<div dir="ltr"><div><div>Martin,<br><br></div>I did reply (to the list) but my email has been retained by the moderator for three days now. I'll reply directly to you.<br><br>regards,<br><br></div>Ivan<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Apr 29, 2014 at 1:29 PM, Martin Preisler <span dir="ltr"><<a href="mailto:mpreisle@redhat.com" target="_blank">mpreisle@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">----- Original Message -----<br>
> From: "Ivan Saez Scheihing" <<a href="mailto:saezscheihing@gmail.com">saezscheihing@gmail.com</a>><br>
</div><div class="">> To: "SCAP Security Guide" <<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>><br>
> Sent: Tuesday, April 22, 2014 8:00:39 PM<br>
> Subject: Re: oscap & jboss on Fedora<br>
><br>
> Martin,<br>
><br>
> I was able to run xccdf and oscan after editing the eap5-xccdf.xml file. I<br>
> did comment out all '<platform idref="cpe:/a:redhat..' lines (5 lines in<br>
> total).<br>
><br>
> java -jar xccdfexec.jar -result bla.xml --report bla.html --profile<br>
> eap5_full -c eap5-cpe-oval.xml -C eap5-cpe-dictionary.xl -P eap5_full<br>
<br>
</div>No idea what xccdfexec.jar is. Is it a wrapper around oscap? The arguments look familiar.<br>
<div class=""><br>
><br>
> Did run and asked me a lot's of questions. The same questions as can be<br>
> found in the JBossEAP5_Guide.html document. Based on my answers it<br>
> generated a few xml files. But am I mistaken or doesn't  xccdfexec cheeck<br>
> anything?<br>
><br>
> Oscap did check some things by it self (by inspecting jboss xml files I<br>
> supose). I run it with the following options:<br>
><br>
> oscap xccdf eval --results bla.xml --report bla.html --profile eap5-full<br>
> -cpe eap5-cpe-dictionary.xml eap5-xccdf.xml<br>
><br>
><br>
> It generated the bla.html file and most of the checks were done. Previously<br>
> I did check the Jboss by hand and I think oscap is not very meticulous.<br>
> Some checks did get the passed status and I'm sure it should have failed.<br>
> Any comments on this/<br>
<br>
</div>We need more specifics, else I can't comment. Give us a particular rule that passed and shouldn't have. Post your xccdf result file, post your oval results.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
Martin Preisler<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</div></div></blockquote></div><br></div>