<div dir="ltr">Thanks Jan!<div>A couple of questions come to mind:</div><div>How well does remote system scanning and remediation work? Using ssh as root? Wouldn't remediation of the sshd PermitRoot configuration lock root out of the system?</div><div>Are the datastream formats also produced in the ssg make process?</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 16, 2014 at 1:33 AM, Jan Lieskovsky <span dir="ltr"><<a href="mailto:jlieskov@redhat.com" target="_blank">jlieskov@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Andrew,<br>
<span class=""><br>
----- Original Message -----<br>
> From: "Andrew Gilmore" <<a href="mailto:agilmore2@gmail.com">agilmore2@gmail.com</a>><br>
> To: "SCAP Security Guide" <<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>><br>
> Sent: Thursday, October 16, 2014 12:50:08 AM<br>
> Subject: Re: [Bug 1066390] Include scap-security-guide in Red Hat Enterprise Linux 6<br>
><br>
> Woohoo! Can we confirm whether remediation scripts are included, or scanning<br>
> tools and content?<br>
<br>
</span>Both the checks & remediation scripts are included. Maybe this is right<br>
opportunity to shed more light how Red Hat Enterprise Linux system scan works.<br>
<br>
There are three major components required:<br>
* the [CLI] scanner (shipped within openscap-utils package),<br>
* the content (system checks + remediations, shipped within scap-security-guide package),<br>
* [optional] GUI tool to ease the task of checking particular system (shipped within<br>
scap-workbench package, which is for now available via EPEL-6 repository:<br>
[1] <a href="http://dl.fedoraproject.org/pub/epel/6/SRPMS/repoview/scap-workbench.html" target="_blank">http://dl.fedoraproject.org/pub/epel/6/SRPMS/repoview/scap-workbench.html</a><br>
[2] <a href="https://fedorahosted.org/scap-workbench/" target="_blank">https://fedorahosted.org/scap-workbench/</a><br>
)<br>
<br>
Given the assumption these three packages are installed, the scan can be then<br>
performed via:<br>
* oscap CLI as follows:<br>
<br>
oscap xccdf eval --profile selected_profile_here --report place_where_to_store_the_HTML_report_of_the_system_scan \<br>
path_to_rhel6_xccdf_file<br>
<br>
See oscap(8) or scap-security-guide(8) manual page for further details.<br>
<br>
* via scap-workbench tool:<br>
<br>
Once run, provide path to RHEL6 XCCDF benchmark file (either in XML<br>
form: /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml or in datastream form:<br>
/usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml) in the "Open Source Datastream or XCCDF file"<br>
dialog. Once selected, select particular profile yet (in the "Profile" select box) & see<br>
how the list of rules is refreshed. Then click the "Scan" button, see the progress & wait<br>
for the tool to finish. Once done, it's possible to see the HTML report (click the "Report"<br>
button) or save the generated artifacts for further inspection later (see "Save" select-button<br>
options).<br>
<br>
Refer to scap-workbench manual (in HTML form) for further information:<br>
<a href="https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html" target="_blank">https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html</a><br>
<br>
To perform also remediation (IOW corrections for those rules, that failed) use:<br>
* also --remediate option with the 'oscap xccdf eval ...' command above. E.g. something like:<br>
<br>
oscap xccdf eval --remediate --profile selected_profile_here --report html_path \<br>
path_to_ssg_rhel6_benchmark<br>
<br>
* when using scap-workbench tool, after loading a selected content, selecting a profile<br>
& *before* clicking the "Scan" button ensure the "Online remediation" checkbox is selected<br>
too. Then click "Scan" as normal. The difference with the previous case being that in this<br>
scenario scap-workbench besides scanning / checking the system it will also attempt remediation /<br>
corrections for cases, where the particular requirement failed (results like 'fixed' should<br>
be visible in the main scap-workbench dialog).<br>
<br>
Here again, people are encouraged to have a look at scap-workbench's user manual:<br>
<a href="https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html" target="_blank">https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html</a><br>
<br>
which provides additional information (& covers this use case / scenario & many more).<br>
<br>
To keep the reply relatively short, there's one more interesting feature of scap-workbench<br>
available yet - and that's being support for remote (via SSH) system scans. See<br>
section:<br>
<a href="https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html#_choose_the_target_machine" target="_blank">https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html#_choose_the_target_machine</a><br>
<br>
for further details. Here it's necessary to pinpoint that only content / benchmark provided in datastream<br>
(*-ds.xml) format can be used for remote system scans.<br>
<br>
Hope the above clarifies things a bit more. Should you have further questions,<br>
check oscap(8), scap-security-guide(8), scap-workbench(8) manual pages and / or<br>
the aforementioned scap-workbench HTML manual.<br>
<br>
Of course should you find some unclear bit yet (not properly covered in the manuals)<br>
or just not obvious enough at first sight, feel free to bring it here.<br>
<br>
Thank you && Regards, Jan.<br>
--<br>
Jan iankko Lieskovsky / Red Hat Security Technologies Team<br>
<div class="HOEnZb"><div class="h5"><br>
><br>
> Just had to manually download and install openscap tools to a new VM this<br>
> week, and was hoping this was coming soon.<br>
><br>
> Congratulations to all!<br>
><br>
> On Wed, Oct 15, 2014 at 4:16 PM, Greg Elin < <a href="mailto:gregelin@gitmachines.com">gregelin@gitmachines.com</a> ><br>
> wrote:<br>
><br>
><br>
><br>
> Awesome!<br>
><br>
> Greg Elin<br>
> P: <a href="tel:917-304-3488" value="+19173043488">917-304-3488</a><br>
> E: <a href="mailto:gregelin@gitmachines.com">gregelin@gitmachines.com</a><br>
><br>
> Sent from my iPhone<br>
><br>
> On Oct 15, 2014, at 4:54 PM, Shawn Wells < <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> > wrote:<br>
><br>
><br>
><br>
><br>
> You guys.<br>
><br>
> As of yesterday, SSG is now shipping natively in RHEL 6.6! A sampling of<br>
> included profiles:<br>
> - RHEL6 STIG (DoD baseline)<br>
> - CS2 (Ft Meade baseline)<br>
> - C2S (CIA commercial cloud baseline)<br>
> - Red Hat CCP (for RHEL cloud images, e.g. Amazon AMIs)<br>
> - CSCF (MLS baseline used at NRO)<br>
><br>
> The inclusion of SSG is also being picked up by the press, including<br>
> international sites/magazines:<br>
> - <a href="http://www.zdnet.com/red-hat-enterprise-linux-6-6-arrives-7000034675/" target="_blank">http://www.zdnet.com/red-hat-enterprise-linux-6-6-arrives-7000034675/</a><br>
> -<br>
> <a href="http://news.softpedia.com/news/Red-Hat-Enterprise-Linux-6-6-Arrives-with-UEFI-Support-462104.shtml" target="_blank">http://news.softpedia.com/news/Red-Hat-Enterprise-Linux-6-6-Arrives-with-UEFI-Support-462104.shtml</a><br>
> - <a href="http://www.admin-magazin.de/News/Red-Hat-Enterprise-Linux-6.6-verfuegbar" target="_blank">http://www.admin-magazin.de/News/Red-Hat-Enterprise-Linux-6.6-verfuegbar</a><br>
> - <a href="http://soft.mail.ru/pressrl_page.php?id=56721" target="_blank">http://soft.mail.ru/pressrl_page.php?id=56721</a><br>
><br>
> This inclusion reflects almost 3 years of work by the community, and brings<br>
> RHEL to a point where tooling+content is natively included for STIG<br>
> compliance. This is exceptionally badass. It's been an amazing ride to get<br>
> us here -- thank you for everyone who has participated!!<br>
><br>
> For those in the Northern VA/DC/Maryland area, an SSG happy hour is in order.<br>
> First round on me. Say next Thursday (23-OCT), DuClaws at Arundel Mills?<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> -------- Original Message --------<br>
> Subject: [Bug 1066390] Include scap-security-guide in Red Hat Enterprise<br>
> Linux 6<br>
> Date: Tue, 14 Oct 2014 06:42:15 +0000<br>
> From: <a href="mailto:bugzilla@redhat.com">bugzilla@redhat.com</a><br>
> To: <a href="mailto:swells@redhat.com">swells@redhat.com</a><br>
><br>
> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1066390" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1066390</a> errata-xmlrpc<br>
> <<a href="mailto:errata-xmlrpc@redhat.com">errata-xmlrpc@redhat.com</a>> changed:<br>
><br>
> What |Removed |Added<br>
> ----------------------------------------------------------------------------<br>
> Status|VERIFIED |CLOSED<br>
> Resolution|--- |ERRATA<br>
> Last Closed| |2014-10-14 02:42:15<br>
><br>
><br>
><br>
> --- Comment #42 from errata-xmlrpc <<a href="mailto:errata-xmlrpc@redhat.com">errata-xmlrpc@redhat.com</a>> ---<br>
> Since the problem described in this bug report should be<br>
> resolved in a recent advisory, it has been closed with a<br>
> resolution of ERRATA.<br>
><br>
> For information on the advisory, and where to find the updated<br>
> files, follow the link below.<br>
><br>
> If the solution does not work for you, open a new bug report.<br>
> <a href="http://rhn.redhat.com/errata/RHEA-2014-1471.html" target="_blank">http://rhn.redhat.com/errata/RHEA-2014-1471.html</a> --<br>
> You are receiving this mail because:<br>
> You are on the CC list for the bug.<br>
> Unsubscribe from this bug<br>
> <a href="https://bugzilla.redhat.com/token.cgi?t=9Q6ih4rslS&a=cc_unsubscribe" target="_blank">https://bugzilla.redhat.com/token.cgi?t=9Q6ih4rslS&a=cc_unsubscribe</a><br>
><br>
> --<br>
> Shawn Wells<br>
> Director, Innovation Programs <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> | <a href="tel:443.534.0130" value="+14435340130">443.534.0130</a> @shawndwells<br>
><br>
><br>
><br>
><br>
><br>
> --<br>
> SCAP Security Guide mailing list<br>
> <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
> <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
><br>
> --<br>
> SCAP Security Guide mailing list<br>
> <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
> <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
><br>
><br>
> --<br>
> SCAP Security Guide mailing list<br>
> <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
> <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br></div>