<div dir="ltr">Thanks Jan!<div>A couple of questions come to mind:</div><div>How well does remote system scanning and remediation work? Using ssh as root? Wouldn&#39;t remediation of the sshd PermitRoot configuration lock root out of the system?</div><div>Are the datastream formats also produced in the ssg make process?</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 16, 2014 at 1:33 AM, Jan Lieskovsky <span dir="ltr">&lt;<a href="mailto:jlieskov@redhat.com" target="_blank">jlieskov@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Andrew,<br>
<span class=""><br>
----- Original Message -----<br>
&gt; From: &quot;Andrew Gilmore&quot; &lt;<a href="mailto:agilmore2@gmail.com">agilmore2@gmail.com</a>&gt;<br>
&gt; To: &quot;SCAP Security Guide&quot; &lt;<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;<br>
&gt; Sent: Thursday, October 16, 2014 12:50:08 AM<br>
&gt; Subject: Re: [Bug 1066390] Include scap-security-guide in Red Hat Enterprise  Linux 6<br>
&gt;<br>
&gt; Woohoo! Can we confirm whether remediation scripts are included, or scanning<br>
&gt; tools and content?<br>
<br>
</span>Both the checks &amp; remediation scripts are included. Maybe this is right<br>
opportunity to shed more light how Red Hat Enterprise Linux system scan works.<br>
<br>
There are three major components required:<br>
* the [CLI] scanner (shipped within openscap-utils package),<br>
* the content (system checks + remediations, shipped within scap-security-guide package),<br>
* [optional] GUI tool to ease the task of checking particular system (shipped within<br>
scap-workbench package, which is for now available via EPEL-6 repository:<br>
  [1] <a href="http://dl.fedoraproject.org/pub/epel/6/SRPMS/repoview/scap-workbench.html" target="_blank">http://dl.fedoraproject.org/pub/epel/6/SRPMS/repoview/scap-workbench.html</a><br>
  [2] <a href="https://fedorahosted.org/scap-workbench/" target="_blank">https://fedorahosted.org/scap-workbench/</a><br>
)<br>
<br>
Given the assumption these three packages are installed, the scan can be then<br>
performed via:<br>
* oscap CLI as follows:<br>
<br>
  oscap xccdf eval --profile selected_profile_here --report place_where_to_store_the_HTML_report_of_the_system_scan \<br>
  path_to_rhel6_xccdf_file<br>
<br>
See oscap(8) or scap-security-guide(8) manual page for further details.<br>
<br>
* via scap-workbench tool:<br>
<br>
  Once run, provide path to RHEL6 XCCDF benchmark file (either in XML<br>
  form: /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml or in datastream form:<br>
  /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml) in the &quot;Open Source Datastream or XCCDF file&quot;<br>
  dialog. Once selected, select particular profile yet (in the &quot;Profile&quot; select box) &amp; see<br>
  how the list of rules is refreshed. Then click the &quot;Scan&quot; button, see the progress &amp; wait<br>
  for the tool to finish. Once done, it&#39;s possible to see the HTML report (click the &quot;Report&quot;<br>
  button) or save the generated artifacts for further inspection later (see &quot;Save&quot; select-button<br>
  options).<br>
<br>
  Refer to scap-workbench manual (in HTML form) for further information:<br>
    <a href="https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html" target="_blank">https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html</a><br>
<br>
To perform also remediation (IOW corrections for those rules, that failed) use:<br>
* also --remediate option with the &#39;oscap xccdf eval ...&#39; command above. E.g. something like:<br>
<br>
  oscap xccdf eval --remediate --profile selected_profile_here --report html_path \<br>
  path_to_ssg_rhel6_benchmark<br>
<br>
* when using scap-workbench tool, after loading a selected content, selecting a profile<br>
  &amp; *before* clicking the &quot;Scan&quot; button ensure the &quot;Online remediation&quot; checkbox is selected<br>
  too. Then click &quot;Scan&quot; as normal. The difference with the previous case being that in this<br>
  scenario scap-workbench besides scanning / checking the system it will also attempt remediation /<br>
  corrections for cases, where the particular requirement failed (results like &#39;fixed&#39; should<br>
  be visible in the main scap-workbench dialog).<br>
<br>
  Here again, people are encouraged to have a look at scap-workbench&#39;s user manual:<br>
    <a href="https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html" target="_blank">https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html</a><br>
<br>
  which provides additional information (&amp; covers this use case / scenario &amp; many more).<br>
<br>
To keep the reply relatively short, there&#39;s one more interesting feature of scap-workbench<br>
available yet - and that&#39;s being support for remote (via SSH) system scans. See<br>
section:<br>
  <a href="https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html#_choose_the_target_machine" target="_blank">https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html#_choose_the_target_machine</a><br>
<br>
for further details. Here it&#39;s necessary to pinpoint that only content / benchmark provided in datastream<br>
(*-ds.xml) format can be used for remote system scans.<br>
<br>
Hope the above clarifies things a bit more. Should you have further questions,<br>
check oscap(8), scap-security-guide(8), scap-workbench(8) manual pages and / or<br>
the aforementioned scap-workbench HTML manual.<br>
<br>
Of course should you find some unclear bit yet (not properly covered in the manuals)<br>
or just not obvious enough at first sight, feel free to bring it here.<br>
<br>
Thank you &amp;&amp; Regards, Jan.<br>
--<br>
Jan iankko Lieskovsky / Red Hat Security Technologies Team<br>
<div class="HOEnZb"><div class="h5"><br>
&gt;<br>
&gt; Just had to manually download and install openscap tools to a new VM this<br>
&gt; week, and was hoping this was coming soon.<br>
&gt;<br>
&gt; Congratulations to all!<br>
&gt;<br>
&gt; On Wed, Oct 15, 2014 at 4:16 PM, Greg Elin &lt; <a href="mailto:gregelin@gitmachines.com">gregelin@gitmachines.com</a> &gt;<br>
&gt; wrote:<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; Awesome!<br>
&gt;<br>
&gt; Greg Elin<br>
&gt; P: <a href="tel:917-304-3488" value="+19173043488">917-304-3488</a><br>
&gt; E: <a href="mailto:gregelin@gitmachines.com">gregelin@gitmachines.com</a><br>
&gt;<br>
&gt; Sent from my iPhone<br>
&gt;<br>
&gt; On Oct 15, 2014, at 4:54 PM, Shawn Wells &lt; <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> &gt; wrote:<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; You guys.<br>
&gt;<br>
&gt; As of yesterday, SSG is now shipping natively in RHEL 6.6! A sampling of<br>
&gt; included profiles:<br>
&gt; - RHEL6 STIG (DoD baseline)<br>
&gt; - CS2 (Ft Meade baseline)<br>
&gt; - C2S (CIA commercial cloud baseline)<br>
&gt; - Red Hat CCP (for RHEL cloud images, e.g. Amazon AMIs)<br>
&gt; - CSCF (MLS baseline used at NRO)<br>
&gt;<br>
&gt; The inclusion of SSG is also being picked up by the press, including<br>
&gt; international sites/magazines:<br>
&gt; - <a href="http://www.zdnet.com/red-hat-enterprise-linux-6-6-arrives-7000034675/" target="_blank">http://www.zdnet.com/red-hat-enterprise-linux-6-6-arrives-7000034675/</a><br>
&gt; -<br>
&gt; <a href="http://news.softpedia.com/news/Red-Hat-Enterprise-Linux-6-6-Arrives-with-UEFI-Support-462104.shtml" target="_blank">http://news.softpedia.com/news/Red-Hat-Enterprise-Linux-6-6-Arrives-with-UEFI-Support-462104.shtml</a><br>
&gt; - <a href="http://www.admin-magazin.de/News/Red-Hat-Enterprise-Linux-6.6-verfuegbar" target="_blank">http://www.admin-magazin.de/News/Red-Hat-Enterprise-Linux-6.6-verfuegbar</a><br>
&gt; - <a href="http://soft.mail.ru/pressrl_page.php?id=56721" target="_blank">http://soft.mail.ru/pressrl_page.php?id=56721</a><br>
&gt;<br>
&gt; This inclusion reflects almost 3 years of work by the community, and brings<br>
&gt; RHEL to a point where tooling+content is natively included for STIG<br>
&gt; compliance. This is exceptionally badass. It&#39;s been an amazing ride to get<br>
&gt; us here -- thank you for everyone who has participated!!<br>
&gt;<br>
&gt; For those in the Northern VA/DC/Maryland area, an SSG happy hour is in order.<br>
&gt; First round on me. Say next Thursday (23-OCT), DuClaws at Arundel Mills?<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; -------- Original Message --------<br>
&gt; Subject:      [Bug 1066390] Include scap-security-guide in Red Hat Enterprise<br>
&gt; Linux 6<br>
&gt; Date:         Tue, 14 Oct 2014 06:42:15 +0000<br>
&gt; From:         <a href="mailto:bugzilla@redhat.com">bugzilla@redhat.com</a><br>
&gt; To:   <a href="mailto:swells@redhat.com">swells@redhat.com</a><br>
&gt;<br>
&gt; <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1066390" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1066390</a> errata-xmlrpc<br>
&gt; &lt;<a href="mailto:errata-xmlrpc@redhat.com">errata-xmlrpc@redhat.com</a>&gt; changed:<br>
&gt;<br>
&gt;            What    |Removed                     |Added<br>
&gt; ----------------------------------------------------------------------------<br>
&gt;              Status|VERIFIED                    |CLOSED<br>
&gt;          Resolution|---                         |ERRATA<br>
&gt;         Last Closed|                            |2014-10-14 02:42:15<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; --- Comment #42 from errata-xmlrpc &lt;<a href="mailto:errata-xmlrpc@redhat.com">errata-xmlrpc@redhat.com</a>&gt; ---<br>
&gt; Since the problem described in this bug report should be<br>
&gt; resolved in a recent advisory, it has been closed with a<br>
&gt; resolution of ERRATA.<br>
&gt;<br>
&gt; For information on the advisory, and where to find the updated<br>
&gt; files, follow the link below.<br>
&gt;<br>
&gt; If the solution does not work for you, open a new bug report.<br>
&gt; <a href="http://rhn.redhat.com/errata/RHEA-2014-1471.html" target="_blank">http://rhn.redhat.com/errata/RHEA-2014-1471.html</a> --<br>
&gt; You are receiving this mail because:<br>
&gt; You are on the CC list for the bug.<br>
&gt; Unsubscribe from this bug<br>
&gt; <a href="https://bugzilla.redhat.com/token.cgi?t=9Q6ih4rslS&amp;a=cc_unsubscribe" target="_blank">https://bugzilla.redhat.com/token.cgi?t=9Q6ih4rslS&amp;a=cc_unsubscribe</a><br>
&gt;<br>
&gt; --<br>
&gt; Shawn Wells<br>
&gt; Director, Innovation Programs <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> | <a href="tel:443.534.0130" value="+14435340130">443.534.0130</a> @shawndwells<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; --<br>
&gt; SCAP Security Guide mailing list<br>
&gt; <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
&gt; <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
&gt; <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
&gt;<br>
&gt; --<br>
&gt; SCAP Security Guide mailing list<br>
&gt; <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
&gt; <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
&gt; <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
&gt;<br>
&gt;<br>
&gt; --<br>
&gt; SCAP Security Guide mailing list<br>
&gt; <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
&gt; <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
&gt; <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br></div>