Hello folks.  Here's my two cents.
The CCI is not an SCAP specification but a DISA one.  In my observations, it 
appears that Red Hat has worked with DISA to support CCI, but this does not 
mean that Red Hat is promoting the use of CCI outside of DoD.  Is this correct?

David Oliva
-----Original Message-----
From: Boyd Ako <boyd.hanalei....@gmail.com>
To: Jan Cerny <jce...@redhat.com>
Cc: open-scap-list <open-scap-list@redhat.com>
Sent: Fri, Jan 11, 2019 8:06 pm
Subject: Re: [Open-scap] Making Fix Templates

What do you mean by "map" the XCCDFs of SSG and DISA? I've looked into the the 
DISA Vunerability IDs referenceing the CCI/CCEs that it's for. I haven't 
checked it against the SSG XCCDF though.
Yeah... I know the "generate fix" thing is muck. I'm actually having to rebuild 
a system because the script killed my bootloader.
I'm essentially trying to use the "generate fix" functionality using external 
snippets. It's pretty obvious the snippets and the results are not that 
dependable to use on production systems. It's what the template used to do. It 
finds CCI XXX as open and searches the template for function CCI XXX and adds 
the snippet to script. The snippet it's self would also "double check" the 
finding and "fix" the finding in means that you could run it over and over 
again and it'd only do something when the snippet actually finds the finding as 
I get why the snippets are included into the XCCDF. However, it doesn't have 
the ability to take in logic and conditions on a "per system" basis. I know 
that's where the "tailoring" comes in. But that's also to "static". By using a 
template, in the PRE section I can state that "if 3rd IP octet is 130 do not 
run fix for CCI XXX or use value of blah for CCI XXX setting" noting some 
official documentation for exception. 
That all being said, all Open SCAP then does is essentially just scan the 
system. And in my work environment the SPAWAR SCC is the more approved scanner. 
And I could make a script to read the results XML and generate a fix script 
like Open SCAP would do. But, that would imply that we don't need Open SCAP to 
begin with and remove a justification for the department to purchase Red Hat 
Satellite. ... However, if I can use the Open SCAP to use the stated authorized 
and approved DISA XCCDF and then use a template to fill in the blanks for the 
finding snippets that would be a means more likely to be approved.

All the XCCDFs are good for scanning. But, the fixing and remediation is where 
most of the Sys Ads complain. And the XCCDF code snippets are not reliable 
because only a really tiny group of people are able to update the XCCDF files; 
officially. If the template function worked, I'd imagine a bunch of people 
collaborating on making fix templates on GITHUB or where ever. The XCCDF file 
needs to be official and authorized. The fix templates do not.

Thank you for your time,

Boyd H. Ako


|  |  |
| Cell Phone: | (424) 244-9653 |

PGP/GPG Public Key: 

On Thu, Jan 10, 2019 at 9:27 PM Jan Cerny <jce...@redhat.com> wrote:


I have looked into this quickly. But I haven't able to get that working. I 
haven't found
anything in the source code that uses it. It seems to me that the feature has 
been removed
without changing the documentation. I'm not sure if the removal was intended or 
if it is
a regression.

The "oscap xccdf generate fix" command only extracts the code snippets from the 
XCCDF or DS file. There is no magic logic behind that, it is a very simple 
It doesn't understand or doesn't analyze the rules that are there.

It isn't clear to me what you need. Do you try to map SSG XCCDF to XCCDF 
provided by DISA?


Jan Černý
Security Technologies | Red Hat, Inc.

----- Original Message -----
> From: "Boyd Ako" <boyd.hanalei....@gmail.com>
> To: open-scap-list@redhat.com
> Sent: Wednesday, January 9, 2019 1:32:48 AM
> Subject: [Open-scap] Making Fix Templates
> Aloha,
> So I had a couple questions.
> A) Is using the Fix Template function still being supported?
> B) Is there more detailed documentation on creating the template? I'm already
> aware of the XSL "legacy" files in /usr/share/openscap/xsl. I seem to be
> having issues with openscap outputing anything from the
> legacy-fixtpl-bash.xml as it is or when I try to modify the "fixentry" to
> map to a rule.
> C) If the Fix Template function is more or less dead in the water, is there a
> way I can "convey" fixes for the remediation script generation that's either
> local or on premise? I know that OpenSCAP does have a bunch of fixes for the
> SSGs. But I can't really reach them due to isolation and even if I could it
> wouldn't be permitted since it's "external" to "DISA Approved" stuff.
> My environment: As awesome as it is that there's SSGs for DISA RHEL 7, I
> can't use it because it doesn't have the MAC and Sensitivity profiles in the
> actual RHEL 7 Benchmark from the DISA XCCDF. So, I'm using the the XCCDF
> from DISA with the appropriate profile and none of the "rules" seem to match
> any of the remediation fixes for the failed rules. Also due to networking
> infrastructure, I'm more or less isoalted so fetching remote resources is
> out.
> Thank you for your time,
> Boyd H. Ako
> boyd.hanalei....@gmail.com
> https://www.boydhanaleiako.me
>       Cell Phone:     (424) 244-9653 PGP/GPG Public Key:
>       https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
> _______________________________________________
> Open-scap-list mailing list
> Open-scap-list@redhat.com
> https://www.redhat.com/mailman/listinfo/open-scap-list

Open-scap-list mailing list
Open-scap-list mailing list

Reply via email to