scap-security-guide January 2016

scap-security-guide@lists.fedorahosted.org

22 participants
18 discussions

RHEL 7 Draft STIG release
by Crawford, Nicholas P CTR USARMY RDECOM CERDEC (US) 23 Feb '16

23 Feb '16

P { MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px } FYI, In case any interested parties missed it during the inclement weather event, DISA has released the Draft STIG for RHEL 7 on 21 Jan. The comment period is open until 12 Feb. http://iase.disa.mil/stigs/os/unix-linux/Pages/index.aspx -Nick -- Nicholas P. Crawford, Contractor Senior UNIX Systems Administrator Manufacturing Techniques, Inc. (MTEQ) NVESD Network Services Branch, US Army email: ncrawford(a)mteq.com NIPR: nicholas.p.crawford.ctr(a)mail.mil SIPR: nicholas.p.crawford.ctr(a)mail.smil.mil work: 703.704.2299 dsn: 312.654.2299 cell: 571.225.1283

12 14

Jenkins Building Content at least 3 times
by Gabe Alford 01 Feb '16

01 Feb '16

Hello, Using the Jenkins build target, I noticed that the build process goes through building the SCAP content at least 3 times. It builds it once for `all`, once for 'dist`, and finally once for `validate`. I wonder if this is by design? It would be nice to consolidate it down to building it once for a faster Jenkins run. Maybe the Jenkins target could be the following: jenkins: clean all instead of: jenkins: clean all dist validate This would greatly reduce Jenkins tests and the amount of time those tests are run. Gabe

2 1

problem with scap-security-guide 0.1.28 and Centos
by Ing. Adrian Hernández Yeja 27 Jan '16

27 Jan '16

I use openscap-1.2.8 and scap-security-guide 0.1.28 with centos 7 x64 but I get 57 errors, for example: oval:ssg-umask_for_daemons:def:1 Set Daemon umask oval:ssg-selinux_state:def:1 SELinux Enforcing oval:ssg-selinux_policytype:def:1 Enable SELinux oval:ssg-accounts_maximum_age_login_defs:def:1 Set Password Expiration Parameters The problem remains in other versions of scap-security-guide The command: oscap oval eval --report oval.html ssg-centos7-ds.xml This is the an excerpt of oval result with option --verbose-log-file filedevel.log --verbose DEVEL: I: oscap: Evaluating definition 'oval:ssg-selinux_state:def:1': SELinux Enforcing. [oscap(18298):oscap(7fa845de9840):oval_agent.c:171:oval_agent_eval_definition] I: oscap: Querying textfilecontent54 object 'oval:ssg-object_etc_selinux_config:obj:1', flags: 0. [oscap(18298):oscap(7fa845de9840):oval_probe.c:246:oval_probe_query_object] I: oscap: Creating new syschar for textfilecontent54_object 'oval:ssg-object_etc_selinux_config:obj:1'. [oscap(18298):oscap(7fa845de9840):oval_probe.c:269:oval_probe_query_object] I: oscap: Sending message. [oscap(18298):oscap(7fa845de9840):oval_probe_ext.c:493:oval_probe_comm] D: oscap: MSG -> SEXP [oscap(18298):oscap(7fa845de9840):seap-packet.c:261:SEAP_packet_msg2sexp] D: oscap: ("seap.msg" ":id" 117 (("textfilecontent54_object" ":id" "oval:ssg-object_etc_selinux_config:obj:1" ":oval_version" "5.11" ) (("filepath" ":operation" 5 ":var_check" 1 ) "/etc/selinux/config" ) (("pattern" ":operation" 11 ":var_check" 1 ) "^[\s]SELINUX[\s]=[\s](.)[\s]*$" ) (("instance" ":operation" 5 ":var_check" 1 ) 1 ) ) ) [oscap(18298):oscap(7fa845de9840):seap-packet.c:262:SEAP_packet_msg2sexp] D: oscap: packet size: 1953 [oscap(18298):oscap(7fa845de9840):seap-packet.c:263:SEAP_packet_msg2sexp] D: oscap: total I/O vectors = 1 [oscap(18298):oscap(7fa845de9840):strbuf.c:294:strbuf_write] D: oscap: iot (1) < IOV_MAX (1024) [oscap(18298):oscap(7fa845de9840):strbuf.c:305:strbuf_write] D: oscap: ioc = 1 [oscap(18298):oscap(7fa845de9840):strbuf.c:321:strbuf_write] D: oscap: total bytes written: 359 [oscap(18298):oscap(7fa845de9840):strbuf.c:338:strbuf_write] I: oscap: Waiting for reply. [oscap(18298):oscap(7fa845de9840):oval_probe_ext.c:552:oval_probe_comm] D: probe_textfilecontent54: offline_mode=00000000 [probe_textfilecontent54(18309):input_handler(7fd2da7e0700):input_handler.c:114:probe_input_handler] D: probe_textfilecontent54: offline_mode_supported=00000001 [probe_textfilecontent54(18309):input_handler(7fd2da7e0700):input_handler.c:115:probe_input_handler] I: probe_textfilecontent54: handling SEAP message ID 117 [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):worker.c:51:probe_worker_runfn] D: probe_textfilecontent54: Extracting item from the cache queue: cnt=1, beg=150 [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:121:probe_icache_worker] D: probe_textfilecontent54: Signaling notfull' [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:148:probe_icache_worker] D: probe_textfilecontent54: Handling cache request [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:172:probe_icache_worker] D: probe_textfilecontent54: item ID=4264826240546045233 [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:178:probe_icache_worker] D: probe_textfilecontent54: cache MISS [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:227:probe_icache_worker] D: probe_textfilecontent54: NOP [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):icache.c:386:probe_icache_nop] D: probe_textfilecontent54: Signalingnotempty' [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):icache.c:411:probe_icache_nop] D: probe_textfilecontent54: Waiting for icache worker to handle the NOP [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):icache.c:421:probe_icache_nop] D: probe_textfilecontent54: Extracting item from the cache queue: cnt=1, beg=151 [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:121:probe_icache_worker] D: probe_textfilecontent54: Signaling `notfull' [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:148:probe_icache_worker] D: probe_textfilecontent54: Handling NOP [probe_textfilecontent54(18309):icache_worker(7fd2db7e2700):icache.c:162:probe_icache_worker] D: probe_textfilecontent54: Sync [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):icache.c:429:probe_icache_nop] I: probe_textfilecontent54: handler result = 0x7fd2cc0191b0, return code = 0 [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):worker.c:56:probe_worker_runfn] I: probe_textfilecontent54: probe thread deleted [probe_textfilecontent54(18309):probe_worker(7fd2d9fdf700):worker.c:75:probe_worker_runfn] D: oscap: return from select [oscap(18298):oscap(7fa845de9840):seap-packet.c:637:SEAP_packet_recv] I: oscap: Received packet [oscap(18298):oscap(7fa845de9840):seap-packet.c:903:SEAP_packet_recv] D: oscap: ("seap.msg" ":id" 117 ":reply-id" 117 (2 () ((("textfilecontent_item" ":id" "11830934" ) ("filepath" "/etc/selinux/config" ) ("path" "/etc/selinux" ) ("filename" "config" ) ("pattern" "^[\s]SELINUX[\s]=[\s](.)[\s]$" ) ("instance" 1 ) ("line" "^[\s]SELINUX[\s]=[\s](.)[\s]$" ) ("text" "SELINUX= #permissive" ) ("subexpression" "#permissive" ) ) ) () ) ) [oscap(18298):oscap(7fa845de9840):seap-packet.c:904:SEAP_packet_recv] I: oscap: packet size: 1913 [oscap(18298):oscap(7fa845de9840):seap-packet.c:905:SEAP_packet_recv] I: oscap: Message received. [oscap(18298):oscap(7fa845de9840):oval_probe_ext.c:586:oval_probe_comm] D: oscap: name=(null), value=0x7fa847f462f0 [oscap(18298):oscap(7fa845de9840):seap-message.c:76:SEAP_msg_free] D: oscap: Syschar entry type: 7007 'textfilecontent' => decoded OK [oscap(18298):oscap(7fa845de9840):oval_sexp.c:952:oval_sexp_to_sysitem] I: oscap: State 'oval:ssg-state_etc_selinux_config:ste:1' references external_variable 'oval:ssg-var_selinux_state:var:1'. [oscap(18298):oscap(7fa845de9840):oval_probe.c:398:oval_probe_query_criteria] I: oscap: oval:ssg-test_etc_selinux_config:tst:1 => error [oscap(18298):oscap(7fa845de9840):oval_resultTest.c:994:oval_result_test_eval] Thanks in advance!!!!

2 2

Move upstream "Collateral & References" section to official open-scap.org?
by Shawn Wells 27 Jan '16

27 Jan '16

On the new OpenSCAP webpage [0] we have a "Resources" section [1]. On the upstream SSG GitHub page, we have the "Collateral and References" page [2]. What would everyone think of merging the content into open-scap.org? This would get us a bit more visibility as open-scap.org is the public-facing/primary site. [0] http://www.open-scap.org/ [1] http://www.open-scap.org/resources/ [2] https://github.com/OpenSCAP/scap-security-guide/wiki/Collateral-and-Referen…

2 2

SCAP Security Guide 0.1.28 now available for download
by Jan Lieskovsky 25 Jan '16

25 Jan '16

Hello folks, we are pleased to announce the availability of the SCAP Security Guide 0.1.28 release. The tags / keywords for this release are the following: * Refactoring * New profiles, products * Overall infrastructure enhancements * Numerous SCAP content bug fixes and enhancements The highlights of this release (in the order the underlying changes have been merged) are (but are not limited to) as follows: * SCAP Security Guide build process refactoring * New "OpenStack/RHEL-OSP/7/" to hold the SCAP content for Red Hat Enterprise Linux OpenStack Platform v7 * Improved (more granular) mapping of official PCI DSS v3 standard to the PCI DSS profile for Red Hat Enterprise Linux 7 * The build process has been updated to produce STATIC rule IDs in the benchmarks (very handy e.g. for benchmark version diffs) * Other numerous XCCDF, OVAL, and remediation scripts enhancements and bug fixes (the list of them is too long to be mentioned here) Be sure to check-out: * More detailed Changelog for this release: [1] https://github.com/OpenSCAP/scap-security-guide/releases/latest * Full list of changes performed in this release: [2] https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.28 The pre-built benchmarks in Zip format are available at: * [3] https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.28/s… (OVAL-5.10 version) * [4] https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.28/s… (OVAL-5.11 version) Ensure to give them a try. We would like to thank all people who have made this release a reality. Happy hardening. Regards, Jan. -- Jan iankko Lieskovsky on behalf of the SCAP Security Guide upstream team P.S.: Should you encounter some issue with the latest version, kindly report it @ [5] https://github.com/OpenSCAP/scap-security-guide/issues/new

1 0

Jenkins outage on 21st January 2016
by Martin Preisler 19 Jan '16

19 Jan '16

Hi, there will be a scheduled maintenance outage of Jenkins on 21st January 2016 15:00 UTC. Jenkins will be down for 8 hours. Sorry for inconvenience! -- Martin Preisler Security Technologies | Red Hat, Inc.

1 0

Linux environment variables and OVAL filepath.
by S, Gautam 12 Jan '16

12 Jan '16

Hello folks, I am trying to write an OVAL check to ensure that an application configuration file say $APP_HOME/a.conf is owned by the correct user_id and group_id. I understand that the OVAL interpreter does not resolve enviroment variables if they are directly used in the filepath element. Is there some way I can accomplish this using the OVAL environmentvariable58_object? I am trying to create a local_variable using the "value" of the object concatenated with the file name. I don't seem to be getting right. Is there a simpler way of performing this task? I would assume this is not a very uncommon use case. Thanks in advance. Regards, Gautam.

2 2

Adding Custom "ident" Sources in shorthand XCCDFs
by Oliver Skiebe 12 Jan '16

12 Jan '16

Hi all, as briefly mentioned already in yesterdays’ Contributor Workshop, our customer wants to enrich the SSG content by adding references to their internal security requirements. I wonder how I could add my own Security Identifiers, because when trying to simply add e.g. a „customerident“ attribute into the shorthand XCCDF as per below, my build fails with: [...] xmllint --format --output output/shorthand.xml output/shorthand.xml xsltproc --stringparam ssg_version "0.1.27" -o output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt output/shorthand.xml oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml output/xccdf-unlinked-unresolved.xml File 'output/xccdf-unlinked-unresolved.xml' line 153: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. File 'output/xccdf-unlinked-unresolved.xml' line 167: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. File 'output/xccdf-unlinked-unresolved.xml' line 182: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. File 'output/xccdf-unlinked-unresolved.xml' line 190: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. Invalid XCCDF Checklist content(1.1) in output/xccdf-unlinked-unresolved.xml. ../../shared/product-make.include:60: recipe for target 'output/xccdf-unlinked-empty-groups.xml' failed make: *** [output/xccdf-unlinked-empty-groups.xml] Error 1 Do I have to „register“/„declare“ the new identifier type, and if so where and how? Example of what I'm trying to achieve: <Rule id="sshd_allow_only_protocol2"> <title>My Title</title> <description>My description</description> <rationale>My rationale</rationale> <ident cce="27072-8" customerident="1234" stig="RHEL-06-000227"/> <oval id="sshd_allow_only_protocol2"/> <ref disa="776,774,1436" nist="AC-3(10),IA-5(1)(c)"/> </Rule> Any pointers highly appreciated :-) ! Thanks & regards Oliver

3 4

Understanding the Pieces
by joescap＠mm.st 12 Jan '16

12 Jan '16

I'm trying to understand all the pieces of SSG and how it relates to the content on the National Checklist Program Repository, specifically for Redhat 6. In RHEL6, I did a yum install scap-security-guide to get the SSG from the Redhat repos. I took a look at file:///usr/share/doc/scap-security-guide-0.1.21/rhel6-guide.html and I can see all the settings, but does this include everything that is in the SCAP content found on the NIST National Checklist Program Repository? Are there any kickstarts available to help configure systems? Just confused on how this all fits together.

2 1

Re: Adding Custom "ident" Sources in shorthand XCCDFs
by Wei N Chen (CENSUS/OIS FED) 12 Jan '16

12 Jan '16

Looks like the customization you made cannot be validated against the XCCDF schema. You would have to look at the schema to see how the <ident> element is defined. Keep in mind that any customization you make will have to be within the defined construct of <ident>. Thanks, Wei Chen | Security Engineer | Office of Information Security (OIS) | U.S. Census Bureau wei.n.chen(a)census.gov census.gov Connect with us on Social Media ------------------------------ Date: Tue, 12 Jan 2016 07:04:29 -0000 From: oliver.skiebe(a)uniqpartners.com Subject: Adding Custom "ident" Sources in shorthand XCCDFs To: scap-security-guide(a)lists.fedorahosted.org Message-ID: <20160112070429.30053.38106(a)mailman01.phx2.fedoraproject.org> Content-Type: text/plain; charset="utf-8" Hi all, as briefly mentioned already in yesterdays’ Contributor Workshop, our customer wants to enrich the SSG content by adding references to their internal security requirements. I wonder how I could add my own Security Identifiers, because when trying to simply add e.g. a „customerident“ attribute into the shorthand XCCDF as per below, my build fails with: [...] xmllint --format --output output/shorthand.xml output/shorthand.xml xsltproc --stringparam ssg_version "0.1.27" -o output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt output/shorthand.xml oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml output/xccdf-unlinked-unresolved.xml File 'output/xccdf-unlinked-unresolved.xml' line 153: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. File 'output/xccdf-unlinked-unresolved.xml' line 167: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. File 'output/xccdf-unlinked-unresolved.xml' line 182: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. File 'output/xccdf-unlinked-unresolved.xml' line 190: Element '{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is required but missing. Invalid XCCDF Checklist content(1.1) in output/xccdf-unlinked-unresolved.xml. ../../shared/product-make.include:60: recipe for target 'output/xccdf-unlinked-empty-groups.xml' failed make: *** [output/xccdf-unlinked-empty-groups.xml] Error 1 Do I have to „register“/„declare“ the new identifier type, and if so where and how? Example of what I'm trying to achieve: <Rule id="sshd_allow_only_protocol2"> <title>My Title</title> <description>My description</description> <rationale>My rationale</rationale> <ident cce="27072-8" customerident="1234" stig="RHEL-06-000227"/> <oval id="sshd_allow_only_protocol2"/> <ref disa="776,774,1436" nist="AC-3(10),IA-5(1)(c)"/> </Rule> Any pointers highly appreciated :-) ! Thanks & regards Oliver ------------------------------ Subject: Digest Footer -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedora… https://github.com/OpenSCAP/scap-security-guide/ ------------------------------ End of scap-security-guide Digest, Vol 53, Issue 2 **************************************************

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide January 2016