scap-security-guide May 2015

scap-security-guide@lists.fedorahosted.org

12 participants
6 discussions

Shared Checks/Fixes ...
by Trey Henefield 27 May '15

27 May '15

Greetings, I wanted to propose a change to the current structure in place for shared checks (shared/oval) and fixes (shared/fixes/bash). I was curious to get everyone's opinion before committing. So the problem I see is with the symbolic linking of checks and fixes to the shared folder. I have found it problematic when working between different operating systems, file systems, and version control systems. Rather than creating symbolic links to certain oval checks in the shared/oval folder, we could choose to just process all oval checks in both the project's checks folder and the shared/oval folder. However, not all checks in the current 'shared/oval' folder are shared by all OS. For example, there are some that only apply to RHEL7 and Fedora, and not RHEL6. Any thoughts? Thanks! Best regards, Trey Henefield, CISSP Senior IAVA Engineer Ultra Electronics Advanced Tactical Systems, Inc. 4101 Smith School Road Building IV, Suite 100 Austin, TX 78744 USA Trey.Henefield(a)ultra-ats.com Tel: +1 512 327 6795 ext. 647 Fax: +1 512 327 8043 Mobile: +1 512 541 6450 www.ultra-ats.com Disclaimer The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2015-04-08 17:13:55 is confidential and may be legally privileged. It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.

7 17

RE: Kickstart with SSG/fixes and More
by Greg Elin 14 May '15

14 May '15

Ted, I was googling about and came across a 2013 email to SSG list regarding kickstart with SSG fixes? Can we get you to share that again? Thanks! http://marc.info/?l=scap-security-guide&m=138031105712558&w=2 Greg Elin

5 5

Scanning remote machines with OpenSCAP
by Martin Preisler 14 May '15

14 May '15

I have written a short blog post summarizing the latest addition to OpenSCAP called `oscap-ssh`. http://martin.preisler.me/2015/05/scanning-remote-machines-with-openscap/ It allows users to scan remote machines using local files. The result files are transferred back and can be conveniently viewed on the local machine. This is very useful for testing and even auditing of remote machines. Feedback appreciated! Cross posting to SCAP Security Guide because this might be valuable to content authors. -- Martin Preisler Security Technologies | Red Hat, Inc.

3 3

[Maintenance] Planning to decommission outdated Fedorahosted's SCAP Security Guide wiki in favour of the GitHub's one. Any objections?
by Jan Lieskovsky 13 May '15

13 May '15

Hello folks, some time ago the SCAP Security Guide's git repository has been moved from Fedora Hosted (fedorahosted.org) to GitHub (refer to: [1] https://www.redhat.com/archives/open-scap-list/2014-August/msg00009.html thread for further details). >From that time the git repository move has been shown to be an improvement for the whole SCAP content evolving process. But besides of just moving the git content, the OpenSCAP/scap-security-guide subproject also got already equipped with new wiki pages (containing more up2date information). This makes the former FedoraHosted's SCAP Security Guide wiki instance more and more outdated and full of confusing information. To mention an example refer to old "Downloads" instructions: [2] https://fedorahosted.org/scap-security-guide/wiki/downloads To lower the two separate wiki instances maintenance burden, the plan is to decommission old Fedora Hosted SCAP Security Guide wiki in favour of the new GitHub one (update the old wiki links to point out to the new GitHub wiki ones to keep the bookmarks working, but simultaneously point to updated information). But prior doing that wanted to check with the community if there would be any objections against performing this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

3 2

Porting RHEL6 XCDDF Profiles to RHEL7
by Greg Elin 08 May '15

08 May '15

Fend and I are looking at moving a client from AWS Linux to RHEL7. We are trying to figure how we can help migrate the existing RHEL6 XCCDF profiles to RHEL7? A number of the baseline profiles available in RHEL6 package (e.g. USGCB and RHEL6-Server are not currently available in either the RHEL7 SSG package or the RHEL7 SSG built from source. I've skimmed the issues and the wiki pages and did not seen anything exactly on topic for the profiles. - Can these RHEL6 profiles easily be ported to RHEL7, or is it a big tasks b/c of significant changes between 6 and 7? - I'm treating the RHEL7 STIG as a separate baseline project from these other pre-existing RHEL6 baselines (with some overlap, of course). Is that right way or wrong way to think about it? - Does it make sense to put together a how to and/or coordination page to discuss the availability and porting of profiles? Fen and I would like to help, but want tackle the problem efficiently. - Is there an overall timeline or plan for managing the XCCDF profiles? Thanks. Greg

3 5

SCAP Security Guide v0.1.22 is now live
by Jan Lieskovsky 07 May '15

07 May '15

Hello folks, we are pleased to announce SCAP Security Guide of version 0.1.22. The highlights include: * new (experimental [*]) SCAP content for Firefox, Java, Webmin, and Red Hat Enterprise Linux 5 products, * drop support for Fedora 19 and add support for Fedora 22 and Rawhide, * all content now successfully validates against version 5.11 of the OVAL language, * multi_platform support has been introduced for OVAL checks, * the root Makefile has been equipped with 'make dist' and 'make install' targets, Product specific enhancements: * RHEL/6 ** content now contains OVAL checks for Avahi, FTP, and DHCP services, ** new PCI-DSS profile has been provided, ** new DISA STIG profile kickstart is now available, * RHEL/7 ** package installed OVAL checks for selected packages have been provided, ** 15 new audit service checks have been ported to RHEL/7, ** many more OVAL checks && remediation enhancements, * Fedora ** content is now shipped in OVAL language version 5.11 by default, ** the systemdtest template and example OVAL checks have been included, ** the audit system component benchmark section has been added, ** 15 new audit service checks have been ported to Fedora, For the full list of changes see: [1] https://github.com/OpenSCAP/scap-security-guide/issues?page=1&q=milestone%3… and [2] https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A%22Dra… Downloads [**]: [3] https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.22 Thanks to all who contributed to make this release the reality! Happy scanning && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team [*] Users are encouraged to test these && report the issues found. [**] See BUILD.md for guidance wrt to obtaining RPMs.

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2015