scap-security-guide April 2019

scap-security-guide@lists.fedorahosted.org

8 participants
5 discussions

Re: [Open-scap] Need help on openscap SSG question
by Jan Cerny 29 Apr '19

29 Apr '19

Hi, I have no idea. Does Nessus have any "verbose" mode to get more helpful error message? Including scap-security-guide list in this conversation because there might be people familiar with using SSG with Nessus. Regards On Mon, Apr 29, 2019 at 4:54 PM Riaz Ebrahim <mriazebrahim1(a)gmail.com> wrote: > > Hi Jan Cerny, > > Thanks a lot for your response, Your answer was very useful to understand about SSG files. As per your advice i tried with scap-security-guide-0.1.43-oval-510.zip and XML validation error was gone, but encountering new error as below from nessus > > "ssg-rhel6-ds-1.zip : Default namespace not found in OVAL" > > Do you get any clue by seeing this error?. Thanks in advance :) > > Thanks, > Riaz > > On Mon, Apr 29, 2019 at 2:44 PM Jan Cerny <jcerny(a)redhat.com> wrote: >> >> Hi, >> >> I will try to answer, but I don't use Nessus, so I'm not sure what is >> the exact reason of this fail. >> >> In general, the SSG files are validated against SCAP XML schemas, so >> they are valid SCAP content. >> However, SCAP standard consist of multiple separate specifications. >> Strictly speaking, the SSG datastream >> doesn't conform to SCAP 1.2 specification, because the datastream >> contains OVAL checks conforming to OVAL >> version 5.11 which is a part of SCAP 1.3. For SCAP 1.2 conformance it >> would need to use OVAL checks >> in version 5.10 or older. >> >> According to this forum thread, it seems that Nessus doesn't support >> OVAL 5.11 it yet, but they say it's planned to be updated >> https://community.tenable.com/s/question/0D5f200005hKRwqCAG/nessus-pro-7-tr… >> >> It could be a problem that Nessus expects datastreams that contain >> OVAL 5.10 only. >> Try using the SSG datastreams that contain OVAL 5.10 only. They can be >> downloaded from >> https://github.com/ComplianceAsCode/content/releases/download/v0.1.43/scap-… >> I hope Nessus should be able to consume these files. >> >> The reason why we use 5.11 is that it contains new checks that allows >> us to check easily system services using systemd >> and other new things introduced in RHEL 7. The aforementioned >> datastreams that contain OVAL 5.10 only >> have limited abilities in comparison with those containing OVAL 5.11. >> >> Best Regards >> >> Jan Černý >> Security Technologies | Red Hat, Inc. >> >> >> On Sat, Apr 27, 2019 at 6:34 AM Riaz Ebrahim <mriazebrahim1(a)gmail.com> wrote: >> > >> > I need help on openscap SSG project. >> > >> > I am currently exploring SCAP Auditing feature from Nessus console. I understood that Nessus supports SCAP Content (1.0 or 1.1 or 1.2) which can be downloaded from NIST repository (https://nvd.nist.gov/ncp/repository) based on the target host version. This works great, However when i use SCAP from OpenSCAP SSG (example "ssg-rhel6-ds.xml”), i am getting error as “sg-rhel6-ds. .zip : sg-rhel6-ds.xml failed XML Schema validation” . >> > >> > I would like to what is the difference between openSSG scap data stream & scap1.2 content downloaded from NIST repository. How i can convert openssg data stream (Example - ssg-rhel6-ds.xml) to NIST scap 1.2 format. >> > >> > >> > My objective - To use openscap SSG from Nessus. Nessus scap scanning expects SCAP 1.0, 1.1 or 1.2 content(in zip format). >> > >> > >> > Thanks in advance! >> > >> > _______________________________________________ >> > Open-scap-list mailing list >> > Open-scap-list(a)redhat.com >> > https://www.redhat.com/mailman/listinfo/open-scap-list -- Jan Černý Security Technologies | Red Hat, Inc.

2 1

Filed bug on inability to effectively audit PolKit rules
by Trevor Vaughan 25 Apr '19

25 Apr '19

If anyone would like to chime in/comment, the bug can be found at https://gitlab.freedesktop.org/polkit/polkit/issues/80. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

1 0

Benchmark Group Rule order
by Alexander Bergmann 17 Apr '19

17 Apr '19

Hi everyone, I have a question about the rules execution order. From my testing the execution order is simply the rule order inside a group of a benchmark. It looks like the order simply depends on the directory structure of linux_os/guide. Is there a way to specify the execution order? The reason I'm asking is the following. I have 3 rules A, B and C. Rules B and C can only be executed successfully if rule A was executed before. A) package_X_installed B) service_X_enabled C) set_X_configuration Sure, this is not a problem during normal evaluation, but the remediation scripts will need the dependency. Otherwise the package is not installed and the script will try to fix something. An ugly workaround would be to run the remediation twice or three times, but this should be avoided. Any idea anyone? :) Regards, Alex~ -- Alexander Bergmann <abergmann(a)suse.com>, Security Engineer, GPG:9FFA4886 SUSE Linux GmbH, GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 21284 (AG Nürnberg)

3 2

"Could not parse profile" error
by Shawn Wells 08 Apr '19

08 Apr '19

When building off master, I receive the following errors: > ./build_product rhel7 > > ........ > Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_enhanced.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_high.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_intermediary.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/anssi_nt28_minimal.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/C2S-docker.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/docker-host.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/rhelh-stig.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-ansible-tower-upstream.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-http-disa.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-ipa-server-upstream.profile. > . Skipping None.Could not parse profile > /media/psf/src/ComplianceAsCode/content/rhel7/profiles/stig-satellite-upstream.profile. The ssg-rhel7-ds.xml appears built successfully. "xccdf info" shows the profiles and I'm able to scan a host. But not sure what those output lines mean -- any pointers?

3 6

/root/openscap_data
by Mike Johnston 05 Apr '19

05 Apr '19

I'm a new to this project and have always done my SCAP lock downs with kickstart scripts up until now. This looks to be something I switched to a long time ago. In the environment I work in, I need to make custom ISO installation disks to send out to the field. I've been testing out the 'addon xccdf_org.ssgproject.content_profile_stig-rhel7-disa' security profile and then made a custom tailored XML following the guidelines keep a few things on that were being removed. My problem is that now that I have my 'ssg-rhel7-ds-tailoring.xml' file, where do I put it in my kickstart image? I've tried copying it in the post -nochroot section of my kickstart to /tmp/openscap_data and /root/openscap_data and neither of those worked. Can someone tell me or show me where in the guide it show where it's supposed to go? This is what my kickstart looks like: ------------------------------------- %post --nochroot cp /run/install/repo/hardening/ssg-rhel7-ds-tailoring.xml /root/openscap_data/ %addon org_fedora_oscap content-type = scap-security-guide profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa tailoring-path=ssg-rhel7-ds-tailoring.xml %end ------------------------------------- Thanks for all the work...this is a great project.

4 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide April 2019