March 2012 - scap-security-guide - Fedora mailing-lists

SSG M1 Objectives
by Kevin Spargur 05 Apr '12

05 Apr '12

Hey all, I've done a quick review of the SSG as far as were we stand in comparison milestone 1 objectives. We are missing roughly 195/634 or about 31% of the line items needed to meet milestone 1. The exact line items missing are specified in the attached. I've opened tickets for each piece up on the SSG site (https://fedorahosted.org/scap-security-guide/report/2) If your working on a section it would be great if you took the ticket so we can try and avoid duplication of effort where possible. Thanks, Kevin Spargur

4 13

coming soon: consistency checking scripts
by Jeffrey Blank 03 Apr '12

03 Apr '12

We'll shortly be committing a script to do checking for consistency between our OVAL and XCCDF. This should detect situations such as: 1) a reference from an XCCDF rule to an OVAL definition that doesn't exist. 2) an XCCDF rule exists (and is used in a profile) but doesn't include any reference to a check. 3) mismatch between filename and OVAL definition name (as this is an important convention for our approach to modular definitions) 4) others? -- ___________________________ Jeffrey Blank 410-854-8675 Global Mitigations NSA Information Assurance

9 31

[patch] Ident element should represent a single identifier.
by Šimon Lukašík 02 Apr '12

02 Apr '12

Attached please find a patch to split up multiple values within single ident element. It avoids things like the following <ident system="http://cce.mitre.org"> 4360-4,4378-6,4492-5,4263-0,3502-2,4449-5, 4361-2,4427-1,4321-6,4339-8,4105-3,3718-4 </ident> The separations will also help applications (Spacewalk for example) with data processing, storing to database, etc. Thank You. -- Simon Lukasik

2 1

Content of Ident elements
by Šimon Lukašík 02 Apr '12

02 Apr '12

Hello list, In the current content there seems to be mixed two approaches how to devise the ident: (1) <ident system="http://cce.mitre.org">4365-3</ident> (2) <ident system="http://cce.mitre.org">CCE-4112-9</ident> I would like to not mix two. For instance usgsb-for-rhel5-desktop uses exclusively the latter one. Even thought in the second approach there seems to be kind of duplicity, I prefer it. Would be a patch converting (1) to (2) acceptable for you? -- Simon Lukasik

2 2

severity tags assigned to all Rules
by Jeffrey Blank 20 Mar '12

20 Mar '12

Just in case anyone was curious, severity tags are now assigned to all Rules. This should help ensure that the content meets the needs of customers who require this. Earlier, "high" and "medium" values were manually added to the severity attribute for each XCCDF Rule (in line with corresponding DIACAP definitions and influenced by previous STIGs). For other Rules (the majority), the shorthand2xccdf.xslt transform was tweaked to automatically add severity="low" if no severity was specified. So the default case should be easy for authoring. This could easily be shown in the html tables ("spreadsheets" if you wish) too.. Jeff

1 0

PATCHes followup, new dist dir to support packaging
by Jeffrey Blank 20 Mar '12

20 Mar '12

Hello all, In keeping with the goal of Shawn's recent patch submissions, I added a "dist" directory and placed some of the new information there. This should put us on a patch to providing an RPM form of our output (and the directories there should clarify our goals as well). Note that the files in the "output" directory are not necessarily final output, and at this time some of the scripts assume that they live in a flat directory. The files in output may be further transformed (or may in fact be final output). Lifting from "output" into "dist" shoud signify an intent to distribute as final product. Thanks, Jeff

1 0

[PATCH] Made output/README a vim friendly
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH 3/3] Updated Makefile to backout directory breakouts
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH 2/3] Added back in output/.gitignore
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH 1/3] In attempting to breakout the content into subdirectories I broke the XCCDF to OVAL mappings, and I can't seem to piece them back together again. Reverting my changes by
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH 3/3] Created output/README
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH 2/3] Updated 'make clean' to remove content directories
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH 1/3] Added back in output/ and output/.gitignore
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

[PATCH] Restructured output/ Directory
by Shawn Wells 17 Mar '12

17 Mar '12

1 0

typo and a question
by David Egts 14 Mar '12

14 Mar '12

Hi all, I'm trying out SSG. Great work! I think I noticed a typo. Search for "veal" here and I think it should be "eval"... https://fedorahosted.org/scap-security-guide/ And now on to the question... :-) Does SSG generate (or plan to generate) remediation content? Check the very bottom of this page for an example... http://dev.gentoo.org/~swift/docs/genoval.xml I tried "generate fix" with the SSG content, but the resulting script was empty. I guess I'm not sure if I'm doing something wrong, or if more needs to be added to SSG to provide remediation capabilities. Thanks! Dave -- David D. Egts, RHCA, RHCSS #805007796228001 Principal Architect, Red Hat, Inc.

2 3

RE: coming soon: consistency checking scripts
by Mike Palmiotto 13 Mar '12

13 Mar '12

>On 03/12/2012 10:26 PM, Shawn Wells wrote: >> On 3/12/12 5:59 PM, Jeffrey Blank wrote: >>> We'll shortly be committing a script to do checking for consistency >>> between our OVAL and XCCDF. This should detect situations such as: >>> >>> 1) >>> a reference from an XCCDF rule to an OVAL definition that doesn't >>>exist. >>> >>> 2) >>> an XCCDF rule exists (and is used in a profile) but doesn't include >>> any reference to a check. >>> >>> 3) >>> mismatch between filename and OVAL definition name (as this is an >>> important convention for our approach to modular definitions) >> >> I think the following would be helpful too: >> >> 4) >> An XCCDF rule exists and isn't used in a profile >> >> 5) >> Any checks that are not present in an XCCDF rule >> (I can't imagine there would actually be any of these given how we've >> been making XCCFD then the checks, but it'd be good to watch for) There doesn't seem to be a way to add new prose (ie from the SNAC guide) to the scap-security-guide, due to issues with well-formedness. File names, Linux keywords, and config file settings are wrapped in <xhtml:code> and <xhtml:pre> tags in ssg, but not in the SNAC guide, so anything that isn't well-formed within the SNAC prose breaks the xccdf. There are also some cases where these settings are well-formed, but are still wrapped in the namespace (xhtml:code/pre) tags within the scap-security-guide. I'd like to keep the SNAC+scap-sec-guide merge consistent with the previous security-guide, but I can't seem to find an all-encompassing set of conditions to systematically add these tags where appropriate. I'm wondering if you guys know of a way to do this (other than manually). If not, this would be great functionality to add for future use. If no one else is currently doing so, I'd like to work on it. --Mike

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide March 2012