scap-security-guide July 2015

scap-security-guide@lists.fedorahosted.org

27 participants
19 discussions

SIMP
by Gallagher, Michael L 21 Jul '15

21 Jul '15

Hello, I would like to hear from the members on the list about how various projects in the SSG ecosystem relate to the recently disclosed SIMP from the NSA. Obviously, it leverages the scanning tools that are part of the RHEL distribution. Is it viewed as complimentary or redundant? https://github.com/NationalSecurityAgency/SIMP Mike Gallagher, CISSP, CEH

10 10

Helping migrate RHEL6 to RHEL7
by Greg Elin 19 Jul '15

19 Jul '15

Simon, Martin - I would like to help migrate the RHEL6 tests to RHEL7. Either of you free in next couple days to check I'm doing it right? Thanks. I learn best with a little hand holding. Greg Elin

4 5

[Blog post] Scanning container images on Red Hat Enterprise Linux Atomic Host using oscap-docker and scap-security-guide
by Jan Lieskovsky 19 Jul '15

19 Jul '15

Hello folks, recently I found myself requiring to set up a testing environment, in which it would be possible to perform oscap scans of container images applied on the top of the Red Hat Enterprise Linux Atomic Host. After putting the steps together realized the scenario might be suitable for wider SSG community trying to perform the same task. Thus have put the steps into the form of a blog post, reachable here: https://jlieskov.wordpress.com/2015/07/17/scanning-container-images-on-red-… Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

3 2

Web IRC client from work: https://chat.openscap.io/
by Shawn Wells 16 Jul '15

16 Jul '15

Greg started a thread earlier today on RHEL6->RHEL7 migration processes. The conversation jumped to IRC and a few people reached out offline to ask how they could join (or at least monitor) the conversation. To help with that, we created a web UI that automatically joins #openscap on Freenode. You can find it here: https://chat.openscap.io/ Very very simple, but seems to get the job done. Had a friend test from his agency NIPR connection and was able to connect without issue. Feedback welcome!

2 2

Scanning a remote CentOS system with oscap-ssh
by Fen Labalme 13 Jul '15

13 Jul '15

Hi, I'm using openscap 1.2.5 and SSG 0.1.24 with: PROFILE = xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream DATASTREAM = ssg-centos7-ds.xml Resulting in this command: oscap-ssh root(a)example.com 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream --results-arf scans/results-arf.xml --results scans/results.xml --report scans/results.html scap/ssg-centos7-ds.xml This is mostly working (it scans 3 high, 11 medium and 42 low severity controls) but getting: oscap exit code: 2 (which I also see when scanning a RHEL71 machine) For CentOS7, should I be using a different profile than the "rhel7-server-upstream"? And, any suggestions on how to debug the cause of the non-zero exit code? Thanks! =Fen -- Fen Labalme, CivicActions.com DevOps | Quality | Security github/skype/twitter: openprivacy

3 2

CCE-27129-6 (kernel auditing rules) on RHEL7
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 10 Jul '15

10 Jul '15

The check for the RHEL7 audit rules for kernel module loading and unloading specifies the following: -w /usr/sbin/insmod -p x -k modules -w /usr/sbin/rmmod -p x -k modules -w /usr/sbin/modprobe -p x -k modules However, at least on my RHEL7 system, these commands are located in /sbin, not /usr/sbin (as on RHEL6). This is using the latest git zip (can't manage to pull from git since the move to github, for some reason). -- Ray Shaw (Contractor, STG) Army Research Laboratory CISD, Unix Support

3 3

Blog post - SSG now builds HTML guide for every profile
by Martin Preisler 09 Jul '15

09 Jul '15

I wrote a small blog post about a new feature in SSG 0.1.24 - building one HTML guide for each profile we ship and providing a convenient switcher. http://martin.preisler.me/2015/07/scap-security-guide-now-has-an-html-guide… It includes a screenshot and a live demo :-) Feedback appreciated. -- Martin Preisler Security Technologies | Red Hat, Inc.

3 2

scap-security-guide-0.1.24 now being the latest
by Jan Lieskovsky 08 Jul '15

08 Jul '15

Hello folks, though it has not been that far in the past I on this place announced the availability of the scap-security-guide-0.1.23 release, the count of SSG project contributions in the past two weeks has been pretty high, and therefore with following the "release early, release often" principle we are proud to announce the general availability of the scap-security-guide-0.1.24 release, containing (between others): * initial draft of "Standard Security Profile" for Red Hat Enterprise Linux 7, * dozen of new remediation scripts for selected audit rules for Red Hat Enterprise Linux 7 system, * HTML formatted security guides logic enhancements (create HTML guide for every profile in every benchmark, optimize the size of the guides to include only xccdf:Groups containing at least one selected rules). Many thanks to Martin Preisler for contributing these changes!, and * many, many more. For further information about 0.1.24 release notes please proceed to (hopefully already expected) location: [1] https://github.com/OpenSCAP/scap-security-guide/releases/latest For information how to build the content from source tarball proceed to: [2] https://github.com/OpenSCAP/scap-security-guide/wiki/Building-from-Source Also, Martin Preisler was kind enough to provide zipped tarball of the pre-built SSG produced benchmarks in the datastream format. Feel free to check them out: [3] https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.24/s… At this point it is necessary to mention that while we didn't solve the "store remediation functions location in the XCCDF directly, rather than relying on expected system paths" issue yet: [4] https://github.com/OpenSCAP/scap-security-guide/issues/590 (therefore performing remediations from content installed from the aforementioned zip archive [3], might not be working properly yet), the zip archive should provide a way how to obtain pre-built version of the most recent SSG content (as already mentioned earlier, we will do our best to solve the issue [4] ASAP). Happy hardening! Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team P.S.: Of course should you encounter any issue(s) with this SSG version (or any earlier), please report it at: * https://github.com/OpenSCAP/scap-security-guide/issues/new or by dropping an email to * SCAP Security Guide mailing list -- https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

1 0

Re: [Xccdf-dev] XSD schema does not recognize dangling selectors
by Šimon Lukašík 02 Jul '15

02 Jul '15

Thanks for the pointers Lubell and Joshua. In fact, we convert the mentioned document to XCCDF 1.2. And latest OpenSCAP includes ability to run schematron for XCCDF. oscap xccdf validate --schematron ssg-rhel7-xccdf-12.xml However, this does not reveal the uppermentioned issue. I'll dig into this a bit more in comming days and report back once I know more. Thank You! -- Šimon Lukašík Security Technologies, Red Hat, Inc. On 07/02/2015 08:05 PM, Lubell, Joshua wrote: > Simon and Melvin, > > According to the XCCDF 1.1 spec > (http://scap.nist.gov/specifications/xccdf/index.html#resource-1.1.4), > the XML schema does not express all of the constraints needed to > validate a benchmark document. > > However, if you were to convert the RHEL7 benchmark document from XCCDF > 1.1 to 1.2, you could then use the Schematron available for 1.2 to check > for dangling idref values. The XCCDF 1.2 includes instructions for > converting a 1.1 benchmark document to 1.2. > > The XCCDF 1.2 spec, XSD, and Schematron are at > http://scap.nist.gov/revision/1.2/index.html#xccdf > > To validate your XCCDF 1.2 benchmark document, you can first check for > validity with respect to the XSD, and then check for validity with > respect to the Schematron. To do this using oXygenXML, you’d set up a > two-step validation scenario. > > Hope this is helpful, > > Josh > > Joshua Lubell > > National Institute of Standards and Technology > > 100 Bureau Drive, Stop 8260 > > Gaithersburg MD 20899-8260 USA > > *From:*xccdf-dev-bounces@nist.gov [mailto:xccdf-dev-bounces@nist.gov] > *On Behalf Of *Melvin Steward > *Sent:* Thursday, July 02, 2015 12:01 PM > *To:* XCCDF-DEV > *Cc:* Jan Lieskovsky; scap-security-guide(a)lists.fedorahosted.org > *Subject:* Re: [Xccdf-dev] XSD schema does not recognize dangling selectors > > Simon > > Yes I encountered the same issue. I'm using OxygenXML to create a fix in > my schema but I've not tested it enough to put it out a fixed Schema > > > > On Thursday, July 2, 2015, Šimon Lukašík <slukasik(a)redhat.com > <mailto:slukasik@redhat.com>> wrote: > > > Hello XCCDF-Dev! > > I am not sure whether this is the place to report issues against XCCDF > standard, XCCDF schema in particular, but I will take my chances. > > > Ján Lieskovský (CC-ed) has found that XSD schema validation will not > always detect malformed XCCDF. Having good XSD schema is critical for > SCAP content authors at SCAP-Security-Guide project. They use XSD > schemas to ensure reasonable quality of their output. The following case > was not detected by XCCDF XSD validation: > > XCCDF: https://isimluk.fedorapeople.org/ssg-rhel7-xccdf.xml > > The PCI-DSS profile contains: > > <select idref="service_chronyd_enabled" selected="true"/> > > However, the content does no include Rule/Group element with such ID. > Similar defects of XCCDF content usually get caught by XSD. > > What do you think? > > Best regards, > > -- > Šimon Lukašík > Security Technologies, Red Hat, Inc. > _______________________________________________ > XCCDF-dev mailing list > XCCDF-dev(a)nist.gov <javascript:;> > To unsubscribe, send an email message to > xccdf-dev-unsubscribe(a)nist.gov <javascript:;>. > > > > -- > Sent from my BlackBerry® smartphone with SprintSpeed > ++++++CONFIDENTIALITY NOTICE++++++ > The information in this email may be confidential and/or privileged. > This email is intended to be reviewed only by the individual or > organization named above. If you are not the intended recipient or an > authorized representative of the intended recipient, you are hereby > notified that any review, dissemination, storage, or copying of this > email and its attachments, if any, or the information contained herein > is prohibited. If you have received this email in error, please > immediately notify the sender by return email and delete this email from > your system- Thank you. > > > > _______________________________________________ > XCCDF-dev mailing list > XCCDF-dev(a)nist.gov > To unsubscribe, send an email message to xccdf-dev-unsubscribe(a)nist.gov. > -- ~š.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide July 2015