The project page of the OSCAP Anaconda Addon [1] now has a section about testing with links to the custom Fedora 20 compose with the OSCAP Anaconda Addon included and to some testing files.
[1] https://fedorahosted.org/oscap-anaconda-addon/
Suggestions, comments and bug reports welcome.
On 11/20/13, 9:15 AM, Vratislav Podzimek wrote:
The project page of the OSCAP Anaconda Addon [1] now has a section about testing with links to the custom Fedora 20 compose with the OSCAP Anaconda Addon included and to some testing files.
[1]https://fedorahosted.org/oscap-anaconda-addon/
Suggestions, comments and bug reports welcome.
That page is fantastic. The instructions are incredibly simple -- this should greatly increase testing done by users. Thank you!
Attempted to perform an install against Fedora 20 SSG content [1], which lead to BZ 1032846 [2] that was generated from the installer. After reviewing the BZ, it's clear my issue was that Anaconda expects a SCAP Datastream and SSG content is expressed as a Benchmark.
1) When using SSG content for "fetch," an error was thrown regarding SSG not being a datastream. After submitting the bugzilla the entire install crashed/rebooted, instead of giving me the option to use another datastream URL or continue without SCAP addon enabled. Is that expected behavior?
2) Will Benchmark content be accepted in the future, or must content be in datastream formats? If datastream, we're looking at a fundamental change to how SSG content is expressed. That's not necessarily a bad thing, just want to start the conversation and understand your direction :)
3) Nit pick. After fetching your datastream content [3] I was brought to the "profile selection" screen where options included "testing profile" and "testing profile2". My natural reaction was to double-click on the profile names -- and after nothing happened -- I finally noticed the "Select Profile" button. Would it be possible to edit the workflow so that users could double click on the profile?
[1] http://people.redhat.com/swells/scap-security-guide/Fedora/output/ssg-fedora... [2] https://bugzilla.redhat.com/show_bug.cgi?id=1032846 [3] http://vpodzime.fedorapeople.org/oscap-anaconda-addon/testing_ds.xml
On Wednesday, November 20, 2013 10:13:45 PM Shawn Wells wrote:
- Will Benchmark content be accepted in the future, or must content be
in datastream formats? If datastream, we're looking at a fundamental change to how SSG content is expressed. That's not necessarily a bad thing, just want to start the conversation and understand your direction
One of the features of SCAP 1.2 is datastreams. It allows for 1 file to be signed and delivered. Its much more convenient to distribute content like that than individual files. Simon wrote a tutorial on how to convert an existing collection of content into a datastream here:
http://isimluk.livejournal.com/3660.html?title=How to convert USGCB to DataStream with OpenSCAP
-Steve
Hi,
On Wednesday, November 20, 2013 10:13:45 PM Shawn Wells wrote:
- Will Benchmark content be accepted in the future, or must content be
in datastream formats? If datastream, we're looking at a fundamental change to how SSG content is expressed. That's not necessarily a bad thing, just want to start the conversation and understand your direction
One of the features of SCAP 1.2 is datastreams. It allows for 1 file to be signed and delivered. Its much more convenient to distribute content like that than individual files. Simon wrote a tutorial on how to convert an existing collection of content into a datastream here:
http://isimluk.livejournal.com/3660.html?title=How to convert USGCB to DataStream with OpenSCAP
I agree, it also makes it easier and more manageable to scan remote machines.
One downside is that you can't use XCCDF 1.1 inside a datastream. Datastreams only allow XCCDF 1.2.
If you are interested I could help you with the transition to XCCDF 1.2. The main hurdle will likely be changing all the Rule and Group IDs to the new enforced XCCDF 1.2 format. After that is done, we could simply use openscap to automatically pack up the datastream and have all of this be a part of the build process in scap-security-guide.
One risk I can see is that the content will no longer be XCCDF 1.1, so tools only implementing XCCDF 1.1 can no longer use it. Not sure how big a deal that is but if needed we could build both XCCDF 1.1 and 1.2 with not that much added complexity to the build process.
On Friday, November 22, 2013 07:45:42 AM Martin Preisler wrote:
Hi,
On Wednesday, November 20, 2013 10:13:45 PM Shawn Wells wrote:
- Will Benchmark content be accepted in the future, or must content be
in datastream formats? If datastream, we're looking at a fundamental change to how SSG content is expressed. That's not necessarily a bad thing, just want to start the conversation and understand your direction
One of the features of SCAP 1.2 is datastreams. It allows for 1 file to be signed and delivered. Its much more convenient to distribute content like that than individual files. Simon wrote a tutorial on how to convert an existing collection of content into a datastream here:
http://isimluk.livejournal.com/3660.html?title=How to convert USGCB to DataStream with OpenSCAP
I agree, it also makes it easier and more manageable to scan remote machines.
One downside is that you can't use XCCDF 1.1 inside a datastream. Datastreams only allow XCCDF 1.2.
The SSG content is already using features found only in SCAP 1.2, so I would hope that content being created completely embraces SCAP 1.2. SCAP is certified as a unit. Meaning you don't mix and match the versions of OVAL, XCCDF, CPE, etc. So, if SSG is not fully up to SCAP 1.2, it should be patched to be at 1.2 for all of the SCAP standards its using.
-Steve
If you are interested I could help you with the transition to XCCDF 1.2. The main hurdle will likely be changing all the Rule and Group IDs to the new enforced XCCDF 1.2 format. After that is done, we could simply use openscap to automatically pack up the datastream and have all of this be a part of the build process in scap-security-guide.
One risk I can see is that the content will no longer be XCCDF 1.1, so tools only implementing XCCDF 1.1 can no longer use it. Not sure how big a deal that is but if needed we could build both XCCDF 1.1 and 1.2 with not that much added complexity to the build process.
On Wed, 2013-11-20 at 22:13 -0500, Shawn Wells wrote:
On 11/20/13, 9:15 AM, Vratislav Podzimek wrote:
The project page of the OSCAP Anaconda Addon [1] now has a section about testing with links to the custom Fedora 20 compose with the OSCAP Anaconda Addon included and to some testing files.
[1]https://fedorahosted.org/oscap-anaconda-addon/
Suggestions, comments and bug reports welcome.
That page is fantastic. The instructions are incredibly simple -- this should greatly increase testing done by users. Thank you!
Attempted to perform an install against Fedora 20 SSG content [1], which lead to BZ 1032846 [2] that was generated from the installer. After reviewing the BZ, it's clear my issue was that Anaconda expects a SCAP Datastream and SSG content is expressed as a Benchmark.
Thanks for filing the bug report. Unfortunately, this is an expected behaviour, because the GUI content specification is something like an experimental and unfinished feature. So far only datastreams are supported this way, benchmarks are supported via kickstart %addon section.
- When using SSG content for "fetch," an error was thrown regarding SSG
not being a datastream. After submitting the bugzilla the entire install crashed/rebooted, instead of giving me the option to use another datastream URL or continue without SCAP addon enabled. Is that expected behavior?
I've already answered this above. It needs additional work.
- Will Benchmark content be accepted in the future, or must content be
in datastream formats? If datastream, we're looking at a fundamental change to how SSG content is expressed. That's not necessarily a bad thing, just want to start the conversation and understand your direction :)
Standalone benchmarks and OVAL XMLs are supported by the %addon kickstart section, interactive (GUI) fetching is planned for the future.
- Nit pick. After fetching your datastream content [3] I was brought to
the "profile selection" screen where options included "testing profile" and "testing profile2". My natural reaction was to double-click on the profile names -- and after nothing happened -- I finally noticed the "Select Profile" button. Would it be possible to edit the workflow so that users could double click on the profile?
Yeah, that's a good idea and quite an easy fix. Thanks for the tip!
scap-security-guide@lists.fedorahosted.org
-
Martin Preisler -
Shawn Wells -
Steve Grubb -
Vratislav Podzimek