<div dir="ltr">Thanks, Shawn!<div><br></div><div>I'll check out <a href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-cces.html" target="_blank" style="font-size:13px;font-family:arial,sans-serif">table-rhel6-cces.html</a> and do an update. </div>
<div><br></div><div>Greg</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, May 19, 2014 at 4:26 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><div><div class="h5">
<br>
<div>On 5/19/14, 4:09 PM, Shawn Wells wrote:<br>
</div>
<blockquote type="cite">
<br>
<div>On 5/19/14, 3:44 PM, Greg Elin wrote:<br>
</div>
<blockquote type="cite">
<pre>I've put together a web page to show which RHEL 6 CCE's have a remediation script from Aqueduct and SSG.
It is interesting that a number of rules are missing CCE Idents. It is also easier to see the coverage of fix scripts.
<a href="Http://www.govready.org/cce/fixes/" target="_blank">Http://www.govready.org/cce/fixes/</a>
Would love feedback and thoughts in how to improve coverage. </pre>
</blockquote>
<br>
This is very, very cool. Did you use some sort of XSLT for this,
and if so, is it sharable? Shipping something like this seems
valuable, with a link back to govready for a dynamic version.<br>
<br>
It doesn't seem to be picking up a few CCEs:<br>
<br>
<span>aide_build_database
- </span>CCE 27135-3 (since 2013-10-30)<br>
<span>bios_disable_usb_boot
- CCE </span>26923-3 (since 2013-10-30)<br>
<br>
Is a refresh needed?</blockquote>
<br></div></div>
Went through a few more of the XCCDF rules manually and double
checked on the CCEs. All *appears* well.<br>
<br>
The code we use to transform out the CCEs from each XCCDF rule lives
here:<br>
<a href="https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/xccdf2table-cce.xslt" target="_blank">https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/xccdf2table-cce.xslt</a><br>
<br>
And generates this HTML table:<br>
<a href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-cces.html" target="_blank">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-cces.html</a><br>
<br>
Now that I'm done fretting if proper CCE assignments exist (mini
heart attack due to the pending SSG inclusion in RHEL 6.6), I'd like
to re-iterate, this is very cool!<br>
</div>
<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br></div>