it all about the different products RHEL provides and so the rpm for lets say mysql on the workstation isn’t identical to the one for the server and thus when CentOS builds the src rpm you could be getting one that is neither the workstation nor the server but some combination between the two?

I’m also curious if CentOS is so different then RHEL, how can the instructions of modifying the cpe-dictionary (or whatever) so that RHEL based tests are run against a CentOS work? Is it just that its possible one of the tests will somehow fail on CentOS?


> 
> Hence the focus has been on RHEL. And that said, I think it is cool use CentOS and SSG ScAP on CentOs for scrimmage. 
> 
> 
>> #2 - If I were able to get proprietary SCAP for a desired standard. Is
>> it so proprietary that it isn't likely to be useful with scanners like
>> openscap-scanner?
> 
> There are two levels of "proprietary."
> 
> The first is a proprietary security content that is NOT SCAP just there is markup that is not SGML or HTML. Some vendors started automated config scanning before the SCAP standards. Structurally proprietary security content cannot be read by OpenSCAP. 
> 
> The second is security content expressed in the SCAP standard but is available only under a proprietary license. This is what Shawn described. If it is SCAP security content, OpenSCAP can use it. But you need a license to use it. 

Right and makes sense I guess. Though I would imagine there are few places that sell just the SCAP without a tool they want you to use with some form of incentives to continue using their tool. 

> 
>> 
>> #3 - Are there places that sell the relevant SCAP files that I may be
>> interested in that are considered by the community as 'good quality'? If
>> so what are some of these companies? (With my new found understanding of
>> all the different pieces I'll be googling around today to see if I can
>> find some on my own but if people here already know that would be
>> great).
> 
> There are not enough places that sell SCAP or offer security content.  Center for Internet Security is a commonly known vendor. I do not know if they have CentOS security content. 
> 
> And as pointed out, content varies, just as the quality of HTML or code varies. Essentially, many tests--like string passwords--are actually composed of several sub tests. Some security content, even if expressed in SCAP, may only test some of the criteria involved. 
> 
> 
>> #4 - It seems the OpenScap Security Guide is converting some type of
>> 'list of rules' into the scap format for RHEL 6 & 7. And 7 being a work
>> in progress. Where is it getting the list of rules? What standard are
>> those rules based on? A side question that no one here can likely
>> answer, why isn't RHEL setup by default with those rules as 'passing' if
>> its a good default?
>> 
>> I think that is it for now.
>> 
>> Sincerely,
>> -- 
>> Nathanael
>> 
>>> On Tue, 2015-04-21 at 16:03 -0400, Greg Elin wrote:
>>> Nathanael,
>>> 
>>> 
>>> I had the same problem getting started with scanning and auditing.
>>> Below are a couple of starting points.
>>> 
>>> 
>>> Getting Started with scanning/auditing CentOS 6 with
>>> SCAP-Security-Guide
>>> =============================================================
>>> For a quick start on auditing CentOS, see the CentOS 6 QuickStart in
>>> the README at: https://github.com/GovReady/govready
>>> 
>>> 
>>> The QuickStart installs my pure Bourne shell app, "GovReady," which
>>> installs OpenSCAP, SCAP-Security-Guide (SSG). Follow the QuickStart
>>> steps to make the adjustments in the OVAL test so the SSG tests for
>>> RedHat will run correctly on CentOS instead of returning "not
>>> applicable" results.
>>> 
>>> 
>>> The GovReady toolkit displays all OpenSCAP commands it runs, so it can
>>> be helpful little training tool to acquaint you the specifics of using
>>> OpenSCAP.
>>> 
>>> 
>>> Getting Started with SCAP-Security-Guide in General
>>> ===========================================
>>> Forgive me if this is too basic, but I think it is good to start from
>>> zero.
>>> 
>>> 
>>> The SCAP-Security-Guide project is a project to produced open-source
>>> SCAP (Security Content Automation Protocol) for RedHat and now other
>>> Linux systems.
>>> 
>>> 
>>> SCAP is best thought of machine-readable "security content". That is,
>>> XML content describing machine-readable checks for software
>>> configuration and vulnerabilities. 
>>> 
>>> 
>>> SCAP is composed of several interrelated XML standards (XCCDF, OVAL,
>>> OCIL, ARF, CCE, CPE, CVE, CVSS, CCSS) -- but trying to understand how
>>> the why and how of these separate standards is confusing.
>>> 
>>> 
>>> What you really want to do is audit your CentOS server for
>>> vulnerabilities and configuration settings, right? To do that,
>>> you need the following:
>>> 
>>> 1. "scanning software" that non-intrusively ​scans and audits ​server
>>> nerd knob settings; 
>>> 
>>> 2. "security content" (or "SCAP content") that describes the tests to
>>> apply to audit the server; 
>>> 
>>> 3. "security report" that indicates which tests passed, which tests
>>> failed, and why. 
>>> 
>>> 
>>> Examples of "scanning software" include RedHat's OpenSCAP, OpenVAS,
>>> FarnHall Ventures's jOVAL and Teneble's Nessus. Most "security
>>> content" is provided either by a software vendor or by a third party
>>> such as Tenable that sells enterprise scanning software. This list, of
>>> course, offers SCAP-Security-Guide, which is security content in SCAP
>>> format with an open source license (Hurray!).
>>> 
>>> ​ ​
>>> The "security reports" indicating which tests have passed is generally
>>> a module built into the scanning software. Most scanning software also
>>> produces standardized XML reporting results so the content can be
>>> aggregated in other tools.
>>> 
>>> 
>>> Scanning/auditing a system is not really any different from installing
>>> Virus scanning software and Virus signatures content to scan your
>>> computer for viruses.  But it's been my experience that SCAP feels
>>> much more complicated.  I think there are three reasons why. First,
>>> the government cyber security community is a bit insular by nature.
>>> Second, scanning software is designed for scanning thousands of "end
>>> points" in the enterprise and a lot of knowledge is assumed. Finally,
>>> SCAP has not yet been packaged to be user friendly and has a steep
>>> learning curve as a standard. (It's easy to get to over 8 standards
>>> when you are trying to juggle different platforms, supporting
>>> variables, standardized tracking of vulnerabilities, etc.)
>>> 
>>> 
>>> Anyway, the whole point of SCAP is to automate security scanning, to
>>> have computers check other computers. That process involves the
>>> following steps:
>>> 
>>> 
>>> 1. Install NIST-certified SCAP scanning software
>>> 2. Download/install desired SCAP Content (e.g. security content) for
>>> your platform
>>> 3. Choose the correct profile (e.g., checklist of tests)
>>> 4. Run the scan
>>> 5. Look at results
>>> 6. Fix results
>>> 7. Repeat as necessary
>>> 
>>> 
>>> Here are some links that discuss the specifics of these seven steps. 
>>> 
>>> 
>>> - http://github.com/govready - a toolkit designed to make server
>>> auditing friendly to developers use to work with Git.
>>> - http://myopensourcelife.com/2013/09/08/scap-and-remediation/ (ignore
>>> the installation information and jump down to "running a scan" to see
>>> commands
>>> -
>>> http://people.redhat.com/swells/docs/en-US/SCAP_Security_Guide/0.1/html-single/User_Guide/index.html - the SSG manual
>>> 
>>> 
>>> It is pretty easy to install the scanning software of your choice, but
>>> it can be a real challenge to finding the SCAP content for your
>>> platform. Lots of SCAP is proprietary, but the SCAP-Security-Guide is
>>> working to make more scanning content available for more platforms
>>> under open source licenses. (Or at least, I think of it that way.)
>>> 
>>> 
>>> A big gotcha that I ran into with SCAP-Security-Guide is the fact that
>>> tests are associated with RedHat platform specifically. (One of the
>>> SCAP standards, CPE, or Common Platform Enumeration, provides an
>>> explicit way of universally identifying a platform. And the SSG basic
>>> distribution tests for RedHat. So it is necessary to adjust
>>> CPE-dictionary file and the associated CPE test in the OVAL XML to get
>>> RedHat SSG tests to work properly on CentOS.)
>>> 
>>> 
>>> Send more questions if you have them...
>>> 
>>> 
>>> best, 
>>> 
>>> 
>>> Greg Elin
>>> GovReady PBC
>>> e gregelin at gitmachines
>>> m 917-304-3488
>>> 
>>> 
>>> 
>>> On Mon, Apr 20, 2015 at 2:24 PM, Nathanael D. Noblet
>>> <nathanael at gnat.ca> wrote:
>>>      Hello,
>>> 
>>>        We tend to use CentOS for most of our servers. All legacy
>>>      servers are
>>>      6, we have two new v7 servers.
>>> 
>>>        I would like to learn how to perform some of these audits
>>>      that the
>>>      guide provides. I looked at it a few months back but never got
>>>      to the
>>>      point of having it work successfully.
>>> 
>>>        Does anyone know of documentation on how to use the guide
>>>      with CentOS?
>>>      I know v7 isn't quite ready? I'm also wondering if there are
>>>      public
>>>      locations for standards like PCI DSS, HIPAA, or other high
>>>      security
>>>      'generally accepted' standards etc.
>>> 
>>>      --
>>>      Nathanael
>>> 
>>>      --
>>>      SCAP Security Guide mailing list
>>>      scap-security-guide at lists.fedorahosted.org
>>>      https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>>      https://github.com/OpenSCAP/scap-security-guide/
>>> 
>>> 
>>> -- 
>>> SCAP Security Guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>> https://github.com/OpenSCAP/scap-security-guide/
>> 
>> 
>> 
>> -- 
>> SCAP Security Guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> https://github.com/OpenSCAP/scap-security-guide/
> -- 
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4106 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150424/43167019/attachment-0001.p7s>


More information about the scap-security-guide mailing list