scap-security-guide February 2013

scap-security-guide@lists.fedorahosted.org

24 participants
50 discussions

adding "fix"es to the xccdf
by Brian Millett 05 Feb '13

05 Feb '13

I'm really interested in adding fixes, or having a set of fixes I can apply to the xccdf for rhel6. I've looked at the line in the Makefile: xsltproc -stringparam fixes "../$(IN)/fixes/bash-ks.xml" -o $(OUT)/unlinked-rhel6-xccdf.xml $(TRANS)/xccdf-addfixes.xslt $(OUT)/unlinked-rhel6-xccdf.xml and it looks like, following the bas-ks.xml, I can create a file with each fix as long as each fix-id is the same as the rule-id so that the fix can be merged with the appropriate rule into a final xccdf.xml file. At least, that is what it seems. I uncommented the line in the Makefile and remade it, however, nothing was added to the final xccdf.xml file, and there are not any make errors, so Any documentation or ideas where to look? Thanks. -- Brian Millett "My brain feels like its been sucked out through my ear." -- [ Londo, "Born to the Purple"]

4 8

Getting the umask tests/checks to finally work
by Brian Millett 05 Feb '13

05 Feb '13

See attached patch for the following files scap-security-guide/RHEL6/input/system/accounts/session.xml scap-security-guide/RHEL6/input/checks/accounts_umask_etc_profile.xml scap-security-guide/RHEL6/input/checks/accounts_umask_bash_users.xml scap-security-guide/RHEL6/input/checks/accounts_umask_csh.xml scap-security-guide/RHEL6/input/checks/accounts_umask_login_defs.xml scap-security-guide/RHEL6/input/profiles/usgcb-rhel6-server.xml scap-security-guide/RHEL6/input/profiles/common.xml scap-security-guide/RHEL6/input/profiles/maritz-rhel6-server.xml scap-security-guide/RHEL6/input/profiles/test.xml scap-security-guide/RHEL6/input/profiles/stig-rhel6-server.xml result now are Ensure the Default Bash Umask is Set Correctly fail Ensure the Default C Shell Umask is Set Correctly fail Ensure the Default Umask is Set Correctly in /etc/profile fail Ensure the Default Umask is Set Correctly in login.defs pass Set Daemon Umask fail -- Brian Millett "If anyone asks, say it fell from the sky." -- [ Delenn to Sinclair (re: Vorlon files), "The Gathering"]

1 0

[PATCH] Renamed manpage to scap-security-guide
by Shawn Wells 05 Feb '13

05 Feb '13

1 0

[PATCH] [bugfix] Updated URN for bash fix scripts
by Shawn Wells 05 Feb '13

05 Feb '13

4 4

[PATCH] fix for typo'ed refine-values
by Jeffrey Blank 05 Feb '13

05 Feb '13

Thanks very much to Brian Millett for his testing. And perhaps at some point we'll consistently rename all Values to end in "_value" or begin with "var_" , but that's a foppish concern that can wait for now... Jeffrey Blank (1): fixed typo in refine-value for user umasks RHEL6/input/profiles/stig-rhel6-server.xml | 4 +--- RHEL6/input/profiles/test.xml | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-)

1 1

[PATCH 6/6] Created SSG Manpage, shortened RPM "Description" text
by Shawn Wells 05 Feb '13

05 Feb '13

3 3

a small problem with some profiles umask_user_value is user_umask_value
by Brian Millett 05 Feb '13

05 Feb '13

Ensure the Default Bash Umask is Set Correctly *error* Ensure the Default C Shell Umask is Set Correctly *error* Ensure the Default Umask is Set Correctly in /etc/profile *error* Ensure the Default Umask is Set Correctly in login.defs *error* I was pulling out my hair (and I don't have much left anyways) why the umask_bashrc, umask_cshrc, etc were giving the results of "error" during an evaluation. Well, come to find out the variables are typoed, ( user_umask_value instead of umask_user_value) so cd scap-security-guide/RHEL6/input/profiles perl -pi -e 's/user_umask_value/umask_user_value/' $(grep -Rl user_umask_value *) fixes that problem. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

2 1

playing with the testcheck.py yields errors
by Brian Millett 05 Feb '13

05 Feb '13

Ok, so I've a rhel-6.3 system [root@localhost checks]# uname -r 2.6.32-279.19.1.el6.x86_64 [root@localhost checks]# rpm -qa | grep libxslt libxslt-1.1.26-2.el6_3.1.x86_64 I've been looking at the RHEL6/input/checks to see how it is done, and I wanted to test the checks. So following the documentation https://fedorahosted.org/scap-security-guide/wiki/newoval, I ran 'sshd_idle_timeout_value=30 ./testcheck.py sshd_idle_timeout.xml' and got the following error: [root@localhost checks]# sshd_idle_timeout_value=30 ./testcheck.py sshd_idle_timeout.xml external_variable with id : sshd_idle_timeout_value Evaluating with OVAL tempfile : /tmp/sshd_idle_timeoutUDK_FW.xml File '/tmp/sshd_idle_timeoutUDK_FW.xml' line 7: Element '{ http://oval.mitre.org/XMLSchema/oval-definitions-5}definition', attribute 'id': [facet 'pattern'] The value 'oval:oval:scap-security-guide.testing:def:108' is not accepted by the pattern 'oval:[A-Za-z0-9_\-\.]+:def:[1-9][0-9]*'. Looking into the code, I see that idtranslate.idtranslator already is adding the namespace to the id str_id = "%s:%s:%s:%d" % (namespace_to_prefix(tagname), self.content_id, tagname_to_abbrev(tagname), i) So the 'oval:oval:scap-security-guide.testing:def:108' being generated is redundant. the following patch fixes that. [root@localhost checks]# diff -wruN testcheck.py.orig ./testcheck.py --- testcheck.py.orig 2013-02-05 10:54:44.579854555 -0600 +++ ./testcheck.py 2013-02-05 10:54:57.889884072 -0600 @@ -102,7 +102,7 @@ if element.getchildren(): ovaltree.append(element) # re-map all the element ids from meaningful names to meaningless numbers - testtranslator = idtranslate.idtranslator("testids.ini", "oval:scap-security-guide.testing") + testtranslator = idtranslate.idtranslator("testids.ini", "scap-security-guide.testing") ovaltree = testtranslator.translate(ovaltree) (ovalfile, fname) = tempfile.mkstemp(prefix=defname,suffix=".xml") os.write(ovalfile, ET.tostring(ovaltree)) so now [root@localhost checks]# sshd_idle_timeout_value=30 ./testcheck.py sshd_idle_timeout.xml external_variable with id : sshd_idle_timeout_value Evaluating with OVAL tempfile : /tmp/sshd_idle_timeoutt_n33_.xml Definition oval:scap-security-guide.testing:def:111: false Definition oval:scap-security-guide.testing:def:109: false Definition oval:scap-security-guide.testing:def:108: false Evaluation done. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

2 2

[PATCH] fixed bug which unnecessarily prepended "oval:" to IDs
by Jeffrey Blank 05 Feb '13

05 Feb '13

Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil> --- RHEL6/input/checks/testcheck.py | 10 +--------- 1 files changed, 1 insertions(+), 9 deletions(-) diff --git a/RHEL6/input/checks/testcheck.py b/RHEL6/input/checks/testcheck.py index 3b410dd..66b8381 100755 --- a/RHEL6/input/checks/testcheck.py +++ b/RHEL6/input/checks/testcheck.py @@ -102,20 +102,12 @@ def main(): if element.getchildren(): ovaltree.append(element) # re-map all the element ids from meaningful names to meaningless numbers - testtranslator = idtranslate.idtranslator("testids.ini", "oval:scap-security-guide.testing") + testtranslator = idtranslate.idtranslator("testids.ini", "scap-security-guide.testing") ovaltree = testtranslator.translate(ovaltree) (ovalfile, fname) = tempfile.mkstemp(prefix=defname,suffix=".xml") os.write(ovalfile, ET.tostring(ovaltree)) os.close(ovalfile) print "Evaluating with OVAL tempfile : " + fname - # temporary workaround for fedora/redhat oscap version differences - # (distname, distversion, distcodename) = platform.linux_distribution(full_distribution_name=0) - # if distname == 'redhat': - # subprocess.call("oscap oval eval --result-file "+ fname + "-results " + fname, shell=True) - # else: - - # content requires OVAL 5.8 support, which is only supported by openscap 0.8 or later - # for RHEL 6, this implies installing openscap from source until RPM is released subprocess.call("oscap oval eval --results "+ fname + "-results " + fname, shell=True) # perhaps delete tempfile? definitions = ET.Element("definitions") -- 1.7.1

1 0

[PATCH] [bugfix] Updated .spec to reflect $RPM_BUILD_ROOT for chcon'ing manpage
by Shawn Wells 05 Feb '13

05 Feb '13

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide February 2013