Afternoonall, Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item):
RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8) [ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_-.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855. [ERROR] Check system [ocil-transitional] is not supported. Check will not be performed. Target System: RH64-64 Selected Profile: rht-ccp Stream Name: ssg-rhel6- Stream Version: 0.9 Stream Date: 2013-07-05 Rule ID: partition_for_tmp
This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed.
I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group.
-Rob
On 8/26/13 4:14 PM, Robert Sanders wrote:
Afternoonall, Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item):
RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8) [ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_-.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855. [ERROR] Check system [ocil-transitional] is not supported. Check will not be performed. Target System: RH64-64 Selected Profile: rht-ccp Stream Name: ssg-rhel6- Stream Version: 0.9 Stream Date: 2013-07-05 Rule ID: partition_for_tmp
This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed.
I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group.
That matches my own experiences with SCC 3.1: http://people.redhat.com/swells/SCC/Logs/RHEL6_SCC-3.1_2013-02-17_102333_Err...
I had the opportunity to meet the SCC team at the MITRE SCAP DevDays, then again at Mil-OSS Charleston a few weeks ago. They're a really great group of people and have been working on updates which should be (IIRC) incorporated into the SCC 3.1 RC6 release which dropped on 8/13.
I've yet to play with the RC6 build, but hope to over the coming week. Did you use SCC v3.1 GA, or one of the recent RC builds? As SCC has yet to undergo NIST validation, there may be some OVAL interpreter bugs to workout within SCC. In my experience the SCC team has been incredibly open to feedback, and many of them lurk here... perhaps they'll chirp up ;)
These results were with SCC 3.1 GA. I've got a copy of rc6, but it isn't on my test machine right now. I need to scrape up some time and migrate that to my test environment and rerun, but thought I drop the initial results.
-Rob
________________________________________ From: scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on behalf of Shawn Wells [shawn@redhat.com] Sent: Monday, August 26, 2013 10:28 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: SCC 3.1 results with SSG content
On 8/26/13 4:14 PM, Robert Sanders wrote:
Afternoonall, Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item):
RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8) [ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_-.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855. [ERROR] Check system [ocil-transitional] is not supported. Check will not be performed. Target System: RH64-64 Selected Profile: rht-ccp Stream Name: ssg-rhel6- Stream Version: 0.9 Stream Date: 2013-07-05 Rule ID: partition_for_tmp
This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed.
I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group.
That matches my own experiences with SCC 3.1: http://people.redhat.com/swells/SCC/Logs/RHEL6_SCC-3.1_2013-02-17_102333_Err...
I had the opportunity to meet the SCC team at the MITRE SCAP DevDays, then again at Mil-OSS Charleston a few weeks ago. They're a really great group of people and have been working on updates which should be (IIRC) incorporated into the SCC 3.1 RC6 release which dropped on 8/13.
I've yet to play with the RC6 build, but hope to over the coming week. Did you use SCC v3.1 GA, or one of the recent RC builds? As SCC has yet to undergo NIST validation, there may be some OVAL interpreter bugs to workout within SCC. In my experience the SCC team has been incredibly open to feedback, and many of them lurk here... perhaps they'll chirp up ;) _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
I have observed this as well. I believe it is expected behavior and will happen whenever it sees check systems other than OVAL or OCIL. It should still process all the OVAL and OCIL checks and you should get results. Rules that have only OCIL-transitional checks will be marked as NOTTESTED. I think the match error is related to the unknown check as well. I think Jeff pushed the OCIL-transitional fix so these errors will go away with the newest version of the content (the ocilrefs version).
Jim
-----Original Message----- From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Robert Sanders Sent: Tuesday, August 27, 2013 8:43 AM To: scap-security-guide@lists.fedorahosted.org Subject: RE: SCC 3.1 results with SSG content
These results were with SCC 3.1 GA. I've got a copy of rc6, but it isn't on my test machine right now. I need to scrape up some time and migrate that to my test environment and rerun, but thought I drop the initial results.
-Rob
________________________________________ From: scap-security-guide-bounces@lists.fedorahosted.org [scap-security-guide-bounces@lists.fedorahosted.org] on behalf of Shawn Wells [shawn@redhat.com] Sent: Monday, August 26, 2013 10:28 PM To: scap-security-guide@lists.fedorahosted.org Subject: Re: SCC 3.1 results with SSG content
On 8/26/13 4:14 PM, Robert Sanders wrote:
Afternoonall, Just wanted to post some interesting lines from running the SCC3.1 tool with the latest SSG yum content. I'm seeing a fair number of items failing with messages like the following (an example line item):
RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate Partition - (CCE-26435-8) [ERROR] 'no line is returned' does not match 'oval:[A-Za-z0-9_-.]+:var:[1-9][0-9]*'. at /</opt/scc/cscc>System/System_Functions.pm line 2855. [ERROR] Check system [ocil-transitional] is not supported. Check will not be performed. Target System: RH64-64 Selected Profile: rht-ccp Stream Name: ssg-rhel6- Stream Version: 0.9 Stream Date: 2013-07-05 Rule ID: partition_for_tmp
This line is showing both example of the errors I've seen , the oval match issue and the ocil-transitional stuff. It appears the errors are always the same, and scattered independently through the 385 checks, for a total of 131 errors listed.
I have done exactly zero digging to see what is happening, just wanted to toss this out to the collective eyeballs of the group.
That matches my own experiences with SCC 3.1: http://people.redhat.com/swells/SCC/Logs/RHEL6_SCC-3.1_2013-02-17_102333_Err...
I had the opportunity to meet the SCC team at the MITRE SCAP DevDays, then again at Mil-OSS Charleston a few weeks ago. They're a really great group of people and have been working on updates which should be (IIRC) incorporated into the SCC 3.1 RC6 release which dropped on 8/13.
I've yet to play with the RC6 build, but hope to over the coming week. Did you use SCC v3.1 GA, or one of the recent RC builds? As SCC has yet to undergo NIST validation, there may be some OVAL interpreter bugs to workout within SCC. In my experience the SCC team has been incredibly open to feedback, and many of them lurk here... perhaps they'll chirp up ;) _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org
-
Robert Sanders -
Ronayne, James K. -
Shawn Wells