Using the RHEL specific SCAP content for CentOS

Bond Masuda bond.masuda at hexadiam.com
Tue Jul 7 00:19:47 UTC 2015


Greg,

Thank you for your links and help. Confirmed that with your CPE
dictionary and OVAL file, I was able to run the content in oscap.

Jan or Gabe:

The SCAP content from 0.1.23 release, even after getting it to build
with the suggested 'make' argument by Jan, does not appear to be
functional. Is this a bug or is it because I'm not doing something
correctly?

Thanks,
-Bond

On 07/06/2015 03:20 PM, Greg Elin wrote:
> Bond,
>
> You have to two files for CentOS:
> - ssg-centos6-cpe-dictionary.xml
> - ssg-centos6-cpe-oval.xml
>
> ssg-centos6-cpe-dictionary.xml describes the platform. (CPE stands for
> Common Platform Enumeration).
>
> But ssg-centos6-cpe-oval.xml consists of the "Open Vulnerability
> Assessment Language" code that _tests_ whether your platform is is
> CentOS. You must have both, b/c the first file refers to the second file.
>
> You can get them here:
> https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-dictionary.xml
> https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-oval.xml
>
> You can put the files anywhere, just make sure they are in the same
> directory together, and reference the full
> path/to/ssg-centos6-cpe-dictionary.xml
>
> Greg
>
> On Mon, Jul 6, 2015 at 5:46 PM, Bond Masuda <bond.masuda at hexadiam.com
> <mailto:bond.masuda at hexadiam.com>> wrote:
>
>     Thanks Jan! Please see inline response below...
>
>     On 07/04/2015 04:32 AM, Jan Lieskovsky wrote:
>     > Hello Bond,
>     >
>     >   thank you for your report.
>     >
>     > ----- Original Message -----
>     >
>     > I can reproduce that issue, when issuing just 'plain' "make" in the
>     > scap-security-guide-0.1.23 folder. The issue is Fedora content by
>     > default requires OVAL-5.11 language version already, and the version
>     > of the openscap RPM you are trying to build Fedora content against
>     > (openscap-1.0.8-1.0.1.el6.centos.1.x86_64) does not support
>     OVAL-5.11
>     > language version yet.
>     >
>     > We will correct this problem in an official way in the upcoming
>     0.1.24
>     > upstream release (should be available for download during next
>     week).
>     >
>     > For now please use the following workaround (in the
>     scap-security-guide-0.1.23
>     > directory after expanding the tarball), issue the following command:
>     >
>     > # make SSG_VERSION_IS_GIT_SNAPSHOT=no rpm
>     >
>     > This will correctly produce working RPM that can be subsequently
>     used
>     > on RHEL-6 / CentOS6 system.
>
>     Yes, I was able to build the RPM, however not able to run with oscap.
>     More below...
>
>     >> As of SCAP Security Guide release 0.1.23, CentOS content is now
>     available
>     >> (any older version will require tweaking). See the announcement
>     here:
>     >>
>     https://lists.fedorahosted.org/pipermail/scap-security-guide/2015-June/006462.html
>     >>
>     >> You can download and build the SSG content from
>     >> https://github.com/OpenSCAP/scap-security-guide
>     >>
>     >> When you run the XCCDF, you have to specify the CentOS XCCDF
>     like below:
>     >>
>     >> # oscap xccdf eval --profile stig-rhel6-server-upstream \
>     >> --results /tmp/`hostname`-ssg-results.xml \
>     >> --report /tmp/`hostname`-ssg-results.html \
>     >> --cpe
>     /usr/share/xml/scap/ssg/content/ssg-centos6-cpe-dictionary.xml \
>     >> /usr/share/xml/scap/ssg/content/ssg-centos6-xccdf.xml
>     >>
>     >> Please note that I believe that ssg-centos6-cpe-dictionary.xml
>     is not being
>     >> built with SSG. OpenSCAP is here:
>     https://github.com/openscap/openscap and
>     >> the announcement here: So I believe all that needs to be done is:
>     >>
>     >> # oscap xccdf eval --profile stig-rhel6-server-upstream \
>     >> --results /tmp/`hostname`-ssg-results.xml \
>     >> --report /tmp/`hostname`-ssg-results.html \
>     >> /usr/share/xml/scap/ssg/content/ssg-centos6-xccdf.xml
>     >>
>
>     Trying to run the last command above without specifying CPE,
>     results in
>     all tests being "notapplicable". And I confirmed there is no
>     cpe-dictionary.xml being built for CentOS6.
>
>     What am I missing?
>     -Bond
>     --
>     SCAP Security Guide mailing list
>     scap-security-guide at lists.fedorahosted.org
>     <mailto:scap-security-guide at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>     https://github.com/OpenSCAP/scap-security-guide/
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150706/6bb65aa7/attachment-0001.html>


More information about the scap-security-guide mailing list