scap-security-guide August 2014

scap-security-guide@lists.fedorahosted.org

22 participants
30 discussions

sshd banner warning
by Jeremiah Jahn 21 Jan '15

21 Jan '15

We used to have to keep out banners under /etc/issue for the console, and /etc/issue.net for remote access. Would it be okay to make this rule deal with either one? diff --git a/shared/oval/sshd_enable_warning_banner.xml b/shared/oval/sshd_enable_warning_banner.xml index 0bd8d32..ace8b75 100644 --- a/shared/oval/sshd_enable_warning_banner.xml +++ b/shared/oval/sshd_enable_warning_banner.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_test> <ind:textfilecontent54_object id="obj_sshd_banner_set" version="2"> <ind:filepath>/etc/ssh/sshd_config</ind:filepath> - <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*(?:|(?:#.*))?$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue(.net){0,1}[\s]*(?:|(?:#.*))?$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>

5 9

RE: New report and guide in openscap 1.1.0
by Chen, Wei (Contractor)(CFPB) 09 Sep '14

09 Sep '14

Couple comments on the report layout. • Rules result breakdown - while the color bar breakdown is nice, it doesn't present precise information at first glance. The user will see 86 passed, 131 failed, and left guessing what that remaining 6 rules are. It'll be nice to see the total number of rules as well. • Failed rules by severity breakdown – similar to rules results, the severity description got cut off even though it’s easy to assume that the two failed rules refer to High severity. • Score – it’ll be nice to have a brief explanation or reference to how the scoring is done for those not familiar with the scoring system. • Section heading – I think the number of “not checked” should also be included in the section heading along with fail and unknown. For example, I could’ve easily missed “Ensure Software Patches Installed” since it was collapsed within Updating Software section. Regards, Wei ----- Original Message ----- > From: "Martin Preisler" <mpreisle(a)redhat.com<mailto:mpreisle@redhat.com>> > To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>> > Sent: Thursday, August 28, 2014 7:49:23 PM > Subject: New report and guide in openscap 1.1.0 > > Hi, > > as you may know I have been working on a complete rewrite of HTML > report and guide for the upcoming openscap 1.1.0 release. It's a > feature that will touch almost every user of openscap. I would like to > gather feedback from the scap-security-guide community so that we can > make sure there aren't any blocker issues in the release. It is > natural that there will be small issues that we will iron out in minor > releases. Basically we would just like to make sure the new report and > guide aren't missing anything crucial that would prevent adoption. > > See https://mpreisle.fedorapeople.org/openscap/1.1.0_xslt/ for sample > HTML report and guide from SSG for RHEL6. > > Looking forward to feedback. > > -- > Martin Preisler > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org> > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/

2 3

Best ways to say this system is not compliant
by Greg Elin 04 Sep '14

04 Sep '14

Several participants in the thread "Re: New report and guide in openscap 1.1.0" raised concerned over a language "The system is not compliant!" in the report. I agree. "not compliant" ideally should only be done against a policy established by an organization for that system. The assessment and passing of any set of controls != compliance, it is a step toward compliance. Public profiles are, generally speaking, against *baselines*. It would be great if the use of OpenSCAP and SSG inspired/encouraged Departments and Agencies to develop and manage their own profiles that build on top of the baseline profiles. For example, if a test is run against a default profile, feedback should emphasize the profile is a default profile and encourage organization to maintain their own organizational profiles. Imagine if by default OpenSCAP tried to find to an agency's default repository of profiles. If no agency-defined repository existed, OpenSCAP would communicate it "No agency-specific profiles available. To create agency specific profiles blah, blah...OpenSCAP using default SCAP-Security-Guide baseline profile blah, blah, blah." This would constantly remind users they should be managing their own set of profiles. Of course, managing drift among agency specific profiles vs the baselines becomes another issue -- but that is something further for OpenSCAP and SSG to assist. Greg Elin http://govready.org - Making FISMA compliance easier for innovators email: gregelin(a)gitmachines.com phone: 917-304-3488

4 10

New report and guide in openscap 1.1.0
by Martin Preisler 02 Sep '14

02 Sep '14

Hi, as you may know I have been working on a complete rewrite of HTML report and guide for the upcoming openscap 1.1.0 release. It's a feature that will touch almost every user of openscap. I would like to gather feedback from the scap-security-guide community so that we can make sure there aren't any blocker issues in the release. It is natural that there will be small issues that we will iron out in minor releases. Basically we would just like to make sure the new report and guide aren't missing anything crucial that would prevent adoption. See https://mpreisle.fedorapeople.org/openscap/1.1.0_xslt/ for sample HTML report and guide from SSG for RHEL6. Looking forward to feedback. -- Martin Preisler

8 30

Re: New report and guide in openscap 1.1.0
by Gabe Alford 01 Sep '14

01 Sep '14

On Fri, Aug 29, 2014 at 3:37 AM, Martin Preisler <mpreisle(a)redhat.com> wrote: > ----- Original Message ----- > > From: "Andrew Gilmore" <agilmore2(a)gmail.com> > > To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org> > > Sent: Thursday, August 28, 2014 8:29:48 PM > > Subject: Re: New report and guide in openscap 1.1.0 > > > > I like the new look and functionality. > > > > Two first blush comments: > > 1) On the report document, I can imagine my security officials freaking > out > > over the in-your-face "*The system is not compliant!*" text. What is the > > recommended course to ensure this text does not appear if you're running > > the scan on a webserver, for example? Is it as simple as creating a > custom > > profile derived from the STIG profile? Does anyone directly use the STIG > > profile, have a completely compliant system, and have a server that > > actually does anything useful? > > Up to now, I've left tests in that I have waivers for, and then pointed > at > > the waivers to justify the test failures. Perhaps I will need to change > > that practice. > > Isn't that a good thing? They should freak out, their system is not > compliant! > The recommended course is to tailor the profile, leaving out rules that > make > no sense on your system. Then you fix the remaining rules using > remediation. > In the end the machine will be compliant. > I would maybe add or modify the message here to be something along the lines: - "The system is not compliant! Please review rule results, site/network security requirements, and consider applying remediation." --- or --- - "The system may not be compliant! Please review rule results, site/network security requirements, and consider applying remediation." I personally would prefer the last one as it says, "Hey. Check your system as well as check your security requirements to see if what you are seeing from the scan matches with those security requirements." The job of openscap is to check your machines for compliance over and over. > When the machines are suddenly not compliant you really want to know that! > > > 2) On the guide document, the text beginning "Providing system > > administrators" occurs twice. > > Looks like an issue with SSG but I will look more into it. > > -- > Martin Preisler > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/ >

4 5

NIST 800-53 identifiers
by Kordell, Luke T 30 Aug '14

30 Aug '14

Hello, I noticed that the majority of the rule definitions now have NIST 800-53 identifiers or an empty set of quotes where an identifier will be added. Is there a way to get the already-added identifiers to show-up on the .html scan results? At the moment all I can see is the CCE number. Thanks, Luke K

5 6

[jFYI / ahead notification] scap-security-guide-0.1.19 coming next week => submit pull requests for any pending patches / changes soon (till next Wed, 2014-09-03)
by Jan Lieskovsky 28 Aug '14

28 Aug '14

Hello folks, jFYI mail that again the time to make a new upstream SSG release has come (116 existing changes since the last 0.1.18 one): $ git describe v0.1.18-116-g27c9ee2 Therefore in accordance with the previously discussed release policy (and actually later than first Friday in the month -- the delay caused due to summer vacation) this time next week I plan to make new upstream 0.1.19 release. Thus would like to kindly ask you that in case you have any pending patches which should go into 0.1.19 release yet, to submit corresponding pull requests soon (till Wed of next week), so they could be reviewed on time. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

1 0

Baseline configs & DevOps code-a-thon
by Greg Elin 27 Aug '14

27 Aug '14

Double posting to Scap-Security-Guide and OpenSCAP mailing list... Can I get a show of hands a late September or early October, one or two day code-a-thon around baseline configurations and integrating compliance tools with DevOps? The space of SCAP, baselines, and general integration of security with DevOps seems to be getting frothy lately with activity. Examples: http://bit.ly/DevOpsAudit, OpenSCAP on Github, https://github.com/fisma-ready/ubuntu-lts. We also have some work, like http://martin.preisler.me/2014/07/openscap-html-report-redesign/ that could benefit from some shared face time and coding. I think there would be a nice turn out in DC for such an event. Greg Elin P: 917-304-3488 E: gregelin(a)gitmachines.com Sent from my iPhone

5 8

Onwards, to GitHub
by Shawn Wells 27 Aug '14

27 Aug '14

Migration to GitHub has been discussed for some time. As preparation for this, over the past few months, the OpenSCAP community of projects have slowly established mirrors of their source repositories at https://github.com/OpenSCAP. Off the OpenSCAP project page you'll find: - Tooling: OpenSCAP Toolkit, SCAP Workbench; - Content: SCAP Security Guide, SCE Community Content; - Ecosystem Projects: Anaconda OpenSCAP Add-On, OpenSCAP Puppet extensions, Foreman integration The idea was to provide a single source repository for the various components, and many thanks to Martin Preisler for setting all this up! For the past two weeks, community members with commit access were asked to start using GitHub as SSG's upstream repository. We wanted to test repository access controls (thanks Greg Elin!), GitHub-style workflows (thanks, everyone), and acclimate to any process changes. The migration has been straightforward, and the new Pull Request process is working well. Hopefully, no more dropped patches or bug reports :) *You can find SSG's repository here:* https://github.com/OpenSCAP/scap-security-guide *We've also started a "SSG on GitHub Primer," for which patches would be most welcome:* https://github.com/OpenSCAP/scap-security-guide/wiki/SSG-on-GitHub-Primer For those who are curious, an example of the Pull Request process (how patches are displayed, how feedback can be given) can be found in the 'Add OVAL for CTRL+ALT+DELETE key sequence" patch: https://github.com/OpenSCAP/scap-security-guide/pull/31 The Pull Request process does mean that patches need not be sent to the mailing list anymore. While pull requests will be centrally managed on a dashboard (of sorts), that does mean members of the community may miss out on dialogs relating to code changes. To ensure you don't miss anything you can setup yourself to "Watch" the project on GitHub. When you 'watch' a project, you are presented with three options: - EMailed only upon mentioning of the project in discussion, or if someone mentions you directly; - EMailed upon every action (patch submissions, comments, tickets, comments on tickets...); - EMailed never, ever Note than when you receive an EMail notification (say, a comment on a patch), you can reply directly from EMail. There's no need to login to GitHub to join the conversation. When you login to GitHub, on the top right, you'll see a section that looks like this: When you click on the "Watch" button you're presented with the three options: GitHub does reflect new processes and a new system for community engagement. Feedback as we migrate is most welcome on the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide. See everyone on GitHub! -Shawn

2 1

On the purpose of cpe_generate.py script (& mainly cpe_variables section within it)
by Jan Lieskovsky 27 Aug '14

27 Aug '14

Hello folks, within effort to rewrite umask checks (more about the motivation for this later within its dedicated email thread) encountered the following RHEL/6/transforms/cpe_generate.py script related issue. Use case: Let's consider RHEL/6/input/checks/accounts_umask_etc_profile.xml OVAL check would have the form as attached (it's not the final form of the check. The final one will be slightly more complex yet. In any case the attached form is syntactically correct one & sufficient to demonstrate the issue I would like to speak below about), then running 'make' in scap-security-guide/RHEL/6 subdirectory returns the following error when trying to generate the datastream output: oscap ds sds-compose output/ssg-rhel6-xccdf-1.2.xml output/ssg-rhel6-ds.xml oscap ds sds-add output/ssg-rhel6-cpe-dictionary.xml output/ssg-rhel6-ds.xml File 'output/ssg-rhel6-ds.xml' line 32236: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}object_component': No match found for key-sequence ['oval:ssg:obj:111'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}objectKeyRef'. Invalid SCAP Source Datastream content(1.2) in output/ssg-rhel6-ds.xml. make: *** [content] Error 1 Investigated the problem further, and noticed the problem is content of RHEL/6/output/ssg-rhel6-cpe-oval.xml file. Namely it contains the content as follows: ... </states><variables><local_variable id="oval:ssg:var:110" datatype="int" comment="x" version="1"> <substring substring_start="1" substring_length="1"> <object_component item_field="subexpression" object_ref="oval:ssg:obj:111"/> </substring> </local_variable> </variables></oval_definitions> which after more detailed look explains why 'oval:ssg:obj:111' wouldn't be defined in output/ssg-rhel6-ds.xml file (the oval:ssg:var:110 local variable references oval:ssg:obj:111, but this object isn't defined within that ssg-rhel6-cpe-oval.xml file [only in different part of ssg-rhel6-ds.xml file]). So investigated further to see, which part of the RHEL/6's Makefile generates / includes this variable, when creating ssg-rhel6-cpe-oval.xml file, and noticed the responsible script being RHEL/6/transforms/cpe_generate.py. The questions: 1) Can someone more familiar with the implementation of this script clarify it's purpose? It requires two input files (OVAL file & CPE file), and one identifier (ssg), and generates 'ssg-rhel6-cpe-oval.xml' file. 2) Can someone more familiar with the implementation of this script clarify the need for the following construct within it?: 82 variables = ovaltree.find("./{%s}variables" % oval_ns) 83 cpe_variables = extract_referred_nodes(ovaltree, variables, "var_ref") 84 if cpe_variables: 85 variables.clear() 86 [variables.append(cpe_variable) for cpe_variable in cpe_variables] 87 else: 88 ovaltree.remove(variables) Is it there to (when generating ssg.ini object name to object id file) to incorporate also OVAL local_variables that might reference another variables via the "var_ref" attribute? The reason why I am asking being that have noticed, when I comment out the following part of this file (IOW when the cpe_generate.py script has the following form around the critical lines): 82 variables = ovaltree.find("./{%s}variables" % oval_ns) 83 #cpe_variables = extract_referred_nodes(ovaltree, variables, "var_ref") 84 #if cpe_variables: 85 # variables.clear() 86 # [variables.append(cpe_variable) for cpe_variable in cpe_variables] 87 #else: 88 ovaltree.remove(variables) the aforementioned error message: File 'output/ssg-rhel6-ds.xml' line 32236: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}object_component': No match found for key-sequence ['oval:ssg:obj:111'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}objectKeyRef'. when generating ssg-rhel6-ds.xml isn't reported anymore & the content builds successfully. Since I wouldn't like to break something, the purpose of this email is to ask someone more familiar with the implementation of cpe_generate.py script, why the cpe_variables section (lines from #83 up to #87 need to be present there)? Is there a chance this behaviour is somehow related with the following commit: [1] https://github.com/OpenSCAP/scap-security-guide/commit/59d650ffe140e4ae742d… ? For example in the sense the original meaning of 'cpe_variables' part of cpe_generate.py was to include also variables, that reference other variables via 'var_ref' attribute into final ssg.ini file (and assign IDs in the form of "oval:ssg:var:..." to them too)? But the change [1] is causing variable objects having 'var_ref' attribute is now included within relabelids.py script & therefore the 'cpe_variables' section of the cpe_generate.py script is not needed anymore & can be safely remove as suggested above (or in the also attached RHEL_6_transforms_cpe_generate_py.diff patch)? Any hints you can provide wrt to observed cpe_generate.py behaviour & how to possibly fix it are appreciated. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: If wondering why this problem didn't show earlier, assuming there isn't such construct (local_variable referencing another local_variable referencing textfilecontent54_object) used in the current content yet. Tried also different approach (encapsulate those local_variables into variable_objects & reference those objects instead), but it didn't help (in the sense datastream output would be successfully generated).

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2014