<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 5/19/14, 4:09 PM, Shawn Wells wrote:<br>
</div>
<blockquote cite="mid:537A64FE.9030407@redhat.com" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<br>
<div class="moz-cite-prefix">On 5/19/14, 3:44 PM, Greg Elin wrote:<br>
</div>
<blockquote
cite="mid:E92E757A-E664-4196-915D-A7001F40662F@gitmachines.com"
type="cite">
<pre wrap="">I've put together a web page to show which RHEL 6 CCE's have a remediation script from Aqueduct and SSG.
It is interesting that a number of rules are missing CCE Idents. It is also easier to see the coverage of fix scripts.
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="Http://www.govready.org/cce/fixes/">Http://www.govready.org/cce/fixes/</a>
Would love feedback and thoughts in how to improve coverage. </pre>
</blockquote>
<br>
This is very, very cool. Did you use some sort of XSLT for this,
and if so, is it sharable? Shipping something like this seems
valuable, with a link back to govready for a dynamic version.<br>
<br>
It doesn't seem to be picking up a few CCEs:<br>
<br>
<meta charset="utf-8">
<span style="color: rgb(51, 51, 51); font-family: 'Helvetica
Neue', Helvetica, Arial, sans-serif; font-size: 14px;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: 20px; orphans: auto;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(249, 249,
249); display: inline !important; float: none;">aide_build_database
- </span>CCE 27135-3 (since 2013-10-30)<br>
<meta charset="utf-8">
<span style="color: rgb(51, 51, 51); font-family: 'Helvetica
Neue', Helvetica, Arial, sans-serif; font-size: 14px;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: 20px; orphans: auto;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); display: inline !important; float: none;">bios_disable_usb_boot
- CCE </span>26923-3 (since 2013-10-30)<br>
<br>
Is a refresh needed?</blockquote>
<br>
Went through a few more of the XCCDF rules manually and double
checked on the CCEs. All *appears* well.<br>
<br>
The code we use to transform out the CCEs from each XCCDF rule lives
here:<br>
<a class="moz-txt-link-freetext" href="https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/xccdf2table-cce.xslt">https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/xccdf2table-cce.xslt</a><br>
<br>
And generates this HTML table:<br>
<a class="moz-txt-link-freetext" href="http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-cces.html">http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-cces.html</a><br>
<br>
Now that I'm done fretting if proper CCE assignments exist (mini
heart attack due to the pending SSG inclusion in RHEL 6.6), I'd like
to re-iterate, this is very cool!<br>
</body>
</html>