scap-security-guide April 2012

scap-security-guide@lists.fedorahosted.org

12 participants
70 discussions

adding fixes -- a proposed patch
by Jeffrey Blank 18 Apr '12

18 Apr '12

Attached is a patch that demonstrates a method for adding fixes in a modular way. It should allow fixes from different "systems" (bash, puppet, chef(?), well whatever) and even different sets of fixes from the same "system" (such as different sets of Puppet modules designed for different use cases) to be linked into XCCDF output easily, and also would keep remediation resources discrete from both each other and the main project. It depends on linkage to Rules via id. Comments are solicited.

2 2

httpd related patches
by Willy Santos 18 Apr '12

18 Apr '12

All, Attached you will find the httpd patches I've been working on for the Team's review. Forgive the amount of files, there was a lot of content to be added and some changes done after further review of the initial commits, brief description below. Feel free to contact me if you have any questions. 0001,0002,0004,0017 - Prose content for http.xml 0003,0005,0006,0007, 0008, 0009, 0010, 0011, 0018 - OVAL checks related to httpd -Willy -- Willy Santos, RHCE Consultant Red Hat Consulting Cell: +1 (301) 254-7077 Email: wsantos(a)redhat.com

1 1

[PATCH] added transform to map SRG elements to guidance Rules
by Jeffrey Blank 09 Apr '12

09 Apr '12

--- rhel6/src/transforms/table-srgmap.xslt | 117 ++++++++++++++++++++++++++++++++ 1 files changed, 117 insertions(+), 0 deletions(-) create mode 100644 rhel6/src/transforms/table-srgmap.xslt diff --git a/rhel6/src/transforms/table-srgmap.xslt b/rhel6/src/transforms/table-srgmap.xslt new file mode 100644 index 0000000..a502d24 --- /dev/null +++ b/rhel6/src/transforms/table-srgmap.xslt @@ -0,0 +1,117 @@ +<?xml version="1.0" encoding="utf-8" standalone="yes"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> + + + +<xsl:include href="constants.xslt"/> + +<xsl:variable name="rules" select="document($map-to-rules)//cdf:Rule" /> + +<xsl:variable name="title" select="document($map-to-rules)/cdf:Benchmark/cdf:title" /> + + <xsl:template match="/"> + <html> + <head> + <title> + CCIs from <xsl:value-of select="cdf:Benchmark/cdf:title"/> Mapped to <xsl:value-of select="$title"/> + </title> + </head> + <body> + <br/> <br/> + <div style="text-align: center; font-size: x-large; font-weight:bold"> + CCIs from <xsl:value-of select="cdf:Benchmark/cdf:title"/> Mapped to <xsl:value-of select="$title"/> + </div> + <br/> <br/> + <xsl:apply-templates select="cdf:Benchmark"/> + </body> + </html> + </xsl:template> + + + <xsl:template match="cdf:Benchmark"> + <style type="text/css"> + table + { + border-collapse:collapse; + } + table,th, td + { + border: 1px solid black; + vertical-align: top; + padding: 3px; + } + thead + { + display: table-header-group; + font-weight: bold; + } + </style> + <table> + <thead> + <td>SRG ID</td> + <td>CCI ID</td> + <td>SRG Title</td> + <td>SRG Description</td> + <td>Rules Mapped</td> + </thead> + <xsl:for-each select=".//cdf:Rule"> + <xsl:sort select="cdf:version"/> + <xsl:call-template name="output-rule-info"> + <xsl:with-param name="srg_id"><xsl:value-of select="cdf:version"/></xsl:with-param> + <xsl:with-param name="srg_cci"><xsl:value-of select="cdf:ident"/></xsl:with-param> + <xsl:with-param name="srg_title"><xsl:value-of select="cdf:title"/></xsl:with-param> + <xsl:with-param name="srg_desc"><xsl:value-of select="cdf:description"/></xsl:with-param> + </xsl:call-template> + </xsl:for-each> + </table> + </xsl:template> + + <xsl:template name="output-rule-info"> + <xsl:param name="srg_id" /> + <xsl:param name="srg_cci" /> + <xsl:param name="srg_title" /> + <xsl:param name="srg_desc" /> + <tr> + <td> <xsl:value-of select="$srg_id"/> </td> + <td> <xsl:value-of select="$srg_cci"/> </td> + <td> <xsl:value-of select="$srg_title"/> </td> + <td> <xsl:value-of select="$srg_desc"/> </td> + <td> +  + <xsl:for-each select="$rules"> + <xsl:variable name="rule" select="."/> + <table> + <xsl:for-each select="cdf:ident[@system='http://iase.disa.mil/cci/index.html']"> + <xsl:if test="self::node()[text()=$srg_cci]" > + <tr> + <td> <xsl:value-of select="$rule/cdf:title"/> </td> + <td> <xsl:apply-templates select="$rule/cdf:description"/> </td> + </tr> + </xsl:if> + </xsl:for-each> + </table> + </xsl:for-each> + </td> + </tr> + </xsl:template> + +  + <xsl:template match="xhtml:*"> + <xsl:element name="{local-name()}"> + <xsl:apply-templates select="node()|@*"/> + </xsl:element> + </xsl:template> + + <xsl:template match="@*|node()"> + <xsl:copy> + <xsl:apply-templates select="@*|node()"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="cdf:description"> + <xsl:apply-templates select="@*|node()" /> + </xsl:template> + +</xsl:stylesheet> -- 1.7.1

1 0

SSG M1 Objectives
by Kevin Spargur 05 Apr '12

05 Apr '12

Hey all, I've done a quick review of the SSG as far as were we stand in comparison milestone 1 objectives. We are missing roughly 195/634 or about 31% of the line items needed to meet milestone 1. The exact line items missing are specified in the attached. I've opened tickets for each piece up on the SSG site (https://fedorahosted.org/scap-security-guide/report/2) If your working on a section it would be great if you took the ticket so we can try and avoid duplication of effort where possible. Thanks, Kevin Spargur

4 13

the rules for adding Rules
by Jeffrey Blank 04 Apr '12

04 Apr '12

I've added some guidelines for what constitutes good Rule-writing to the wiki at: https://fedorahosted.org/scap-security-guide/wiki/newxccdf (This is also linked from the main page in "How to Create a New Guidance Item in XCCDF"). TLDR? Perhaps. But there are a few recent commits that provided excellent content but which I may reformat to be consistent with these guidelines.

1 0

coming soon: consistency checking scripts
by Jeffrey Blank 03 Apr '12

03 Apr '12

We'll shortly be committing a script to do checking for consistency between our OVAL and XCCDF. This should detect situations such as: 1) a reference from an XCCDF rule to an OVAL definition that doesn't exist. 2) an XCCDF rule exists (and is used in a profile) but doesn't include any reference to a check. 3) mismatch between filename and OVAL definition name (as this is an important convention for our approach to modular definitions) 4) others? -- ___________________________ Jeffrey Blank 410-854-8675 Global Mitigations NSA Information Assurance

9 31

[PATCH] Added 'make rpm'
by Shawn Wells 02 Apr '12

02 Apr '12

4 8

[PATCH] Moved dist/ to input/dist_template
by Shawn Wells 02 Apr '12

02 Apr '12

2 1

[patch] Ident element should represent a single identifier.
by Šimon Lukašík 02 Apr '12

02 Apr '12

Attached please find a patch to split up multiple values within single ident element. It avoids things like the following <ident system="http://cce.mitre.org"> 4360-4,4378-6,4492-5,4263-0,3502-2,4449-5, 4361-2,4427-1,4321-6,4339-8,4105-3,3718-4 </ident> The separations will also help applications (Spacewalk for example) with data processing, storing to database, etc. Thank You. -- Simon Lukasik

2 1

Content of Ident elements
by Šimon Lukašík 02 Apr '12

02 Apr '12

Hello list, In the current content there seems to be mixed two approaches how to devise the ident: (1) <ident system="http://cce.mitre.org">4365-3</ident> (2) <ident system="http://cce.mitre.org">CCE-4112-9</ident> I would like to not mix two. For instance usgsb-for-rhel5-desktop uses exclusively the latter one. Even thought in the second approach there seems to be kind of duplicity, I prefer it. Would be a patch converting (1) to (2) acceptable for you? -- Simon Lukasik

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2012