scap-security-guide November 2013

scap-security-guide@lists.fedorahosted.org

23 participants
73 discussions

Introducing docs/ directory
by Shawn Wells 10 Nov '13

10 Nov '13

The need for documentation has increased as the project matures and gained popularity. To this end a "User Guide" and a "Developers Guide" has taken shape. The initial code dump (original patch was ~4MB, hence not posting to list first!): https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/docs This initial patch should provide a base framework to build out these documents, and should be considered alpha/draft. The intent is to provide a User Guide which comprehensively documents the usage of SSG, and a Developers Guide that details out our build process, coding standards, and other information a new project member would find useful. This code is currently running at http://docs.ssgproject.org/, however I can't stress enough the need to consider this alpha/beta at best! At some point Jenkins may be setup to push doc updates to docs.ssgproject.org .... help would be much appreciated if anyone knows Jenkins!

3 7

[PATCH] Updated User Guide with content from Ted Brunell
by Shawn Wells 09 Nov '13

09 Nov '13

1 0

[PATCH 2/2] Updated Makefile * HTML index files
by Shawn Wells 09 Nov '13

09 Nov '13

1 0

[PATCH 1/2] Added docs/User_Guide/ section on SCC
by Shawn Wells 09 Nov '13

09 Nov '13

1 0

[PATCH] Incorporation of workbook into docs/Makefile
by Shawn Wells 09 Nov '13

09 Nov '13

1 0

[PATCH] set class=compliance for x86-bitness definitions
by Steinke, Leland J Sr CTR DISA DD (US) 08 Nov '13

08 Nov '13

The NIST SCAP Content Validation Tool threw errors on the system_info_architecture_x86* definitions (requirement ID 208). This patch corrects the errors. Regards, -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr(a)mail.mil (gov't) lsteinke(a)tapestrytech.com (com'l) --- .../input/checks/system_info_architecture_x86.xml | 2 +- .../checks/system_info_architecture_x86_64.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/RHEL6/input/checks/system_info_architecture_x86.xml b/RHEL6/input/checks/system_info_architecture_x86.xml index f05260a..393c4d6 100644 --- a/RHEL6/input/checks/system_info_architecture_x86.xml +++ b/RHEL6/input/checks/system_info_architecture_x86.xml @@ -1,5 +1,5 @@ <def-group> - <definition class="miscellaneous" id="system_info_architecture_x86" + <definition class="compliance" id="system_info_architecture_x86" version="1">  diff --git a/RHEL6/input/checks/system_info_architecture_x86_64.xml b/RHEL6/input/checks/system_info_architecture_x86_64.xml index d4e681f..08481b5 100644 --- a/RHEL6/input/checks/system_info_architecture_x86_64.xml +++ b/RHEL6/input/checks/system_info_architecture_x86_64.xml @@ -1,5 +1,5 @@ <def-group> - <definition class="miscellaneous" id="system_info_architecture_x86_64" + <definition class="compliance" id="system_info_architecture_x86_64" version="1">  -- 1.7.1

3 3

[PATCH] Fixed a typo in the CS2 profile.
by Caleb Cooper 08 Nov '13

08 Nov '13

There was a small typo in the CS2 profile that prevented the accounts_maximum_age_login_defs rule from running. Caleb Cooper (1): Fixed a typo in the CS2 profile

1 1

STIG ID RHEL-06-000324 /SSG ID Enable GUI Warning Banner PATCH
by Mercer, Rodney 07 Nov '13

07 Nov '13

8<==================== Subject: [PATCH] Added proper filepath, addition of the state, filename->filepath conversion to RHEL6/input/checks/banner_gui_enabled.xml --- RHEL6/input/checks/banner_gui_enabled.xml | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/checks/banner_gui_enabled.xml b/RHEL6/input/checks/banner_gui_enabled.xml index 786a7b7..f9612d3 100644 --- a/RHEL6/input/checks/banner_gui_enabled.xml +++ b/RHEL6/input/checks/banner_gui_enabled.xml @@ -6,6 +6,7 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>Enable the GUI warning banner.</description> + <reference source="rmercer" ref_id="20131104" ref_url="test_attestation" /> </metadata> <criteria> <criterion comment="check settings" test_ref="test_banner_gui_enabled" /> @@ -13,10 +14,13 @@ </definition> <ind:xmlfilecontent_test check="all" comment="stuff" id="test_banner_gui_enabled" version="1"> <ind:object object_ref="object_banner_message_enable" /> + <ind:state state_ref="state_banner_message_enable" /> </ind:xmlfilecontent_test> <ind:xmlfilecontent_object id="object_banner_message_enable" version="1"> - <ind:path>/etc/gconf/gconf.xml.defaults</ind:path> - <ind:filename>%gconf-tree.xml</ind:filename> - <ind:xpath>/gconf/dir[@name='apps']/dir[@name='gdm']/dir[@name='simple-greeter']/entry[@name='banner_message_enable']/local_schema[1]/default[1]/@value</ind:xpath> + <ind:filepath>/var/lib/gdm/.gconf/apps/gdm/simple-greeter/% gconf.xml</ind:filepath> + <ind:xpath>/gconf/entry[@name='banner_message_enable']/@value</ind:xpath> </ind:xmlfilecontent_object> + <ind:xmlfilecontent_state id="state_banner_message_enable" version="1"> + <ind:value_of datatype="string">true</ind:value_of> + </ind:xmlfilecontent_state> </def-group> -- 1.7.1

2 1

[PATCH] Added CCEs to remaining rules
by Shawn Wells 07 Nov '13

07 Nov '13

2 2

banner_gui_enabled.xml
by Mercer, Rodney 04 Nov '13

04 Nov '13

I was seeing a fail on "Result for Enable GUI Warning Banner" CCE-27195-7. I found this ticket: https://fedorahosted.org/scap-security-guide/ticket/319 So I worked on the banner_gui_enabled.xml file and came up with the attached replacement. I tested it and it appears to work correctly. Could someone check this to see if I have this right? Thanks, Rodney. --

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2013