<div dir="ltr"><div class="gmail_default" style="font-size:small">Nathanael,</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">I had the same problem getting started with scanning and auditing. Below are a couple of starting points.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><b>Getting Started with scanning/auditing CentOS 6 with SCAP-Security-Guide</b></div><div class="gmail_default" style="font-size:small"><b>=============================================================</b></div><div class="gmail_default" style="font-size:small">For a quick start on auditing CentOS, see the CentOS 6 QuickStart in the README at: <a href="https://github.com/GovReady/govready" target="_blank">https://github.com/GovReady/govready</a></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The QuickStart installs my pure Bourne shell app, "GovReady," which installs OpenSCAP, SCAP-Security-Guide (SSG). Follow the QuickStart steps to make the adjustments in the OVAL test so the SSG tests for RedHat will run correctly on CentOS instead of returning "not applicable" results.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The GovReady toolkit displays all OpenSCAP commands it runs, so it can be helpful little training tool to acquaint you the specifics of using OpenSCAP.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><div class="gmail_default"><b>Getting Started with SCAP-Security-Guide in General</b></div><div class="gmail_default"><b>===========================================</b></div></div><div class="gmail_default" style="font-size:small">Forgive me if this is too basic, but I think it is good to start from zero.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><span><span style="font-size:12px;font-family:Arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">The SCAP-Security-Guide project is a project to produced open-source SCAP (Security Content Automation Protocol) for RedHat and now other Linux systems.</span></span></div><div class="gmail_default" style="font-size:small"><span><span style="font-size:12px;font-family:Arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><br></span></span></div><div class="gmail_default" style="font-size:small"><span><span style="font-size:12px;font-family:Arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap">SCAP is best thought of machine-readable "security content". That is, </span></span><span style="font-family:Arial;font-size:12px;white-space:pre-wrap">XML content describing machine-readable checks for software configuration and vulnerabilities. </span></div><div class="gmail_default" style="font-size:small"><span><span style="font-size:12px;font-family:Arial;background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><br></span></span></div><div class="gmail_default"><span style="background-color:transparent"><font face="Arial"><span style="font-size:12px;white-space:pre-wrap">SCAP is composed of several interrelated XML standards (XCCDF, OVAL, OCIL, ARF, CCE, CPE, CVE, CVSS, CCSS) -- but trying to understand how the why and how of these separate standards is confusing.</span></font></span></div><div class="gmail_default"><br></div><div class="gmail_default"><span style="background-color:transparent"><font face="Arial"><span style="font-size:12px;white-space:pre-wrap">What you really want to do is audit your CentOS server for vulnerabilities and configuration settings, right? To do that, you </span></font></span><span style="font-family:Arial;font-size:12px;white-space:pre-wrap;background-color:transparent;line-height:1.38">need the following:</span></div><span><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt">1. "scanning software" that non-intrusively scans and audits server nerd knob settings; </p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"> 2. "security content" (or "SCAP content") that describes the tests to apply to audit the server; </p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt">3. "security report" that indicates which tests passed, which tests failed, and why. </p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><br></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt">Examples of "scanning software" include RedHat's OpenSCAP, OpenVAS, FarnHall Ventures's jOVAL and Teneble's Nessus<span style="line-height:normal">. Most "security content" is provided either by a software vendor or by a third party such as Tenable that sells enterprise scanning software. This list, of course, offers SCAP-Security-Guide, which is security content in SCAP format with an open source license (Hurray!).</span></p><div class="gmail_default" style="display:inline"> </div><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="line-height:normal">The "security reports" indicating which tests have passed is generally a module built into the scanning software. Most scanning software also produces standardized XML reporting results so the content can be aggregated in other tools.</span></p></span><div><br><div class="gmail_default" style="font-size:small">Scanning/auditing a system is not really any different from installing Virus scanning software and Virus signatures content to scan your computer for viruses. But it's been my experience that SCAP feels much more complicated. I think there are three reasons why. First, the government cyber security community is a bit insular by nature. Second, scanning software is designed for scanning thousands of "end points" in the enterprise and a lot of knowledge is assumed. Finally, SCAP has not yet been packaged to be user friendly and has a steep learning curve as a standard. (It's easy to get to over 8 standards when you are trying to juggle different platforms, supporting variables, standardized tracking of vulnerabilities, etc.)</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><div class="gmail_default">Anyway, the whole point of SCAP is to automate security scanning, to have computers check other computers. That process involves the following steps:</div><div class="gmail_default"><br></div><div class="gmail_default">1. Install NIST-certified SCAP scanning software</div><div class="gmail_default">2. Download/install desired SCAP Content (e.g. security content) for your platform</div><div class="gmail_default">3. Choose the correct profile (e.g., checklist of tests)</div><div class="gmail_default">4. Run the scan</div><div class="gmail_default">5. Look at results</div><div class="gmail_default">6. Fix results</div><div class="gmail_default">7. Repeat as necessary</div><div class="gmail_default"><br></div><div class="gmail_default">Here are some links that discuss the specifics of these seven steps. </div><div><br></div><div>- <a href="http://github.com/govready" target="_blank">http://github.com/govready</a> - a toolkit designed to make server auditing friendly to developers use to work with Git.</div><div>- <a href="http://myopensourcelife.com/2013/09/08/scap-and-remediation/" target="_blank">http://myopensourcelife.com/2013/09/08/scap-and-remediation/</a> (ignore the installation information and jump down to "running a scan" to see commands</div><div>- <a href="http://people.redhat.com/swells/docs/en-US/SCAP_Security_Guide/0.1/html-single/User_Guide/index.html" target="_blank">http://people.redhat.com/swells/docs/en-US/SCAP_Security_Guide/0.1/html-single/User_Guide/index.html</a> - the SSG manual</div><div><br></div><div><div>It is pretty easy to install the scanning software of your choice, but it can be a real challenge to finding the SCAP content for your platform. Lots of SCAP is proprietary, but the SCAP-Security-Guide is working to make more scanning content available for more platforms under open source licenses. (Or at least, I think of it that way.)</div><div><br></div><div>A big gotcha that I ran into with SCAP-Security-Guide is the fact that tests are associated with RedHat platform specifically. (One of the SCAP standards, CPE, or Common Platform Enumeration, provides an explicit way of universally identifying a platform. And the SSG basic distribution tests for RedHat. So it is necessary to adjust CPE-dictionary file and the associated CPE test in the OVAL XML to get RedHat SSG tests to work properly on CentOS.)</div></div></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Send more questions if you have them...</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">best, </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Greg Elin</div><div class="gmail_default" style="font-size:small">GovReady PBC</div><div class="gmail_default" style="font-size:small">e gregelin@gitmachines</div><div class="gmail_default" style="font-size:small">m 917-304-3488</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 20, 2015 at 2:24 PM, Nathanael D. Noblet <span dir="ltr"><<a href="mailto:nathanael@gnat.ca" target="_blank">nathanael@gnat.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hello,<br>
<br>
We tend to use CentOS for most of our servers. All legacy servers are<br>
6, we have two new v7 servers.<br>
<br>
I would like to learn how to perform some of these audits that the<br>
guide provides. I looked at it a few months back but never got to the<br>
point of having it work successfully.<br>
<br>
Does anyone know of documentation on how to use the guide with CentOS?<br>
I know v7 isn't quite ready? I'm also wondering if there are public<br>
locations for standards like PCI DSS, HIPAA, or other high security<br>
'generally accepted' standards etc.<br>
<span><font color="#888888"><br>
--<br>
Nathanael<br>
<br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></font></span></blockquote></div><br></div></div></div>