scap-security-guide January 2018

scap-security-guide@lists.fedorahosted.org

13 participants
11 discussions

Issue with Repo GPG Checking
by Trevor Vaughan 20 Oct '18

20 Oct '18

Hi All, I've been re-roaming through the SSG and this is probably the first of a many part thread regarding different checks. TL;DR; The potential risk caused by enabling 'repo_gpgcheck' outweighs any potential benefit if TLS is enabled. In my opinion, the following check should *only* be enabled if all of your repositories are internally managed xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata. The reason for this is that YUM presently does not (to my knowledge) have any way to differentiate between package signing GPG keys and repo signing GPG keys. This means that if, for instance, I host my packages via some shared Nexus, then I have to add the Nexus GPG key to my trust list for the repo. I fundamentally do *not* want to do this! I shouldn't be allowing my Nexus maintainer to potentially install software on my system without my explicit knowledge. You should use TLS, and the repo should have a trusted certificate there and that should be sufficient for the metadata until RPM can tell the difference between these two certificates. Please let me know if I've missed something, but I don't remember seeing options to split out the two sets of certs. Additionally, this is marked as 'high' severity and that seems to be massive overkill considering that 1) the packages are still signed and validated and 2) TLS is required. -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

7 20

Re: [Open-scap] oscap results stored in central database?
by Shawn Wells 01 Feb '18

01 Feb '18

On 1/31/18 10:22 PM, Luke Salsich wrote: > Hey all, > > I've been using OpenSCAP for a while on our servers and really > appreciate what it does. > > I've been looking around for a way to store scan results and then > query them and I can't seem to locate any plugins or apps which do > this other than SCAPTimony. > > SCAPTimony sounds great, but I'm not sure it's currently maintained > and I don't really want to dive into Foreman just to store Oscap results. > > What does the community use for this kind of scan / report storing and > querying? > > We're currently using Ansible AWX to run scans and to manage > remediation. Love to find a way to pull that XML into a central > database....... This week was DevConf in Brno [0] and this very topic came up multiple times! The quick answer being broad agreement that "yes this must happen." There are partner projects like Foreman (upstream) and Satellite (downstream) which integrate scanning into their embedded databases. In general there is a desire to unify SCAP with OpenControl for central reporting though. Many are in transit from Brno back home over the next few days, or recovering locally from staying out all night for the past week :) Some responses might be slightly delayed because of this. If you could have database integration with SCAP.... what all would you want it to do? Could you help the community form a few user stories? [0] https://devconf.cz/cz/2018

3 4

should ansible invoke bash fixes?
by Fen Labalme 28 Jan '18

28 Jan '18

Question on Ansible fixes: Might it be possible (and preferable per the DRY principle) to have Ansible fixes invoke the Bash fixes which tend to be more complete? Simple case in point: there are 6 bash/aide* fixes and only 2 ansible/aide* fixes. Not to mention it's easier (at least for me) to build and test a bash "fix" script than an Ansible one. Related: When you provision a new instance, to harden do you run the bash fixes (more complete) or the Ansible ones? I'm provisioning with Ansible so guidance as to how best to harden it would be helpful. Bonus question: How best to generate fixes? Should I run them all on a new server, or can I run just those that match failing tests? Thanks, =Fen (apologies to list moderator - I initially sent this from an unsubscribed email address)

2 1

how much time to fix rhel 7.5 beta bugs?
by Shawn Wells 25 Jan '18

25 Jan '18

Did a quick install + scan of RHEL 7.5 beta and opened a few tickets. Not sure how much time we have to fix these bugs. Anyone know? IIRC, it's pretty short... just a few weeks.

2 1

Fwd: NIST Releases Draft NIST Internal Report (NISTIR) 7511 Revision 5, Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements
by Shawn Wells 17 Jan '18

17 Jan '18

Some late night reading for everyone :) -------- Forwarded Message -------- Subject: NIST Releases Draft NIST Internal Report (NISTIR) 7511 Revision 5, Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements Date: Tue, 16 Jan 2018 15:07:43 -0600 From: NIST Computer Security Division <csrc.nist(a)service.govdelivery.com> Reply-To: csrc.nist(a)service.govdelivery.com To: shawn.d.wells(a)gmail.com NIST Releases Draft NIST Internal Report (NISTIR) 7511 Revision 5, Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements *NIST Releases Draft NIST Internal Report (NISTIR) 7511 Revision 5, /Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements/ for public comment.* News Release about DRAFT NISTIR 7511 Rev. 5 document from the CSRC website https://csrc.nist.gov/News/2018/NIST-Releases-Draft-NISTIR-7511-Rev-5 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> To view the Draft NISTIR 7511 Rev. 5 document details: https://csrc.nist.gov/publications/detail/nistir/7511/rev-5/draft Send comments to: <ir7511comments(a)nist.gov> *Deadline to submit comments: February 19, 2018*. If you are having trouble viewing the link to the Draft NISTIR 7511 document, you can use this link below: <https://csrc.nist.gov/publications/detail/nistir/7511/rev-5/draft> __________ NIST Computer Security Division webmaster-csrc(a)nist.gov (Attn: NIST Cybersecurity Framework Team) ------------------------------------------------------------------------ NIST <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> Questions? Contact Us <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> STAY CONNECTED: <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> SUBSCRIBER SERVICES: Manage Preferences <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> | Unsubscribe <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> | Help <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> ------------------------------------------------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…>. Technical questions? Contact inquiries(a)nist.gov <mailto:inquiries@nist.gov>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 GovDelivery logo <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…>

1 0

Jenkins out of order
by Olivier BONHOMME 09 Jan '18

09 Jan '18

Hello everybody, There is a 502 Error on the Jenkins. Is that normal ? Regards, Olivier Bonhomme

2 1

Ansible vs bash fixup scripts
by Chuck Atkins 08 Jan '18

08 Jan '18

There seems to be a mix of ansible and bash for fix-up scripts, in that some rules only have bash fixes, others only have ansible fixes, while most have both, and a few still have none. When applying remediation during a scan, which ones get used? Is there a way to specify? If I have ansible installed, will the ansible fixes automatically get used? If the ansible ones are being used? Do the bash-only fixes get run as well? What about rules that have both? Thanks ---------- Chuck Atkins Staff R&D Engineer, Scientific Computing Kitware, Inc.

6 12

Issues for writing a remediation
by Olivier BONHOMME 06 Jan '18

06 Jan '18

Hello everybody, I'm trying to write my first OVAL check and the associated remediation script. For my first try, I decided to test with a simple check https://github.com/OpenSCAP/scap-security-guide/issues/1861. I think, I succedeed writing the OVAL check but I have big issues with the remediation : When I execute the remediate command using the results file from the eval command, my remediation is never selected. After some investigations, I realized that the fix wasn't generated into the results file. I must admit I'm a little bit lost and I don't understand why my remediation fix is not generated into the results file. That's why i'm looking for some help in order to understand how to investigate for resolving that issue (Which i'm sure is a newbie thing) I put my files on the following GIST : https://gist.github.com/ptitoliv/fe10d4d37049801b60c98b255c7a6d66 Thanks for your help. Regards, Olivier Bonhomme

4 6

audit_rules_file_deletion_events
by Paige, David B CTR USARMY ICOE (US) 05 Jan '18

05 Jan '18

This check and some related ones require auditing for all users and root. The suggested line includes these elements: -a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=500 -F auid!=4294967295 -k delete Should this check include "-F auid=0" to properly audit the root user?

6 9

open-scap.org expired cert
by Tom Albrecht 05 Jan '18

05 Jan '18

All, Looks like the TLS cert expired on https://www.open-scap.org a couple days ago. Need to check the letsencrypt cron job. Tom A.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2018