Shared Checks/Fixes ...
by Trey Henefield
Greetings,
I wanted to propose a change to the current structure in place for shared checks (shared/oval) and fixes (shared/fixes/bash). I was curious to get everyone's opinion before committing.
So the problem I see is with the symbolic linking of checks and fixes to the shared folder. I have found it problematic when working between different operating systems, file systems, and version control systems.
Rather than creating symbolic links to certain oval checks in the shared/oval folder, we could choose to just process all oval checks in both the project's checks folder and the shared/oval folder.
However, not all checks in the current 'shared/oval' folder are shared by all OS. For example, there are some that only apply to RHEL7 and Fedora, and not RHEL6.
Any thoughts?
Thanks!
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com
Disclaimer
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2015-04-08 17:13:55 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
9 years
Scanning remote machines with OpenSCAP
by Martin Preisler
I have written a short blog post summarizing the latest addition to
OpenSCAP called `oscap-ssh`.
http://martin.preisler.me/2015/05/scanning-remote-machines-with-openscap/
It allows users to scan remote machines using local files. The result
files are transferred back and can be conveniently viewed on the local
machine. This is very useful for testing and even auditing of remote
machines.
Feedback appreciated! Cross posting to SCAP Security Guide because
this might be valuable to content authors.
--
Martin Preisler
Security Technologies | Red Hat, Inc.
9 years, 1 month
[Maintenance] Planning to decommission outdated Fedorahosted's SCAP Security Guide wiki in favour of the GitHub's one. Any objections?
by Jan Lieskovsky
Hello folks,
some time ago the SCAP Security Guide's git repository has been moved
from Fedora Hosted (fedorahosted.org) to GitHub (refer to:
[1] https://www.redhat.com/archives/open-scap-list/2014-August/msg00009.html
thread for further details).
>From that time the git repository move has been shown to be an improvement
for the whole SCAP content evolving process. But besides of just moving the git
content, the OpenSCAP/scap-security-guide subproject also got already equipped with
new wiki pages (containing more up2date information).
This makes the former FedoraHosted's SCAP Security Guide wiki instance more and
more outdated and full of confusing information. To mention an example refer to
old "Downloads" instructions:
[2] https://fedorahosted.org/scap-security-guide/wiki/downloads
To lower the two separate wiki instances maintenance burden, the plan is to
decommission old Fedora Hosted SCAP Security Guide wiki in favour of the
new GitHub one (update the old wiki links to point out to the new GitHub wiki
ones to keep the bookmarks working, but simultaneously point to updated
information).
But prior doing that wanted to check with the community if there would be any
objections against performing this?
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
9 years, 1 month
Porting RHEL6 XCDDF Profiles to RHEL7
by Greg Elin
Fend and I are looking at moving a client from AWS Linux to RHEL7.
We are trying to figure how we can help migrate the existing RHEL6 XCCDF
profiles to RHEL7?
A number of the baseline profiles available in RHEL6 package (e.g. USGCB
and RHEL6-Server are not currently available in either the RHEL7 SSG
package or the RHEL7 SSG built from source.
I've skimmed the issues and the wiki pages and did not seen anything
exactly on topic for the profiles.
- Can these RHEL6 profiles easily be ported to RHEL7, or is it a big tasks
b/c of significant changes between 6 and 7?
- I'm treating the RHEL7 STIG as a separate baseline project from these
other pre-existing RHEL6 baselines (with some overlap, of course). Is that
right way or wrong way to think about it?
- Does it make sense to put together a how to and/or coordination page to
discuss the availability and porting of profiles? Fen and I would like to
help, but want tackle the problem efficiently.
- Is there an overall timeline or plan for managing the XCCDF profiles?
Thanks.
Greg
9 years, 1 month
SCAP Security Guide v0.1.22 is now live
by Jan Lieskovsky
Hello folks,
we are pleased to announce SCAP Security Guide of version 0.1.22.
The highlights include:
* new (experimental [*]) SCAP content for Firefox, Java, Webmin, and Red Hat Enterprise Linux 5 products,
* drop support for Fedora 19 and add support for Fedora 22 and Rawhide,
* all content now successfully validates against version 5.11 of the OVAL language,
* multi_platform support has been introduced for OVAL checks,
* the root Makefile has been equipped with 'make dist' and 'make install' targets,
Product specific enhancements:
* RHEL/6
** content now contains OVAL checks for Avahi, FTP, and DHCP services,
** new PCI-DSS profile has been provided,
** new DISA STIG profile kickstart is now available,
* RHEL/7
** package installed OVAL checks for selected packages have been provided,
** 15 new audit service checks have been ported to RHEL/7,
** many more OVAL checks && remediation enhancements,
* Fedora
** content is now shipped in OVAL language version 5.11 by default,
** the systemdtest template and example OVAL checks have been included,
** the audit system component benchmark section has been added,
** 15 new audit service checks have been ported to Fedora,
For the full list of changes see:
[1] https://github.com/OpenSCAP/scap-security-guide/issues?page=1&q=milestone...
and
[2] https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A%22D...
Downloads [**]:
[3] https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.22
Thanks to all who contributed to make this release the reality!
Happy scanning && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] Users are encouraged to test these && report the issues found.
[**] See BUILD.md for guidance wrt to obtaining RPMs.
9 years, 1 month
