<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 1/2/14, 3:42 PM, ssg testing wrote:<br>
</div>
<blockquote
cite="mid:1388695371.69445.YahooMailNeo@web161804.mail.bf1.yahoo.com"
type="cite">
<div class="moz-text-html" lang="x-unicode">
<div style="color:#000; background-color:#fff; font-family:times
new roman, new york, times, serif;font-size:12pt">
<div style="RIGHT: auto" id="yiv4804638434">
<div style="RIGHT: auto">
<div style="BACKGROUND-COLOR: #fff; FONT-FAMILY: times new
roman, new york, times, serif; COLOR: #000; FONT-SIZE:
12pt"><span style="RIGHT: auto"
id="yiv4804638434yui_3_7_2_6_1388679020490_49"
lang="EN">
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_51"
align="left"><var id="yui-ie-cursor"></var>While
running SCC 3.1.1.1 against the SSG 0.1-14-14
content, with either the stig-rhel6-server or
usgcb-rhel6-server profile selected from the SCAP
stream, and rpm_verify_permissions = false, there
appears to be variables referenced in the OVAL file
but are not declared in the XCCDF and the value is
being used in XCCDF without being declared.</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_57"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_60"
align="left">usgcb-rhel6-server profile:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_63"
align="left">SCC Warning:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_66"
align="left">"[WARN] Value 'umask_user_value' was
not found"</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_69"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_92"
align="left">declaration in XCCDF: </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_72"
align="left"># /bin/grep -ir "<value id.*
'umask_user_value" /opt/scc/Resources/</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_75"
align="left"><null></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_78"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_101"
align="left">reference in XCCDF:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_81"
align="left"># /bin/grep -ir "value
idref.*umask_user_value" /opt/scc/Resources/</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_108"
align="left">/opt/scc/Resources/Content/ssg-rhel6-xccdf.xml:
<refine-value idref="umask_user_value"
selector="077"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_111"
align="left"># /bin/grep "umask_user_value"
/opt/scc/Resources/Content/ssg-rhel6-xccdf.xml
-A13|/bin/grep "oval:ssg:var"|/usr/bin/uniq</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_114"
align="left"><check-export
export-name="oval:ssg:var:2261"
value-id="var_accounts_user_umask"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_117"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_120"
align="left">reference in OVAL:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_48"
align="left">/bin/grep -i "2261"
/opt/scc/Resources/Content/ssg-rhel6-oval.xml </div>
<div dir="ltr" align="left"><ind:subexpression
operation="equals" var_check="all"
var_ref="oval:ssg:var:2261"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_54"
align="left"><ind:subexpression
operation="equals" var_check="all"
var_ref="oval:ssg:var:2261"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_129"
align="left"><ind:subexpression
operation="equals" var_check="all"
var_ref="oval:ssg:var:2261"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_132"
align="left"><ind:subexpression
operation="equals" var_check="all"
var_ref="oval:ssg:var:2261"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_137"
align="left"><external_variable comment="umask
for user shell" datatype="string"
id="oval:ssg:var:2261" version="1"/></div>
</span></div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
pushed as bugfix:<br>
<a class="moz-txt-link-freetext" href="https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=6aa3740d96a43fa3734cc07f905e20e3782b769c">https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=6aa3740d96a43fa3734cc07f905e20e3782b769c</a><br>
<br>
<br>
<br>
<br>
<blockquote
cite="mid:1388695371.69445.YahooMailNeo@web161804.mail.bf1.yahoo.com"
type="cite">
<div class="moz-text-html" lang="x-unicode">
<div style="color:#000; background-color:#fff; font-family:times
new roman, new york, times, serif;font-size:12pt">
<div style="RIGHT: auto" id="yiv4804638434">
<div style="RIGHT: auto">
<div style="BACKGROUND-COLOR: #fff; FONT-FAMILY: times new
roman, new york, times, serif; COLOR: #000; FONT-SIZE:
12pt"><span style="RIGHT: auto"
id="yiv4804638434yui_3_7_2_6_1388679020490_49"
lang="EN">
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_142"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_147"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_209"
align="left">stig-rhel6-server profile:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_150"
align="left">SCC Warning:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_196"
align="left">"[WARN] Value
'sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value'
was not found."</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_224"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_272"
align="left">declaration in XCCDF: </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_157"
align="left"># /bin/grep -ir "<value
id.*sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
/opt/scc/Resources/</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_162"
align="left"><null></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_167"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_243"
align="left">reference in XCCDF:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_170"
align="left"># /bin/grep -ir "value
idref.*sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
/opt/scc/Resources/</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_385"
align="left">/opt/scc/Resources/Content/ssg-rhel6-xccdf.xml:
<refine-value
idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
selector="enabled"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_394"
align="left">/opt/scc/Resources/Content/ssg-rhel6-xccdf.xml:
<refine-value
idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
selector="enabled"/></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_698"
align="left">/opt/scc/Resources/Content/ssg-rhel6-xccdf.xml:
<refine-value
idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
selector="enabled"/></div>
</span></div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
<br>
sysctl checks still outstanding<br>
<br>
<br>
<blockquote
cite="mid:1388695371.69445.YahooMailNeo@web161804.mail.bf1.yahoo.com"
type="cite">
<div class="moz-text-html" lang="x-unicode">
<div style="color:#000; background-color:#fff; font-family:times
new roman, new york, times, serif;font-size:12pt">
<div style="RIGHT: auto" id="yiv4804638434">
<div style="RIGHT: auto">
<div style="BACKGROUND-COLOR: #fff; FONT-FAMILY: times new
roman, new york, times, serif; COLOR: #000; FONT-SIZE:
12pt"><span style="RIGHT: auto"
id="yiv4804638434yui_3_7_2_6_1388679020490_49"
lang="EN">
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_173"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_300"
align="left">reference in OVAL:</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_50"
align="left"><null></div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_403"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_150"
align="left">SCC Warning:</div>
<div style="RIGHT: auto" dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_467"
align="left">[WARN] Value 'var_password_min_len' was
not found.<br>
[WARN] Value 'var_password_max_age' was not found.<br
style="RIGHT: auto">
[WARN] Value 'var_password_min_age' was not found.<br
id="yiv4804638434yui_3_7_2_6_1388679020490_492">
[WARN] Value 'var_password_warn_age' was not found.</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_480"
align="left"> </div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_650"
align="left">$ /bin/grep -E "var_password_[m|w]"
/opt/scc/Resources/Content/ssg-rhel6-xccdf.xml<br>
<refine-value idref="var_password_min_len"
selector="6"/><br
id="yiv4804638434yui_3_7_2_6_1388679020490_497">
<refine-value idref="var_password_max_age"
selector="90"/><br>
<refine-value idref="var_password_min_age"
selector="7"/><br>
<refine-value idref="var_password_warn_age"
selector="7"/><br>
</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_653"
align="left">$ /bin/grep -E "var_password_[m|w]"
/opt/scc/Resources/Content/ssg-rhel6-oval.xml</div>
<div dir="ltr"
id="yiv4804638434yui_3_7_2_6_1388679020490_530"
align="left">$ <null></div>
</span></div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
this still need to be addressed too<br>
<br>
I'll have some time this weekend, but it'd be great if someone else
wants to step up!<br>
</body>
</html>