scap-security-guide March 2015

scap-security-guide@lists.fedorahosted.org

9 participants
6 discussions

SCAP FAQ Ideas?
by Shawn Wells 25 Mar '15

25 Mar '15

There are still many questions around using SCAP, such as the SCAP for CVE scanning thread a few days ago. To begin documenting FAQs -- both for the OpenSCAP/SSG pages, and formal Red Hat documentation -- I've started to document common questions here: https://github.com/OpenSCAP/scap-security-guide/wiki/What-should-go-into-an… What other topics/questions should be covered? Feel free to edit the wiki directly or reply to the list! This feedback will be driven into our wikis/manuals, and formal docs off redhat.com. Don't limit to use SSG.... broader questions on how to store SCAP data, using OpenSCAP, how policy is developed all make sense!

3 3

2015 Red Hat Summit: Discounted passes for SSG & OpenSCAP community members
by Shawn Wells 25 Mar '15

25 Mar '15

Hey Guys, The 2015 Red Hat Summit (http://www.redhat.com/summit) will take place June 23-26 in Boston. The event may seem far away, but we all know how long it takes for integrators and govies to allocate training and travel budgets... :) This year we've ensured that _*any*_ member of the SSG & broader OpenSCAP community is eligible for discounted Summit passes at $950/pass (or $895/pass for groups of 4+). Doesn't matter if you're a code contributor, occasional voice on the mailing lists, or silent partner. For reference, the full conference pass is generally $1,975 (ref http://www.redhat.com/summit/rates/) In 2012 the SCAP session was standing room only, and in 2013 it was rated the #3 session (out of 196 sessions) by attendees. We hope to see you there this year! In full transparency: I don't get any RHT kickback or commissions off this. I received a special registration code that allows me to empirically show various managers/event staff how much interest there is in SCAP and Security Automation. For every 10 registrants that use the code, I get to send a RHT engineer to Red Hat Summit. Contact me _*off-list*_ if interested! -sdw

2 2

BIND and HTTP STIGs
by Gabe Alford 24 Mar '15

24 Mar '15

Hello, I am currently in the mist of securing some of my systems with the BIND and HTTP STIGs, and

3 6

Using OpenSCAP with CVE feeds for daily scanning
by Greg Elin 24 Mar '15

24 Mar '15

To date, I've used OpenSCAP to check the configuration of Unix operating systems against government baselines. But I assume OpenSCAP can consume any SCAP content including daily CVE feeds? I have not tried that yet. And superficial searching did not reveal any obvious documentation. Does anyone know of a good example that would get a person started with using OpenSCAP to consume CVE feeds? Any recommendations of freely available feeds? Thanks! Greg Elin

3 3

Building SCAP content on RHEL 5 ...
by Trey Henefield 18 Mar '15

18 Mar '15

Greetings, I was curious to know if anyone has tried building SCAP content on RHEL 5? Given that the intention of the scap-security-guide rpm package is meant to be built individually on each platform (RHEL5, RHEL 6, RHEL 7, Fedora), I have attempted trying to build SCAP content on RHEL5. I am running into all sorts of issues. Here's what I gathered so far: 1) The following python files include 'with' statements, which are not supported by the latest version of Python on RHEL5 (2.4.3-56): shared/transforms/combinechecks.py shared/transforms/combinefixes.py shared/transforms/cpe generate.py shared/transforms/relabelids.py I was able to work through these errors, using the suggested workaround here: http://stackoverflow.com/questions/2755849/python-invalid-syntax-with-with-… 2) The command 'xmlwf input/checks/*.xml' produces syntax errors for every file processed. Example: input/checks/system_info_architecture_x86.xml:1:0: syntax error 3) When the errors above are corrected in item 1, another error is generated, which has me stumped: ../shared/transforms/relabelids.py unlinked-fedora-xccdf.xml ssg File "../shared/transforms/relabelids.py", line 62 ovalfile = ovalfiles.pop() if ovalfiles else None ^ SyntaxError: invalid syntax There could be many more issues, but this is as far as I have gotten so far. I am not much of a python guru so I was hoping someone else could chime in. Thanks! Best regards, Trey Henefield, CISSP Senior IAVA Engineer Ultra Electronics Advanced Tactical Systems, Inc. 4101 Smith School Road Building IV, Suite 100 Austin, TX 78744 USA Trey.Henefield(a)ultra-ats.com Tel: +1 512 327 6795 ext. 647 Fax: +1 512 327 8043 Mobile: +1 512 541 6450 www.ultra-ats.com Disclaimer The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2015-03-18 14:15:56 is confidential and may be legally privileged. It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

1 0

[ANN] CMITS 1.3 released on GitHub
by JENNINGS, JARED L CTR USAF AFMC 96 SK/CCI 05 Mar '15

05 Mar '15

Configuration Management for IT Systems (CMITS) 1.3 has been released on GitHub at <https://github.com/afseo/cmits>. From the README: This is a toolset that makes it easier for network administrators to configure IT systems in compliance with U.S. Department of Defense requirements, and to document that compliance as automatically as possible, at several levels of detail. CMITS contains many Puppet modules that implement portions of compliance with about 1000 requirements from nine DoD-level policy documents. These modules make it easier for administrators to construct a complete Puppet manifest which tells IT systems how to configure themselves in a compliant fashion. ("Puppet is IT automation software that helps system administrators manage infrastructure throughout its lifecycle" <http://puppetlabs.com/puppet/what-is-puppet/>.) CMITS also contains scripts and extensions necessary to create a unified policy document, which lays out in complete detail how systems are configured using Puppet, and offers a single place to document IT-related processes, especially those necessary for compliance. The scripts and extensions also create automatic summaries, cross-references and indices, so that auditors can easily find assertions about compliance. -- Jared Jennings, RHCE, Network Administrator, SURVICE Engineering Co.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide March 2015