scap-security-guide September 2012

scap-security-guide@lists.fedorahosted.org

18 participants
92 discussions

Start a nNew thread

[PATCH 2/2] Check text for 'Ensure SELinux State is Enforcing'
by Michael J. McConachie 21 Sep '12

21 Sep '12

1 0

[PATCH 1/2] Check text for 'Remove Rsh Trust Files' entry for SSST
by Michael J. McConachie 21 Sep '12

21 Sep '12

1 0

[PATCH] Check text for 'Remove Rsh Trust Files' entry for SSST
by Michael J. McConachie 21 Sep '12

21 Sep '12

Hi all, a test email from my mutt client. You should be receiving this on the mailing list, from my @redhat email, with an attachment containing the single patch (named in the title). Intially, I thougtht it would be prudent to do several at a time, passing them all into one patch file, but that can prove hard to read at times, and hard to follow. After some thought it might be better to do one at a time (so that we can track he changes per the subj: line of each email). If need be, we can adjust the desired frequency at a later date. Mike

2 2

xsltproc and bash-ks
by Spencer R. Shimko 20 Sep '12

20 Sep '12

Jeff, Back on September 4th you submitted a patch that commented out the xsltproc for generating the fixes. The commit message wasn't clear on the rationale for this removal. The change set in question is here: https://fedorahosted.org/scap-security-guide/changeset/19b174a275c6d60d5a42… I'm referring to the change in line 17/18. Was there a problem with the transform? Thanks, --Spencer

3 2

0001-Title-Added-OCIL-Checking.patch
by Michael J. McConachie 20 Sep '12

20 Sep '12

All, Per My conversation with Jeff today, I instantiated some new <ocil> tags / checking. I cleaned up a little verbiage in the Fix Text Areas. I also added some SELinux checking material(s). I'll continue where I left off tomorrow, Thanks, -- Red Hat Consulting Michael J. McConachie, RHCE Consultant - Red Hat, Inc. michael(a)redhat.com [m] 760-819-2111

2 2

[PATCH 0/3] support for generating OCIL
by Jeffrey Blank 19 Sep '12

19 Sep '12

These commits should permit creation of manual checking text that can appear as the made-up checksystem "ocil-transitional" (inline with the XCCDF), and can also be automatically generated into proper OCIL. Well, valid OCIL. Addition of a "clause" attribute is still needed in order to permit generation of a question (or to make a statement about whether something is a "finding"). But the support is now there to enable this to occur in earnest. Jeffrey Blank (3): additions to Makefile to create OCIL output from inline manual check text new transforms to create OCIL from manual checks, change inline content to references support for generating OCIL, synchronizing/generating OCIL IDs automatically RHEL6/Makefile | 6 +- RHEL6/transforms/constants.xslt | 4 +- RHEL6/transforms/cpe_generate.py | 4 +- RHEL6/transforms/idtranslate.py | 206 +++++++++++++++++----------- RHEL6/transforms/relabelids.py | 151 ++++++++++++--------- RHEL6/transforms/xccdf-create-ocil.xslt | 67 ++++++++++ RHEL6/transforms/xccdf-ocilcheck2ref.xslt | 35 +++++ 7 files changed, 324 insertions(+), 149 deletions(-) create mode 100644 RHEL6/transforms/xccdf-create-ocil.xslt create mode 100644 RHEL6/transforms/xccdf-ocilcheck2ref.xslt

4 6

[PATCH 0/2] minor updates with manual checking text
by Jeffrey Blank 14 Sep '12

14 Sep '12

This will also enable generation of OCIL. Jeffrey Blank (2): changes to support "transitional" OCIL content (which is what we're calling our manual check text) added macro-ized package installation checks RHEL6/Makefile | 2 +- RHEL6/input/services/dns.xml | 1 + RHEL6/input/services/obsolete.xml | 5 +++ RHEL6/input/system/software/integrity.xml | 1 + RHEL6/transforms/constants.xslt | 1 + RHEL6/transforms/shorthand2xccdf.xslt | 33 ++++++++++++++++++---- RHEL6/transforms/xccdf2table-profileccirefs.xslt | 2 +- 7 files changed, 37 insertions(+), 8 deletions(-)

2 7

Implementation of openscap
by Joe Wulf 14 Sep '12

14 Sep '12

I appreciate all the work being done to develop RHEL6 content. Thanks to everyone! My question is based on this.... I'll be reaching a point of testing a number of RHEL5/6 systems in bulk with openscap. Initially of course they'll be offline, development and/or non-production systems. OS versions would be a diverse smattering of RHEL 5.7, 5.8, 5.9 (when it comes out), 6.1, 6.2, 6.3 and 6.4 (when it comes out). Architecture would be both intel 32 and 64 bits. Most (if not all?) of these hosts would not have openscap.rpms already installed. I can readily envision full customer production systems expressly NOT having openscap.rpms installed on them at all, ever. - Can a single edition (preferably the latest) of openscap combined with the latest content be 'brought' into the RHEL test/dev hosts and be successful in executing for scoring/assessment? - Has anyone tried this yet? This 'bringing in' would not be via RPM nor yum, but as an expanded gzipped tar file that is made available on an NFS share, so it was centrally available (for example). At that point execution could bring the benefits of modern openscap to site/host assessment, while not perturbating the customers' environment. Proving this works in test/dev, gives value to going forward with application against production systems that customers will not want changed, to the greatest extent possible. Another reason is that one cannot assume much less ensure any given 'environment to be tested' will have a yum repo available, nor that it would have the correct/right edition of openscap to install, via RPM, if the system owners would even permit it at the time of assessment. Thanks, R, -Joe

2 3

A question about the ensure_redhat_gpgkey_installed test
by Kenneth Stailey 13 Sep '12

13 Sep '12

Hi, RHEL6/input/checks/templates/packages_installed.csv contains rhn_gpgkey but the real Red Hat release signing key package name is gpg-pubkey. The version and release strings must be used since they specify the key ID and there are usually several versions of gpg-pubkey installed at the same time. Unless create_package_installed.py and template_package_installed are refactored to support specifying RPM version and release strings this test can't use templating. Given that the only two packages that can have multiple versions installed are gpg-pubkey and kernel is it worth modifying the templating code to support these special cases? Thanks, Kenneth

3 7

[PATCH] fixed use of invalid check types
by Jeffrey Blank 13 Sep '12

13 Sep '12

per Peter's email ... more fixes to come Jeffrey Blank (1): correcting checktypes used in test for accounts_nologin_for_system fix accidental addition of argument to testcheck's oscap invocation...we get ovalresults anyway RHEL6/input/checks/accounts_nologin_for_system.xml | 4 ++-- RHEL6/input/checks/testcheck.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)

1 1

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2012