scap-security-guide September 2014

scap-security-guide@lists.fedorahosted.org

23 participants
27 discussions

SCAP Security Guide - make validate fails after make templates run
by Paul Urwin 04 Sep '14

04 Sep '14

Hello Everyone, I'm hoping you can help put me out of my misery! I've taken the latest version of scap-security-guide # git clone https://git.fedorahosted.org/git/scap-security-guide.git And I've been trying to run "make content; make validate" on the RHEL/6 directory... ... if I do a fresh git clone and run it, it is successful and the validate completes ok. ...if i first go into the RHEL/6/input/checks/templates directory and run "make templates; make copy" ....and then run the "make content; make validate" it fails: paul@myhost:/tmp/ssg3/scap-security-guide/RHEL/6> make validate oscap xccdf validate-xml output/ssg-rhel6-xccdf.xml oscap oval validate-xml output/ssg-rhel6-oval.xml oscap oval validate-xml output/ssg-rhel6-cpe-oval.xml cd output; ../utils/verify-references.py --rules-with-invalid-checks --ovaldefs-unused ssg-rhel6-xccdf.xml /tmp/ssg3/scap-security-guide/RHEL/6/output OVAL Check is not referenced by XCCDF: oval:ssg:def:556 make: *** [validate] Error 1 ...this is a bug of some kind right? Thanks! Paul

5 5

Test run of Jenkins (CI tool)
by Shawn Wells 04 Sep '14

04 Sep '14

Also in the vein of automation, went ahead and installed an instance of Jenkins and connected it to SSG: http://jenkins.ssgproject.org:8080/ Not meant to be permanent right now, but wanted to get something stood up for us to play with. Martin stood one up for the OpenSCAP interpreter, which was the source of thinking to stand up a sandbox for SSG too. There really isn't much to see in the UI, but one thing it does is integrate into GitHub. Whenever someone issues a pull request, Jenkins will automagically detect that, apply the patch(s), and run "make validate." Check out https://github.com/OpenSCAP/scap-security-guide/pull/45 for an example. Or for the lazy :-), see below: When you click on Details, you're brought to an overview of the patch and can even see console output of the build (in case there were errors): http://jenkins.ssgproject.org:8080/job/scap-security-guide/24/console Having this in place should afford the peer reviewers an immediate answer to "does this validate?" Longer term, this could also enable unit checks of the OVAL and bash scripts. Does anyone have experience with Jenkins, thoughts on how we could begin building out unit tests, or really any thoughts on usefulness beyond "make validate" on pull requests?

6 11

No OVAL checks for Rules "httpd_servertokens_prod" and "httpd_serversignature_off"
by Ronald 04 Sep '14

04 Sep '14

Hello list, I just wanted to know if it was on purpose that the xccdf rules "httpd_servertokens_prod" and "httpd_serversignature_off" have no OVAL checks defined/written? I suppose it has something to do with the difficulty to write the most valid test. Considering that just testing for ServerToken and signature in httpd.conf might not be enough to guarantee that the setting is enabled. Correct? Thanks in advance for your feedback. Ronald

2 1

Audit .rule files location
by Greg Elin 04 Sep '14

04 Sep '14

Shawn, You indicated that the .rule files are available as part of SSG? Can you please remind me where these are located? Thanks. Greg Elin http://govready.org - Making FISMA compliance easier for innovators email: gregelin(a)gitmachines.com phone: 917-304-3488

2 3

Test run of landscape.io (python code quality checks)
by Shawn Wells 03 Sep '14

03 Sep '14

Generally speaking, we really haven't had much automation in terms of builds and code quality checks. I stumbled across landscape.io, which scans source code repositories for things like syntax issues, errors, and coding style. Went ahead and signed up (it's free for open source projects). You can check out the findings here: https://landscape.io/github/OpenSCAP/scap-security-guide/master If you scroll to the bottom right of that page, you will see the "See all files" button. Users are then presented with the ability to dive into the landscape.io's findings. Today the tool only scans Python, and for that it's given us a "71% / Good" rating.... your guess is as good as mine on how it weighs things. For those who know python: what do you think of the findings? Are they worth cleaning up? In theory this should really help keep tabs on generic coding practices. p.s. I went ahead and had landscape.io scan all the OpenSCAP projects... for those curious: 100% - https://landscape.io/github/OpenSCAP/foreman-proxy_openscap 100% - https://landscape.io/github/OpenSCAP/foreman_openscap 38% - https://landscape.io/github/OpenSCAP/openscap 79% - https://landscape.io/github/OpenSCAP/oscap-anaconda-addon 100% - https://landscape.io/github/OpenSCAP/puppet-foreman_openscap 100% - https://landscape.io/github/OpenSCAP/puppet-openscap 100% - https://landscape.io/github/OpenSCAP/ruby-openscap 71% - https://landscape.io/github/OpenSCAP/scap-security-guide 100% - https://landscape.io/github/OpenSCAP/scap-workbench 100% - https://landscape.io/github/OpenSCAP/scaptimony 75% - https://landscape.io/github/OpenSCAP/sce-community-content [again, who knows how these %'s are weighed/generated]

2 1

New report and guide in openscap 1.1.0
by Martin Preisler 02 Sep '14

02 Sep '14

Hi, as you may know I have been working on a complete rewrite of HTML report and guide for the upcoming openscap 1.1.0 release. It's a feature that will touch almost every user of openscap. I would like to gather feedback from the scap-security-guide community so that we can make sure there aren't any blocker issues in the release. It is natural that there will be small issues that we will iron out in minor releases. Basically we would just like to make sure the new report and guide aren't missing anything crucial that would prevent adoption. See https://mpreisle.fedorapeople.org/openscap/1.1.0_xslt/ for sample HTML report and guide from SSG for RHEL6. Looking forward to feedback. -- Martin Preisler

8 30

Re: New report and guide in openscap 1.1.0
by Gabe Alford 01 Sep '14

01 Sep '14

On Fri, Aug 29, 2014 at 3:37 AM, Martin Preisler <mpreisle(a)redhat.com> wrote: > ----- Original Message ----- > > From: "Andrew Gilmore" <agilmore2(a)gmail.com> > > To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org> > > Sent: Thursday, August 28, 2014 8:29:48 PM > > Subject: Re: New report and guide in openscap 1.1.0 > > > > I like the new look and functionality. > > > > Two first blush comments: > > 1) On the report document, I can imagine my security officials freaking > out > > over the in-your-face "*The system is not compliant!*" text. What is the > > recommended course to ensure this text does not appear if you're running > > the scan on a webserver, for example? Is it as simple as creating a > custom > > profile derived from the STIG profile? Does anyone directly use the STIG > > profile, have a completely compliant system, and have a server that > > actually does anything useful? > > Up to now, I've left tests in that I have waivers for, and then pointed > at > > the waivers to justify the test failures. Perhaps I will need to change > > that practice. > > Isn't that a good thing? They should freak out, their system is not > compliant! > The recommended course is to tailor the profile, leaving out rules that > make > no sense on your system. Then you fix the remaining rules using > remediation. > In the end the machine will be compliant. > I would maybe add or modify the message here to be something along the lines: - "The system is not compliant! Please review rule results, site/network security requirements, and consider applying remediation." --- or --- - "The system may not be compliant! Please review rule results, site/network security requirements, and consider applying remediation." I personally would prefer the last one as it says, "Hey. Check your system as well as check your security requirements to see if what you are seeing from the scan matches with those security requirements." The job of openscap is to check your machines for compliance over and over. > When the machines are suddenly not compliant you really want to know that! > > > 2) On the guide document, the text beginning "Providing system > > administrators" occurs twice. > > Looks like an issue with SSG but I will look more into it. > > -- > Martin Preisler > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/ >

4 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2014