scap-security-guide September 2012

scap-security-guide@lists.fedorahosted.org

18 participants
92 discussions

Start a nNew thread

[PATCH] OCIL clause tags added to 6 files in the /input dir
by Michael J. McConachie 25 Sep '12

25 Sep '12

2 2

[PATCH 0/2] Minor OCIL additions
by David Smith 25 Sep '12

25 Sep '12

David Smith (2): added OCIL checks commented out vestige of variable display RHEL6/input/services/ftp.xml | 6 +++- RHEL6/input/services/ldap.xml | 4 +++ RHEL6/input/services/mail.xml | 5 ++++ RHEL6/input/services/ssh.xml | 23 ++++++++++++++++++++++ RHEL6/transforms/xccdf2table-profileccirefs.xslt | 5 +-- 5 files changed, 38 insertions(+), 5 deletions(-)

3 4

macro notes / authoring
by Jeffrey Blank 25 Sep '12

25 Sep '12

For our viewers at home who are seeing some of the recent commits and wondering what's up: In the "shorthand XCCDF" in input/system and input/services, we've got stuff like: <ocil><package-check-macro package="xinetd" /> </ocil> The package-remove-macro (and many other macros) are defined in transforms/shorthand2xccdf.xslt, which inserts the lines of text that you'd expect to see for a manual check. In this case, it's text that describes how you'd check to see whether that package is installed. See: <xsl:template match="package-check-macro"> Run the following command to determine if the <xhtml:code><xsl:value-of select="@package"/></xhtml:code> package is installed: <xhtml:pre># rpm -q <xsl:value-of select="@package"/> </xhtml:pre> </xsl:template> This way, if we need to change the language in the entire project that describes how you check for a package being installed, it's easy to do at once. There is also support for adding boilerplate remarks with the text, by providing the conditional clause which describes non-compliance. This clause can be provided by adding a clause= attribute to the ocil tag. (And yes, other transforms take care of generating the 100 lines of XML that make it proper OCIL.) A commit I've just made takes care of also adding that clause= attribute automatically, for those checks which contain a macro. An example of all of this coming together is in RHEL6/output/rhel6-table-stig-server-shorttitles.html (don't forget to git pull; make tables)

1 0

[PATCH 0/4] automatic clause insertion for check texts with macros
by Jeffrey Blank 25 Sep '12

25 Sep '12

This is to allow easy generation of "if [clause], this is a finding" or whatever robotic boilerplate text is needed, in the event that your state of compliance is somehow not apparent after performing a manual check. Jeffrey Blank (4): fixes to check text for services typo fixes to checks in auditing section typo fixes for service checks support for including clauses with macro-ized check texts RHEL6/input/services/dns.xml | 4 +- RHEL6/input/services/ftp.xml | 6 ++-- RHEL6/input/services/http.xml | 6 ++-- RHEL6/input/services/obsolete.xml | 17 +++++++------ RHEL6/input/services/smb.xml | 4 ++- RHEL6/input/system/auditing.xml | 8 +++--- RHEL6/transforms/shorthand2xccdf.xslt | 28 +++++++++++++++++---- RHEL6/transforms/xccdf2table-profileccirefs.xslt | 2 +- 8 files changed, 47 insertions(+), 28 deletions(-)

1 4

short-term goals update
by Jeffrey Blank 25 Sep '12

25 Sep '12

Very short term goal update: Michael will work on adding "clause=" attributes to each <ocil> tag in order to have statements like "If [clause], this is a finding" generated automatically at the end of each check. I will be working on getting the necessary transform for this working in very short order (by making augmentations to the existing <ocil> to <check> transform). David will be working on the remaining check text items, such as for PAM/password settings, gconf, and SSH. The goal is to have the STIG and USGCB profiles in complete enough shape such that meaningful conversations can be held about them at the upcoming NIST IT Security Automation Conference in Baltimore next week. Thanks, Jeff

2 2

[PATCH 0/5] support for generation of boilerplate remarks, validation fixes
by Jeffrey Blank 24 Sep '12

24 Sep '12

Through some abuse of the <check-export> facility in XCCDF, we can now attach a clause to a body of manual checking instructions that can be used as part of a boilerplate remark. Also contained here are fixes to make the content validate. Jeffrey Blank (5): removal of duplicate OCIL checking text temporary commenting of x windows listening Rule, until new version is complete adding transforms and Values support to enable automatic generation of boilerplate text * if a "shorthand" OCIL / manual check text is decorated with a clause attribute, then it can now be used to generate a boilerplate remark which incorporates that clause * for example, if your check needs to conclude with, "If [clause], then this is a finding..." we can now generate the boilerplate portions if the clause is provided. The clause can also be used to construct a question in the true OCIL style for the valid OCIL output. added example clause for manual check text, to enable boilerplate remark generation removed duplicate OCIL check RHEL6/input/guide.xslt | 6 ++++ RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/services/base.xml | 1 - RHEL6/input/services/dhcp.xml | 2 +- .../accounts/restrictions/password_storage.xml | 8 ------ RHEL6/input/system/network/ipsec.xml | 1 - RHEL6/input/system/network/wireless.xml | 1 - RHEL6/input/system/software/disk_partitioning.xml | 4 ++- RHEL6/transforms/shorthand2xccdf.xslt | 26 +++++++++---------- RHEL6/transforms/xccdf2table-profileccirefs.xslt | 4 +++ 10 files changed, 27 insertions(+), 28 deletions(-)

1 5

coming soon: re-ordering of check types within Rules
by Jeffrey Blank 24 Sep '12

24 Sep '12

... since evaluation of the XCCDF profiles is broken at the moment. The XCCDF spec says that the first check type should be chosen, and this will mean putting OVAL first. This is also logical since automated checks are preferable to manual ones that are defined in OCIL. This should only be a few lines of XSLT in transforms/shorthand2xccdf.xslt, but I thought I'd mention that I'm aware of it.

1 0

[PATCH 13/14] Created OCIL for set_iptables_default_rule_forward
by Shawn Wells 24 Sep '12

24 Sep '12

2 1

[PATCH 08/14] Created OCIL for world_writable_files_system_ownership
by Shawn Wells 24 Sep '12

24 Sep '12

3 3

[PATCH 12/14] Updated install_openswan
by Shawn Wells 24 Sep '12

24 Sep '12

3 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2012