scap-security-guide February 2017

scap-security-guide@lists.fedorahosted.org

14 participants
7 discussions

VMs, containers vs. bare-metal machines in SSG
by Martin Preisler 15 Aug '17

15 Aug '17

We have had increasing requests to scan containers and VM storage images for compliance. In those use-cases a lot of our rules don't make sense. For example separate partition for /tmp isn't really applicable to containers. I thought about how we can deal with this in SSG. We have several options: 1) Separate benchmark and datastreams for containers and VM storage images: ssg-rhel7-ds.xml and ssg-rhel7-container-ds.xml 2) Separate profile for containers and VM storage images: pci-dss and pci-dss-container 3) Use applicability and CPE platforms to distinguish between what is being scanned. That allows us to use the same pci-dss profile for bare-metal, VM, VM storage image and container image. Right now I am leaning towards 3) because it "unlocks" the feature transparently to our users. There is nothing extra they have to study to start scanning containers. The downside is that we will have to add "fake" CPE IDs for platforms like "vm-storage" and "container". Rules that apply to everything will have no <platform> element in them. Rules that apply to just containers will have something like: <platform idref="cpe:/a:*:container-image"/> or <platform idref="cpe:/a:*:vm-storage"/> Official NIST CPE ID dictionary has these related CPE IDs cpe:/a:redhat:docker:1.5.0-27 cpe:/a:linuxcontainers:lxc:0.5.0 cpe:/a:redhat:libvirt:1.2.7 Not sure we want to go with any of those though. I would like to keep it container and VM tech agnostic. Before I start hacking this I would like to hear your thoughts. -- Martin Preisler Identity Management and Platform Security | Red Hat, Inc.

7 12

Where did the HTML tables go?
by Shawn Wells 25 Feb '17

25 Feb '17

Went to give a demo of SSG this morning - and noticed the HTML tables are no longer in RHEL/7/output/*. Where did the HTML tables go? I can't find any documentation on the new build flags. Thanks!

3 4

SSG structure without duplicates (OVAL/remediations)
by Zbynek Moravec 22 Feb '17

22 Feb '17

Hi, we have lot of same files in SSG - especially OVAL checks and remediations and it becoming hard to maintain such many files. Every new product means copy&paste of many new files. Bugfix in one product doesn't fix same files in another product. We are not able to see, that we forgot remediation for OVAL check, etc. Currently, I am trying to remove generated files and update old csv & templates. I would like to introduce new structure to allow sharing of files between products. Do you have any ideas/requirements? https://github.com/OpenSCAP/scap-security-guide/issues/1668 Thank you Z.

4 6

SELinux in PCI profile
by Shawn Wells 20 Feb '17

20 Feb '17

Spent the week at RSA. Someone from a large technology company in Japan approached asked why SELinux wasn't enabled in the RHEL7 PCI profile. Sure enough... it's not there: https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/7/input/pr… https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/pr… I vaguely recall the enabled rules are direct PCI mappings (e.g. a minimum baseline)... but I don't really remember why SELinux isn't evaluated. Anyone else recall? Wanted to ping the mailing list prior to making a PR to add it!

4 4

Kickstart from floppy wth SCAP and tailoring
by Robert Sanders 16 Feb '17

16 Feb '17

Hi all, Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way? -Rob

3 4

upcoming OpenSCAP domain renewals
by Shawn Wells 16 Feb '17

16 Feb '17

A few of the OpenSCAP/SSG domains are coming up for renewal: - scapsecurityguides.{com net info org} - openscap.{com io net} - openscap.info Don't believe the scapsecurityguides.* and openscap.info domains are being used, so was going to let them expire. Wanted to check with the community first... anyone using these? The openscap.com/net/io are aliased to open-scap.org. Planning to renew them.

1 0

Importing to SecurityCenter
by Todd, Charles 07 Feb '17

07 Feb '17

Has anyone else zipped up one or more output files and gotten SecurityCenter ala ACAS to successfully scan with it? I'm using the SSG in CentOS and openscap works great. SC recognizes the xccdf and rhel7 oval file zipped up as OVAL content. But I get errors about XML Schema validation when I actually scan. X-tool won't parse it either. Thanks, Charlie Todd Ball Aerospace This message and any enclosures are intended only for the addressee. Please notify the sender by email if you are not the intended recipient. If you are not the intended recipient, you may not use, copy, disclose, or distribute this message or its contents or enclosures to any other person and any such actions may be unlawful. Ball reserves the right to monitor and review all messages and enclosures sent to or from this email address.

4 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide February 2017