scap-security-guide February 2014

scap-security-guide@lists.fedorahosted.org

32 participants
66 discussions

[PATCH 0/3] Added datastream outputs for Fedora, RHEL7, RHEL6
by Shawn Wells 21 Feb '14

21 Feb '14

3 8

[PATCH] [RHEL] Include datastream files into RHEL6 and RHEL7 RPM packages too [RHEL] Bump version to 0.1-16
by Jan Lieskovsky 21 Feb '14

21 Feb '14

As agreed in: https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-February/… the datastream output format files have been included also into RHEL-6 and RHEL-7 RPM packages. The version of EPEL-6 package has been bumped to 0.1-16 and corresponding build succeeded: http://koji.fedoraproject.org/koji/buildinfo?buildID=499782 (will shortly schedule new scap-security-guide EPEL-6 package bugfix and enhancement update) Above patch covers the necessary changes. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

[PATCH] [Fedora] Shift list of supported Fedora releases by one up (Fedora 18 got EOL 2014-01-14)
by Jan Lieskovsky 21 Feb '14

21 Feb '14

Move the list of Fedora releases supported by SCAP content as provided within scap-security-guide RPM by one release up (Fedora 18 got EOL / EOPS 2014-01-14). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] [Fedora] Include datastream file (for remote system scans) into RPM package too
by Jan Lieskovsky 21 Feb '14

21 Feb '14

Based on Shawn's datastream format enhancements from yesterday include the generated ssg-fedora-ds.xml datastream file also into the final RPM package, so users could scan remote Fedora systems without the need to perform the explicit conversion by themselves. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

Looking to start contributing
by Lee Kinser 20 Feb '14

20 Feb '14

Hey guys, I just wanted to send out a quick hello to the list in hopes of getting to know some of you. I'm part of one of our security teams inside of Red Hat and am looking to do what I can to help expand on remediation content inside of SSG. I've worked for years in Government spaces, so my experience and interest is primarily around STIG content... I'd love to get SSG to a point where we can scan and remediate essentially everything that can possibly be automated inside of the STIG. I just might need some help from you guys in getting started. :) First question, what's the format for remediation content? It appears that everything is held under ./scap-security-guide/RHEL/6/input/fixes/bash, but since they're named with words instead of finding ID, I'm a bit unsure as to how to map them to requirements in the policy... anyone have any tips there? How about how to add new fixes? Writing the BASH content is the easy part, I just need to know how to incorporate it into the SSG. Thanks for the help! -- Lee Kinser Solutions Architect Navy & Marine Corps Red Hat Federal 843-868-1024 (Mobile) lkinser(a)redhat.com

2 1

[PATCH] [RHEL/7] Fix 'make validate' error caused by missing two OVAL checks definitions
by Jan Lieskovsky 20 Feb '14

20 Feb '14

This patch fixes 'make validate' error on current RHEL-7 content. Running 'make validate' in RHEL/7 currently returns output as detailed in attached old_output.txt. This problem is / was caused by missing OVAL definitions for: * service_sshd_disabled.xml and * package_openssh-server_removed.xml checks. Thus provide RHEL-7 specific check for service_sshd_disabled (since it uses systemd and can't be shared with RHEL-6), and move original package_openssh-server_removed.xml definition into shared, making symlinks on appropriate places for RHEL-6 and RHEL-7 content(s). After the patch 'make validate' succeeds already as shown in attached new_output.txt (it still prints warnings about missing definitions, but these aren't defined in RHEL-7 content yet => that warning being expected and to be fixed gradually later together with adding appropriate definitions. But after application of the patch make validate runs / completes correctly, without the above error). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 1

[PATCH 3/3] Added datastream output for RHEL7
by Shawn Wells 19 Feb '14

19 Feb '14

2 1

[PATCH 2/3] Updated Fedora build process to generate datastream
by Shawn Wells 19 Feb '14

19 Feb '14

2 1

[PATCH 1/3] Adding datastream output for RHEL6
by Shawn Wells 19 Feb '14

19 Feb '14

2 1

(no subject)
by Kordell, Luke T 18 Feb '14

18 Feb '14

Hello, I have been following the steps listed on this website to attempt remediation of the selinux_policytype rule. http://isimluk.livejournal.com/3573.html I tried to edit the line in the /etc/selinux/config file via a fix tag in the selinux.xml file. After running the make command and re-scanning my system I realized the results omitted ALL rules dealing with Selinux. Just to make sure it wasn't anything within the <fix> tags I inserted a simple "touch" statement. It yielded the same results. Does anyone know what might be causing this? I am attaching my version of the selinux.xml file. Thanks, Luke

2 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide February 2014