Re: [Open-scap] Ensure that official distribution repositories are used check failed in Debian 8
Hi Marek I will have a look On Fri, 7 Sep 2018 at 14:55, Marek Haicman wrote: > Hello Dhanushka, > first of, I added scap-security-guide list, as that will make more sense > for this kind of questions. open-scap-list is mostly about scanner > issues (and in 99% cases, problem is in content, not in the scanner). > > Regarding the problem itself, it would be great if you took a look at > the sources for the oval, maybe you'll be able to find the issue > yourself. As you are on the platform. > > To find the source for the issue, I have checked the ID of the rule is > rule_apt_sources_official. So calling this in cloned git repo: > `find . | grep apt_sources_list` > will tell you where are the sources: > ./linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml > is the source for check. > There is no complexity, there just regexes, so if you find an issue, > pull request with the fix would be awesome, but explanation what is the > bug will also do. > > Thanks! > Marek > > On 09/07/2018 07:38 AM, Dhanushka Parakrama wrote: > > Hi Team > > > > In Debian 8 */etc/apt/sources.list *file include below repositories > > > > deb http://ftp.us.debian.org/debian/ jessie main > > deb-src http://ftp.us.debian.org/debian/ jessie main > > > > deb http://security.debian.org/ jessie/updates main > > deb-src http://security.debian.org/ jessie/updates main > > > > but still *oscap xccdf eval --profile > > xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report > > report.html ssg-debian8-ds.xml * Scan says > > > > image.png > > > > *Ensure that official distribution repositories are used * -> *FAIL* > > Is there any reason for that ? > > > > Thank You > > Dhanushka > > > > > > ___ > > Open-scap-list mailing list > > Open-scap-list@redhat.com > > https://www.redhat.com/mailman/listinfo/open-scap-list > > > > ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
[Open-scap] Ensure that official distribution repositories are used check failed in Debian 8
Hi Team In Debian 8 */etc/apt/sources.list *file include below repositories deb http://ftp.us.debian.org/debian/ jessie main deb-src http://ftp.us.debian.org/debian/ jessie main deb http://security.debian.org/ jessie/updates main deb-src http://security.debian.org/ jessie/updates main but still *oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report report.html ssg-debian8-ds.xml * Scan says [image: image.png] *Ensure that official distribution repositories are used * -> *FAIL* Is there any reason for that ? Thank You Dhanushka ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
Re: [Open-scap] Ensure Log Files Are Owned By Appropriate Group setting Issue in Debian 8
Hi Wasto Please correct me if i'm not mistaken . in the URL [1] that you shared i can't see the rsyslog-ng , instead of it have package_rsyslog_installed So its check for the correct package is'nt it ? [1] https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml Thank you Dhanushka On Fri, 31 Aug 2018 at 18:28, Watson Yuuma Sato wrote: > On 29/08/18 18:34, Dhanushka Parakrama wrote: > > Hi Team > > We have ran the scan for debian 8 using below command > > *oscap xccdf eval --profile > xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report > report.html ssg-debian8-ds.xml* > > Got alerts as below , > === > > [image: image.png] > > As the solution suggested change the group as below > > * chgrp adm /var/log/* -R * > > [image: image.png] > > but we still getting the > > *Ensure Log Files Are Owned By Appropriate Group -> Failed * > > Is there any reason for that ? > > Hello, Dhanushka, > > The check for this rule also verifies if rsyslog is in use. Now, > unfortunately, it checks for rsyslog, not rsyslog-ng. > > Here is where the check is defined: > https://github.com/OpenSCAP/scap-security-guide/blob/master/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/oval/shared.xml > > Thank You > > Dhanushka > > > > ___ > Open-scap-list mailing > listOpen-scap-list@redhat.comhttps://www.redhat.com/mailman/listinfo/open-scap-list > > > -- > Watson Sato > Security Technologies | Red Hat, Inc > > ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
Re: [Open-scap] ntp and auditd setting issue in debian 8
Guys Any news regarding the error On Wed, 29 Aug 2018 at 21:33, Dhanushka Parakrama wrote: > > Hi Team > > We have ran the scan for debian 8 using below command > > *oscap xccdf eval --profile > xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report > report.html ssg-debian8-ds.xml* > > Got alerts as below , > === > > [image: image.png] > > > > To Fixed it we ran the below commands as suggested by the report > > *service ntp status* > ● ntp.service - LSB: Start NTP daemon >Loaded: loaded (/etc/init.d/ntp) >Active: active (running) since Mon 2018-08-27 18:24:21 IST; 2 days ago >CGroup: /system.slice/ntp.service >└─473 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 112:120 > > Aug 27 18:24:21 oscapserver ntpd[473]: Listen and drop on 0 v4wildcard > 0.0.0.0 UDP 123 > Aug 27 18:24:21 oscapserver ntpd[473]: Listen and drop on 1 v6wildcard :: > UDP 123 > Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 2 lo 127.0.0.1 > UDP 123 > Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 3 eth0 > 192.168.8.150 UDP 123 > Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 4 lo ::1 UDP 123 > Aug 27 18:24:21 oscapserver ntpd[473]: peers refreshed > Aug 27 18:24:21 oscapserver ntpd[473]: Listening on routing socket on fd > #21 for interface updates > Aug 27 18:24:21 oscapserver systemd[1]: Started LSB: Start NTP daemon. > Aug 27 18:24:24 oscapserver ntpd[473]: Listen normally on 5 eth0 > fe80::250:56ff:fe94:6150 UDP 123 > Aug 27 18:24:24 oscapserver ntpd[473]: peers refreshed > > > *service auditd status* > ● auditd.service - Security Auditing Service >Loaded: loaded (/lib/systemd/system/auditd.service; enabled) >Active: active (running) since Tue 2018-08-28 14:41:28 IST; 1 day 6h ago > Main PID: 12464 (auditd) >CGroup: /system.slice/auditd.service >└─12464 /sbin/auditd -n > > > But even after we ran the scan after fixing it Report still shows as > > > [image: image.png] > > Is there any reason for that ? > > > Thank You > Dhanushka > > > ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
[Open-scap] Set SSH Idle Timeout Interval Debian 8
Guys In Debian 8 i have configured the settings as below for ssh client timeout ClientAliveInterval 400 but seems like scan is not picking it up , Version scap-security-guide-0.1.40 *oscap-ssh --sudo wso2@192.168.8.150 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report abc.html ssg-debian8-ds.xml* and still shows output as below *Title Set SSH Idle Timeout Interval* *Rulexccdf_org.ssgproject.content_rule_sshd_set_idle_timeout* *Result fail* ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
[Open-scap] Ensure Log Files Are Owned By Appropriate Group setting Issue in Debian 8
Hi Team We have ran the scan for debian 8 using below command *oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report report.html ssg-debian8-ds.xml* Got alerts as below , === [image: image.png] As the solution suggested change the group as below * chgrp adm /var/log/* -R * [image: image.png] but we still getting the *Ensure Log Files Are Owned By Appropriate Group -> Failed * Is there any reason for that ? Thank You Dhanushka ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
[Open-scap] ntp and auditd setting issue in debian 8
Hi Team We have ran the scan for debian 8 using below command *oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report report.html ssg-debian8-ds.xml* Got alerts as below , === [image: image.png] To Fixed it we ran the below commands as suggested by the report *service ntp status* ● ntp.service - LSB: Start NTP daemon Loaded: loaded (/etc/init.d/ntp) Active: active (running) since Mon 2018-08-27 18:24:21 IST; 2 days ago CGroup: /system.slice/ntp.service └─473 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 112:120 Aug 27 18:24:21 oscapserver ntpd[473]: Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123 Aug 27 18:24:21 oscapserver ntpd[473]: Listen and drop on 1 v6wildcard :: UDP 123 Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 2 lo 127.0.0.1 UDP 123 Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 3 eth0 192.168.8.150 UDP 123 Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 4 lo ::1 UDP 123 Aug 27 18:24:21 oscapserver ntpd[473]: peers refreshed Aug 27 18:24:21 oscapserver ntpd[473]: Listening on routing socket on fd #21 for interface updates Aug 27 18:24:21 oscapserver systemd[1]: Started LSB: Start NTP daemon. Aug 27 18:24:24 oscapserver ntpd[473]: Listen normally on 5 eth0 fe80::250:56ff:fe94:6150 UDP 123 Aug 27 18:24:24 oscapserver ntpd[473]: peers refreshed *service auditd status* ● auditd.service - Security Auditing Service Loaded: loaded (/lib/systemd/system/auditd.service; enabled) Active: active (running) since Tue 2018-08-28 14:41:28 IST; 1 day 6h ago Main PID: 12464 (auditd) CGroup: /system.slice/auditd.service └─12464 /sbin/auditd -n But even after we ran the scan after fixing it Report still shows as [image: image.png] Is there any reason for that ? Thank You Dhanushka ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
Re: [Open-scap] syslog-ng setting issue in debian 8
Hi Watson On Wed, 29 Aug 2018 at 14:51, Watson Yuuma Sato wrote: > On 29/08/18 11:05, Dhanushka Parakrama wrote: > > Hi Team > > > Hello Dhanushka, > > What version of SSG are you using? > This looks like a bug on 0.1.40 release, the package and service names > used in bash remediation for syslog-ng are different than your commands, we > use "syslogng" for package and service name. > > Would you be willing to propose a fix for that? > These are the files that would need to be changed: > > https://github.com/OpenSCAP/scap-security-guide/blob/master/debian8/templates/csv/packages_installed.csv > > https://github.com/OpenSCAP/scap-security-guide/blob/master/debian8/templates/csv/services_enabled.csv > > I have send the Pull request for those files > > We have ran the scan for debian 8 using below command > > *oscap xccdf eval --profile > xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report > report.html ssg-debian8-ds.xml* > > Got alerts as below , > == > [image: image.png] > > > To Fixed it we ran the below commands as suggested by the report > > * apt-get install syslog-ng-core > > * systemctl status syslog-ng > > ● syslog-ng.service - System Logger Daemon >Loaded: loaded (/lib/systemd/system/syslog-ng.service; enabled) >Active: active (running) since Tue 2018-08-28 15:04:28 IST; 23h ago > Docs: man:syslog-ng(8) > Process: 16275 ExecReload=/bin/kill -HUP $MAINPID (code=exited, > status=0/SUCCESS) > Main PID: 14555 (syslog-ng) >CGroup: /system.slice/syslog-ng.service >└─14555 /usr/sbin/syslog-ng -F > > Aug 28 15:04:28 oscapserver systemd[1]: Starting System Logger Daemon... > Aug 28 15:04:28 oscapserver systemd[1]: Started System Logger Daemon. > Aug 29 06:25:03 oscapserver systemd[1]: Reloading System Logger Daemon. > Aug 29 06:25:03 oscapserver systemd[1]: Reloaded System Logger Daemon. > > > But even after we ran the scan after fixing it Report still shows as > > Ensure syslog-ng is installed -> FAILED > Ensure Syslog-ng Service -> FAILED > > > Is there any reason for that ? > > > ___ > Open-scap-list mailing > listOpen-scap-list@redhat.comhttps://www.redhat.com/mailman/listinfo/open-scap-list > > > -- > Watson Sato > Security Technologies | Red Hat, Inc > > ___ > Open-scap-list mailing list > Open-scap-list@redhat.com > https://www.redhat.com/mailman/listinfo/open-scap-list ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
[Open-scap] syslog-ng setting issue in debian 8
Hi Team We have ran the scan for debian 8 using below command *oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report report.html ssg-debian8-ds.xml* Got alerts as below , == [image: image.png] To Fixed it we ran the below commands as suggested by the report * apt-get install syslog-ng-core * systemctl status syslog-ng ● syslog-ng.service - System Logger Daemon Loaded: loaded (/lib/systemd/system/syslog-ng.service; enabled) Active: active (running) since Tue 2018-08-28 15:04:28 IST; 23h ago Docs: man:syslog-ng(8) Process: 16275 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 14555 (syslog-ng) CGroup: /system.slice/syslog-ng.service └─14555 /usr/sbin/syslog-ng -F Aug 28 15:04:28 oscapserver systemd[1]: Starting System Logger Daemon... Aug 28 15:04:28 oscapserver systemd[1]: Started System Logger Daemon. Aug 29 06:25:03 oscapserver systemd[1]: Reloading System Logger Daemon. Aug 29 06:25:03 oscapserver systemd[1]: Reloaded System Logger Daemon. But even after we ran the scan after fixing it Report still shows as Ensure syslog-ng is installed -> FAILED Ensure Syslog-ng Service -> FAILED Is there any reason for that ? ___ Open-scap-list mailing list Open-scap-list@redhat.com https://www.redhat.com/mailman/listinfo/open-scap-list
