VMs, containers vs. bare-metal machines in SSG
by Martin Preisler
We have had increasing requests to scan containers and VM storage images
for compliance. In those use-cases a lot of our rules don't make sense.
For example separate partition for /tmp isn't really applicable to containers.
I thought about how we can deal with this in SSG. We have several options:
1) Separate benchmark and datastreams for containers and VM storage images:
ssg-rhel7-ds.xml and ssg-rhel7-container-ds.xml
2) Separate profile for containers and VM storage images:
pci-dss and pci-dss-container
3) Use applicability and CPE platforms to distinguish between what is being
scanned. That allows us to use the same pci-dss profile for bare-metal, VM,
VM storage image and container image.
Right now I am leaning towards 3) because it "unlocks" the feature
transparently to our users. There is nothing extra they have to study to
start scanning containers. The downside is that we will have to add "fake"
CPE IDs for platforms like "vm-storage" and "container". Rules that apply
to everything will have no <platform> element in them. Rules that apply
to just containers will have something like:
<platform idref="cpe:/a:*:container-image"/>
or
<platform idref="cpe:/a:*:vm-storage"/>
Official NIST CPE ID dictionary has these related CPE IDs
cpe:/a:redhat:docker:1.5.0-27
cpe:/a:linuxcontainers:lxc:0.5.0
cpe:/a:redhat:libvirt:1.2.7
Not sure we want to go with any of those though. I would like to keep it
container and VM tech agnostic.
Before I start hacking this I would like to hear your thoughts.
--
Martin Preisler
Identity Management and Platform Security | Red Hat, Inc.
6 years, 8 months
Where did the HTML tables go?
by Shawn Wells
Went to give a demo of SSG this morning - and noticed the HTML tables
are no longer in RHEL/7/output/*.
Where did the HTML tables go? I can't find any documentation on the new
build flags.
Thanks!
7 years, 2 months
SSG structure without duplicates (OVAL/remediations)
by Zbynek Moravec
Hi,
we have lot of same files in SSG - especially OVAL checks and remediations
and it becoming hard to maintain such many files. Every new product means
copy&paste of many new files. Bugfix in one product doesn't fix same files
in another product. We are not able to see, that we forgot remediation for
OVAL check, etc.
Currently, I am trying to remove generated files and update old csv & templates.
I would like to introduce new structure to allow sharing of files between
products. Do you have any ideas/requirements?
https://github.com/OpenSCAP/scap-security-guide/issues/1668
Thank you
Z.
7 years, 2 months
Kickstart from floppy wth SCAP and tailoring
by Robert Sanders
Hi all,
Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way?
-Rob
7 years, 2 months
upcoming OpenSCAP domain renewals
by Shawn Wells
A few of the OpenSCAP/SSG domains are coming up for renewal:
- scapsecurityguides.{com net info org}
- openscap.{com io net}
- openscap.info
Don't believe the scapsecurityguides.* and openscap.info domains are
being used, so was going to let them expire. Wanted to check with the
community first... anyone using these?
The openscap.com/net/io are aliased to open-scap.org. Planning to renew
them.
7 years, 2 months
Importing to SecurityCenter
by Todd, Charles
Has anyone else zipped up one or more output files and gotten SecurityCenter ala ACAS to successfully scan with it?
I'm using the SSG in CentOS and openscap works great. SC recognizes the xccdf and rhel7 oval file zipped up as OVAL content. But I get errors about XML Schema validation when I actually scan. X-tool won't parse it either.
Thanks,
Charlie Todd
Ball Aerospace
This message and any enclosures are intended only for the addressee. Please
notify the sender by email if you are not the intended recipient. If you are
not the intended recipient, you may not use, copy, disclose, or distribute this
message or its contents or enclosures to any other person and any such actions
may be unlawful. Ball reserves the right to monitor and review all messages
and enclosures sent to or from this email address.
7 years, 2 months
