scap-security-guide September 2016

scap-security-guide@lists.fedorahosted.org

5 participants
4 discussions

Adding rules for SUSE.
by S, Gautam 08 Nov '16

08 Nov '16

Hello, I am trying to test how new rules can be added to SUSE. I could not find any documentation so this is what I have done so far: 1) Added a new file input/xccdf/system/permissions/files.xml with a couple of rules to check file ownership and permissions of the passwd file. These are copies on the same in RHEL/6 folder. 2) Updated the guide.xslt file for including this group. 3) Added "<platform>multi_platform_sle</platform>" to the appropriate OVAL checks in shared/oval. 4) Added "# platform = multi_platform_sle" to the appropriate fix scripts in /shared/templates/static/bash. 5) Modified Make to remove CentOS related operations from derivatives, guide and validate because they were breaking and are possibly not relevant to SUSE anyhow. With this I am able to complete the build without errors and generate the output files. [Make fails for the latest sources fetched from the git repo] I would like to start contributing the rules into SUSE directory. Would the above process be alright? Also, I do not know what needs to be done for the reference and ident tags in XCCDF. Please advise. Thank you. Regards, Gautam.

5 7

[OpenSCAP, SSG & Ansible] Blogpost
by Zbynek Moravec 14 Sep '16

14 Sep '16

Hi, I wrote a quick introduction of newly added Ansible support. You can check it here: https://blog-zbynek.rhcloud.com/2016/09/12/ssg-openscap-and-ansible/ Z.

2 1

SCAP Security Guide 0.1.30
by Jan Lieskovsky 12 Sep '16

12 Sep '16

Hello folks, it's my pleasure and honor to announce that SCAP Security Guide release 0.1.30 has been created and is now available for download. Highlights of this release: * CNSS No.1253 (nist-CL-IL-AL) profile has been ported to Red Hat Enterprise Linux 7, * SCAP benchmark for Red Hat Enterprise Linux 7 now passes official NIST SCAP ScapVal-1.2.14.1 content validation tool requirements, * The XCCDF rules for Red Hat Enterprise Linux 7 has been equipped with CCE identifiers, * New CJIS "Criminal Justice Information Services (CJIS) Security Policy" profile has been added to Red Hat Enterprise Linux 7 benchmark, * Profile for each ANSSI hardening level for NP targets has been added to Debian 8 benchmark, * Remediation scripts don't rely on external /usr/share/scap-security-guide/remediation_functions shell library any more (instead starting from this release the remediation scripts are part of the specific benchmark itself). This allows to perform remediation without the need to have scap-security-guide RPM package being installed. For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.30 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30/s… (Zip archive using OVAL-5.10 language version) Happy hardening! Regards, Jan -- Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream team)

2 2

State of SUSE SSG builds.
by S, Gautam 07 Sep '16

07 Sep '16

Hello folks, I see there are some PRs for adding initial build directories for SUSE. When I try a make on the directory it fails with a minor issue: make xsltproc --stringparam SHARED_RP "/root/ssg_sles/scap-security-guide/shared" -o output/shorthand.xml input/guide.xslt output/guide.xml XPath error : Invalid expression document('concat($SHARED_RP, '/xccdf/intro/shared_intro_os.xml')) ^ compilation error: file input/guide.xslt line 37 element apply-templates XSLT-apply-templates: could not compile select expression 'document('concat($SHARED_RP, '/xccdf/intro/shared_intro_os.xml'))' Upon fixing the extra single quote, I get another error: make xsltproc --stringparam SHARED_RP "/root/ssg_sles/scap-security-guide/shared" -o output/shorthand.xml input/guide.xslt output/guide.xml warning: failed to load external entity "input/xccdf/system/system.xml" warning: failed to load external entity "input/xccdf/services/services.xml" warning: failed to load external entity "input/auxiliary/srg_support.xml" xmllint --format --output output/shorthand.xml output/shorthand.xml xsltproc --stringparam ssg_version "0.1.30" -o output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt output/shorthand.xml oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml output/xccdf-unlinked-unresolved.xml xsltproc -stringparam ref "nist" -o output/table-sle11-nistrefs.html transforms/xccdf2table-byref.xslt output/xccdf-unlinked-empty-groups.xml xsltproc -stringparam profile "common" -o output/table-sle11-nistrefs-common.html \ transforms/xccdf2table-profilenistrefs.xslt output/xccdf-unlinked-empty-groups.xml xsltproc -o output/table-sle11-cces.html transforms/xccdf2table-cce.xslt output/xccdf-unlinked-empty-groups.xml xsltproc -stringparam map-to-items "../output/xccdf-unlinked-empty-groups.xml" -o output/table-sle11-srgmap.html \ transforms/table-srgmap.xslt ../../shared/references/disa-os-srg-v1r1.xml warning: failed to load external entity "../../shared/references/disa-os-srg-v1r1.xml" unable to parse ../../shared/references/disa-os-srg-v1r1.xml make: *** [table-srgmap] Error 6 # ls ../../shared/references/disa-os-srg-v1r1.xml ls: cannot access ../../shared/references/disa-os-srg-v1r1.xml: No such file or directory Is there some other process for SUSE builds?

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2016