<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">I'm not the one packaging up the rpm,
      so I don't know how out of date that is. I'd like Leam and you
      both to test against the git repository to see if any of my recent
      OVAL patches fix any of these problems. That will help me
      prioritize anything that's still broken.<br>
      <br>
      I'll do a full run myself against the git repository in a little
      bit here, but I have some uncommitted changes that might lead to
      different results<br>
      <br>
      Thanks,<br>
      - Maura Dailey<br>
      <br>
      On 08/28/2013 02:21 PM, Robert Sanders wrote:<br>
    </div>
    <blockquote
      cite="mid:848FB1215E2AD643A5E10D906091D3FB692274@TCSEXCH1.tcs-sec.com"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
      <div style="direction: ltr;font-family: Tahoma;color:
        #000000;font-size: 10pt;">Maura,<br>
          I'm using the yum repos for my latest download also instead of
        git.  I can corroborate several of the false positives on my
        RHEL6 box after locking things down with Security Blanket, and
        manually reviewing the failures.  There are several that need
        additional scrutiny.  I used SCC 3.1 GA to run the checks as it
        seems to give me more insight into the results than oscap does
        (any suggestions on increasing the who/what/where/how/why
        logging w/o having to rebuild oscap from source appreciated).<br>
          I'd just reverted the VM where I'd done the SCC scan so I
        don't have the results in front of me, but from memory :<br>
        <br>
        57/58/59 - SCC was showing the line, including the correct
        value, then complaining that the value didn't match what it was
        looking for.  Wonder if this is a case of not handling the
        leading '-' incorrectly?<br>
        <br>
        73 - I know the RHEL5 STIG had an issue with whitespace at one
        point that I'd gotten around<br>
        <br>
        206-211 I don't have telnet on my box either, but I think it may
        be treating the failure of finding /etc/xinetd.d/telnet as not
        finding 'disabled' in that file<br>
        <br>
        240 I had this also, but we set the file to point to /etc/issue
        rather than /etc/issue.net.  The *contents* of both files are
        the same (the correct banner).  Perhaps the check should be
        checking the contents of whatever banner is being used rather
        than just the setting references the right file name?<br>
        <br>
        <br>
        -Rob<br>
        <br>
        <div style="font-family: Times New Roman; color: rgb(0, 0, 0);
          font-size: 16px;">
          <hr tabindex="-1">
          <div style="direction: ltr;" id="divRpF106483"><font
              color="#000000" face="Tahoma" size="2"><b>From:</b>
              <a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>
              [<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>] on
              behalf of leam hall [<a class="moz-txt-link-abbreviated" href="mailto:leamhall@gmail.com">leamhall@gmail.com</a>]<br>
              <b>Sent:</b> Wednesday, August 28, 2013 2:02 PM<br>
              <b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
              <b>Subject:</b> Re: Various False Positives?<br>
            </font><br>
          </div>
          <div>
            <div dir="ltr">Hey Maura!<br>
              <br>
              I'm using the openscap-utils rpm and the content from the
              Fedorahosted zip file.<br>
            </div>
            <div class="gmail_extra"><br>
              <br>
              <div class="gmail_quote">On Wed, Aug 28, 2013 at 1:05 PM,
                Maura Dailey <span dir="ltr">
                  &lt;<a moz-do-not-send="true"
                    href="mailto:maura@eclipse.ncsc.mil" target="_blank">maura@eclipse.ncsc.mil</a>&gt;</span>
                wrote:<br>
                <blockquote class="gmail_quote" style="margin: 0pt 0pt
                  0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204);
                  padding-left: 1ex;">
                  <div bgcolor="#FFFFFF">
                    <div class="im">
                      <div>On 08/28/2013 12:04 PM, leam hall wrote:<br>
                      </div>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>Hey all,<br>
                            <br>
                          </div>
                          <div>Just ran oscap with the xml files
                            available on the website (Benchmark version
                            0.9). Here are the issues that seem to be
                            false positives. Prefix everything with
                            "RHEL-06-000". These are all marked as fail
                            but the server meets the STIG.<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    Stupid question, but what are you running against
                    exactly? The RPM or the latest git checkout? I want
                    to make sure that if I run this, I'm seeing the same
                    results, and I've made a lot of changes to OVAL
                    checks in the git repository in the past few weeks.
                    I'm going to run through your list, comparing it
                    against the OVAL checks.
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>  9   rhnsd can be on if configured to
                            Satellite server or similar<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    Fix text definitely implies this. It's not the only
                    service that implies it's allowed in certain
                    environments, but then proceeds to only accept a
                    value of disabled.
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div> 57   ucredit <br>
                          </div>
                          <div> 58   ocredit<br>
                          </div>
                          <div> 59   lcredit<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    For the previous 3, I'd like to see the
                    pam_cracklib.so line so I can troubleshoot.<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div> 73   /etc/issue<br>
                        </div>
                      </div>
                    </blockquote>
                    Going back to my many many OVAL check updates, I'd
                    like to see your exact /etc/issue so I can debug
                    what went wrong. If it's an exact copy of the text
                    from the STIG, I'll work off that.<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div> 98  No ipv6 installed<br>
                        </div>
                      </div>
                    </blockquote>
                    Do you mean it's disabled on your system, but the
                    OVAL checks are saying it isn't?<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div> 99  "<br>
                        </div>
                      </div>
                    </blockquote>
                    ?
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>165  adjtimex<br>
                          </div>
                          <div>167  settimeofday<br>
                          </div>
                          <div>169  stime  // Also, the STIG is wrong.
                            There is no x86_64 stime syscall<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    The STIG actually says that stime is not necessary,
                    which is kind of a strange wording, but the
                    suggested line in the fix text prose is correct, at
                    least. So far as OVAL checks go, I haven't gotten to
                    testing audit checks yet. Maybe this is broken. I'll
                    check it out once I've deciphered the OVAL check.
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>171  clock_settime<br>
                          </div>
                          <div>184-196, 200 chmod, chown, etc...<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    Haven't tested audit checks yet...
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>206-211  No telnet installed or turned on<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    These are both automated checks. Unless the package
                    name is wrong, I don't know why they'd give false
                    positives.<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div>240  /etc/ssh/sshd_config Banner<br>
                        </div>
                      </div>
                    </blockquote>
                    The OVAL check was definitely working on my system
                    when I last tested it.
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>271  If there are no removable partitions
                            this is not a finding.<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    Working on testing this one now...
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>278  If the file permissions are more
                            restrictive then it is not a finding.<br>
                          </div>
                          <div>324  No X running<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    Agreed, the GNOME checks need to be rewritten to
                    have extended definitions to exclude machines that
                    don't have X installed.<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div>326   "  <br>
                        </div>
                      </div>
                    </blockquote>
                    ?
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>346  Finding reported on umask 022<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    This is DEFINITELY a bug. The check section is
                    actually pointing to a different check. The actual
                    check for this rule was never written.
                    <div class="im"><br>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div>348  No vsftp installed, thus no file.<br>
                          </div>
                        </div>
                      </blockquote>
                    </div>
                    No OVAL check exists in SSG.<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div>506  "hushlogin"<br>
                        </div>
                      </div>
                    </blockquote>
                    This one isn't in the SSG at all.<br>
                    <blockquote type="cite">
                      <div dir="ltr">
                        <div>507  PrintLastLog<br>
                        </div>
                      </div>
                    </blockquote>
                    This one isn't in the SSG at all.<br>
                    <br>
                    - Maura Dailey<br>
                    <br>
                    <blockquote type="cite">
                      <div class="im">
                        <div dir="ltr">
                          <div><br>
                          </div>
                          <div><br>
                          </div>
                          <div>Am I confused in thinking a system in run
                            level 3 should net need to worry about
                            X/Gnome findings?<br>
                            <br>
                          </div>
                          <div>Leam<br>
                          </div>
                          <div>
                            <div><br>
                              -- <br>
                              <div><a moz-do-not-send="true"
                                  href="http://leamhall.blogspot.com/"
                                  target="_blank">Mind on a Mission</a></div>
                            </div>
                          </div>
                        </div>
                        <br>
                        <fieldset target="_blank"></fieldset>
                        <br>
                      </div>
                      <pre>_______________________________________________
scap-security-guide mailing list
<a moz-do-not-send="true" href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a moz-do-not-send="true" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
                    </blockquote>
                    <br>
                  </div>
                  <br>
                  _______________________________________________<br>
                  scap-security-guide mailing list<br>
                  <a moz-do-not-send="true"
                    href="mailto:scap-security-guide@lists.fedorahosted.org"
                    target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
                  <a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide"
                    target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
                  <br>
                </blockquote>
              </div>
              <br>
              <br clear="all">
              <br>
              -- <br>
              <div><a moz-do-not-send="true"
                  href="http://leamhall.blogspot.com/" target="_blank">Mind
                  on a Mission</a></div>
            </div>
          </div>
        </div>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>