RE: scap-security-guide 0.1-10 help

[Rodrian, Logan P (IS)]

That is the URL where I found the command.  I just happened to try the common profile in addition to the stig-rhel6-server profile.  Both yield the same result showing "notapplicable".

Logan Rodrian

________________________________
From: [e-mail] [[e-mail]] on behalf of Shawn Wells [[e-mail]]
Sent: Wednesday, March 06, 2013 19:53
To: [e-mail]
Subject: EXT :Re: scap-security-guide 0.1-10 help

On 3/6/13 5:19 PM, Rodrian, Logan P (IS) wrote:

*

I am attempting a secstate audit and would like to use the newly released scap-security-guide v0.1-10.  I have tried simply applying the v0.1-10 rpm and importing that content into secstate.  When running a profile (no matter which is selected), the report shows that none of the rules have been selected.  Backing up a layer, I simply tried the instructions on the scap-security-guide webpage of running:

oscap xccdf eval --profile common /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

...and then all output shows "Result notapplicable".
I haven't used the secstate tool much recently, so I can't address that... but as for the oscap command above, where on the webpage did you find it? That's an outdated invocation and needs to be updated.

Here's the current usage guide: https://fedorahosted.org/scap-security-guide/wiki/usageguide

scap-security-guide 0.1-10 help

[Brian Peake]

Check the profile name: I found it appears to have changed and is no longer
stig-rhel6-server

I can't remember what it is now (have to scan the XCDDF), but the SSG site
user documentation had not been updated when I attempted my runs.

Very Respectfully,

Brian Peake
HiPK, LLC

From:  "Rodrian, Logan P (IS)" 
Reply-To:  
Date:  Thu, 7 Mar 2013 13:31:27 +0000
To:  "[e-mail]"

Subject:  RE: scap-security-guide 0.1-10 help

That is the URL where I found the command.  I just happened to try the
common profile in addition to the stig-rhel6-server profile.  Both yield the
same result showing "notapplicable".

Logan Rodrian

From: [e-mail]
[[e-mail]] on behalf of Shawn
Wells [[e-mail]]
Sent: Wednesday, March 06, 2013 19:53
To: [e-mail]
Subject: EXT :Re: scap-security-guide 0.1-10 help

On 3/6/13 5:19 PM, Rodrian, Logan P (IS) wrote:
> I am attempting a secstate audit and would like to use the newly released
> scap-security-guide v0.1-10.  I have tried simply applying the v0.1-10 rpm and
> importing that content into secstate.  When running a profile (no matter which
> is selected), the report shows that none of the rules have been selected.
> Backing up a layer, I simply tried the instructions on the scap-security-guide
> webpage of running:
> oscap xccdf eval --profile common
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> ...and then all output shows "Result notapplicable".

I haven't used the secstate tool much recently, so I can't address that...
but as for the oscap command above, where on the webpage did you find it?
That's an outdated invocation and needs to be updated.

Here's the current usage guide:
https://fedorahosted.org/scap-security-guide/wiki/usageguide
_______________________________________________ scap-security-guide mailing
list [e-mail]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

scap-security-guide 0.1-10 help

[Brian Peake]

IGNORE my last. Just checked, that profile is thereŠ

Very Respectfully,

Brian Peake
HiPK, LLC
From:  Brian  Peake 
Reply-To:  
Date:  Thu, 07 Mar 2013 08:41:59 -0500
To:  
Subject:  Re: scap-security-guide 0.1-10 help

Check the profile name: I found it appears to have changed and is no longer
stig-rhel6-server

I can't remember what it is now (have to scan the XCDDF), but the SSG site
user documentation had not been updated when I attempted my runs.

Very Respectfully,

Brian Peake
HiPK, LLC

From:  "Rodrian, Logan P (IS)" 
Reply-To:  
Date:  Thu, 7 Mar 2013 13:31:27 +0000
To:  "[e-mail]"

Subject:  RE: scap-security-guide 0.1-10 help

That is the URL where I found the command.  I just happened to try the
common profile in addition to the stig-rhel6-server profile.  Both yield the
same result showing "notapplicable".

Logan Rodrian

From: [e-mail]
[[e-mail]] on behalf of Shawn
Wells [[e-mail]]
Sent: Wednesday, March 06, 2013 19:53
To: [e-mail]
Subject: EXT :Re: scap-security-guide 0.1-10 help

On 3/6/13 5:19 PM, Rodrian, Logan P (IS) wrote:
> I am attempting a secstate audit and would like to use the newly released
> scap-security-guide v0.1-10.  I have tried simply applying the v0.1-10 rpm and
> importing that content into secstate.  When running a profile (no matter which
> is selected), the report shows that none of the rules have been selected.
> Backing up a layer, I simply tried the instructions on the scap-security-guide
> webpage of running:
> oscap xccdf eval --profile common
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> ...and then all output shows "Result notapplicable".

I haven't used the secstate tool much recently, so I can't address that...
but as for the oscap command above, where on the webpage did you find it?
That's an outdated invocation and needs to be updated.

Here's the current usage guide:
https://fedorahosted.org/scap-security-guide/wiki/usageguide
_______________________________________________ scap-security-guide mailing
list 
[e-mail]://lists.fedorahosted.org/mai
lman/listinfo/scap-security-guide
_______________________________________________ scap-security-guide mailing
list [e-mail]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

scap-security-guide 0.1-10 help

[Rodrian, Logan P (IS)]

It appears that the full command is needed.  The scan won't run without the cpe/dictionary reference.  The minimal command needed is as follows:

oscap xccdf eval --profile <profile> \
--cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

Logan Rodrian
________________________________
From: [e-mail] [[e-mail]] on behalf of Brian Peake [[e-mail]]
Sent: Thursday, March 07, 2013 06:47
To: [e-mail]
Subject: EXT :Re: scap-security-guide 0.1-10 help

IGNORE my last. Just checked, that profile is there…

Very Respectfully,

Brian Peake
HiPK, LLC
From: Brian Peake <[e-mail]>
Reply-To: <[e-mail]>
Date: Thu, 07 Mar 2013 08:41:59 -0500
To: <[e-mail]>
Subject: Re: scap-security-guide 0.1-10 help

Check the profile name: I found it appears to have changed and is no longer stig-rhel6-server

I can't remember what it is now (have to scan the XCDDF), but the SSG site user documentation had not been updated when I attempted my runs.

Very Respectfully,

Brian Peake
HiPK, LLC

From: "Rodrian, Logan P (IS)" <[e-mail]>
Reply-To: <[e-mail]>
Date: Thu, 7 Mar 2013 13:31:27 +0000
To: "[e-mail]" <[e-mail]>
Subject: RE: scap-security-guide 0.1-10 help

That is the URL where I found the command.  I just happened to try the common profile in addition to the stig-rhel6-server profile.  Both yield the same result showing "notapplicable".

Logan Rodrian

________________________________
From: [e-mail] [[e-mail]] on behalf of Shawn Wells [[e-mail]]
Sent: Wednesday, March 06, 2013 19:53
To: [e-mail]
Subject: EXT :Re: scap-security-guide 0.1-10 help

On 3/6/13 5:19 PM, Rodrian, Logan P (IS) wrote:

*

I am attempting a secstate audit and would like to use the newly released scap-security-guide v0.1-10.  I have tried simply applying the v0.1-10 rpm and importing that content into secstate.  When running a profile (no matter which is selected), the report shows that none of the rules have been selected.  Backing up a layer, I simply tried the instructions on the scap-security-guide webpage of running:

oscap xccdf eval --profile common /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

...and then all output shows "Result notapplicable".
I haven't used the secstate tool much recently, so I can't address that... but as for the oscap command above, where on the webpage did you find it? That's an outdated invocation and needs to be updated.

Here's the current usage guide: https://fedorahosted.org/scap-security-guide/wiki/usageguide
_______________________________________________ scap-security-guide mailing list [e-mail]://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________ scap-security-guide mailing list [e-mail] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

scap-security-guide 0.1-10 help

[Shawn Wells]

On 3/7/13 8:51 AM, Rodrian, Logan P (IS) wrote:
> It appears that the full command is needed.  The scan won't run 
> without the cpe/dictionary reference.  The minimal command needed is 
> as follows:
> oscap xccdf eval --profile <profile> \
> --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

Ah, yes. The --cpe is *very* much needed as it provides some platform 
checks. The others (--report, etc) are optional.