<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/1/12 1:00 PM, Peter Vrabec wrote:<br>
</div>
<blockquote cite="mid:5092AAC6.8040904@redhat.com" type="cite">Hi
Shawn,
<br>
<br>
if you see all the rules with notapplicable results it's because
we start supporting CPE applicability processing.
<br>
<br>
I see this in the content:
<br>
<platform idref="cpe:/o:redhat:enterprise_linux:6"/> <br>
<br>
<platform idref="cpe:/o:redhat:enterprise_linux:6::client"/>
<br>
<br>
<br>
Please use "--cpe-dict" option. I have just found out that it's
missing in a man page. Well I need kick someone. :)
<br>
<br>
--cpe-dict ssg-rhel6-cpe-dictionary.xml
<br>
<br>
should work for you if you are on RHEL6 system.
<br>
<br>
If for some reason you don't want cpe applicability check you need
to remove <platform> elements from the content.
</blockquote>
<br>
Thank you Peter! <br>
<br>
I've pushed a few patches (per David's ack) which solve our
immediate content problems and cut a new RPM. <br>
<br>
Eric (+interested parties): Can you download the following RPM and
provide feedback? If users report back this fixes their issue I'll
cut a new (official) release and put it on the wiki.<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-7.noarch.rpm">http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/scap-security-guide-0.1-7.noarch.rpm</a><br>
<br>
As Peter mentioned above, be sure to use the --cpe-dict flag, e.g.:<br>
$ oscap xccdf eval --profile stig-server --cpe-dict
ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml<br>
<br>
<u><b>PLEASE NOTE</b></u> the now proper execution of CPE exposes
some errors in our OVAL. Some rules will pass/fail while others will
throw errors. We'll work on fixing these now, e.g.:<br>
$ oscap xccdf eval --profile stig-server --cpe-dict
RHEL6/output/ssg-rhel6-cpe-dictionary.xml
RHEL6/output/ssg-rhel6-xccdf.xml <br>
....<br>
Title Ensure All World-Writable Directories Are Owned by a System
Account<br>
Rule world_writable_files_system_ownership<br>
Ident CCE-14794-2<br>
Result fail<br>
<br>
Title Ensure tftp Daemon Uses Secure Mode<br>
Rule tftpd_uses_secure_mode<br>
Ident CCE-TODO<br>
Result pass<br>
<br>
Title Enable Logging of All FTP Transactions<br>
Rule ftp_log_transactions<br>
Ident CCE-4549-2<br>
Result notchecked<br>
<br>
Title Ensure the Default Bash Umask is Set Correctly<br>
Rule user_umask_bashrc<br>
Ident CCE-3844-8<br>
Result error<br>
<br>
<br>
</body>
</html>