<div dir="ltr">Hi Matus<div><br></div><div>Please find the attached reports </div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, 4 Sep 2018 at 18:43, Matus Marhefka <<a href="mailto:mmarhefk@redhat.com">mmarhefk@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-size:small">Hi Dhanushka,</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">have you run both 'systemctl start SERVICE' and 'systemctl enable SERVICE' (replace SERVICE with auditd and ntp)? If yes, it might be an issue either in OVAL checks or in the systemdunitdependency_probe. Please run the following scans and send us the outputs for further analysis:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><b>oscap xccdf eval --verbose DEVEL --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --rule xccdf_org.ssgproject.content_rule_service_ntp_enabled ssg-debian8-ds.xml</b></div><div class="gmail_default" style="font-size:small">and</div><div class="gmail_default" style="font-size:small"><b>oscap xccdf eval --verbose DEVEL --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --rule xccdf_org.ssgproject.content_rule_service_auditd_enabled ssg-debian8-ds.xml</b><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Best Regards,</div><div class="gmail_default" style="font-size:small">Matus Marhefka<br></div></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 3, 2018 at 11:59 AM, Dhanushka Parakrama <span dir="ltr"><<a href="mailto:parakrama1282@gmail.com" target="_blank">parakrama1282@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Guys<div><br></div><div>Any news regarding the error </div></div><div class="m_-863908304401269487HOEnZb"><div class="m_-863908304401269487h5"><br><div class="gmail_quote"><div dir="ltr">On Wed, 29 Aug 2018 at 21:33, Dhanushka Parakrama <<a href="mailto:parakrama1282@gmail.com" target="_blank">parakrama1282@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><br></div><div><div class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-gE m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-iv m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-gt" style="padding:20px 0px 0px;font-size:12.8px;font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif"><table class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-cf m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-gJ" style="border-collapse:collapse;margin-top:0px;width:auto;font-size:0.875rem;letter-spacing:0.2px;display:block" cellpadding="0"></table></div><div id="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-:2gf" style="font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:medium"><div class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-qQVYZb"></div><div class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-utdU2e"></div><div class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-btm"></div></div><div class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-" style="font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:medium"><div class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-aHl"></div><div id="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-:2em"></div><div id="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-:2gd" class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-ii m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-gt" style="font-size:12.8px;direction:ltr;margin:8px 0px 0px;padding:0px"><div id="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-:2ge" class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-a3s m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-aXjCH" style="overflow:hidden;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:small;line-height:1.5;font-family:Arial,Helvetica,sans-serif"><div dir="ltr"><div>Hi Team </div><div><br></div><div>We have ran the scan for debian 8 using below command </div><div><br></div><div><b>oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --report report.html ssg-debian8-ds.xml</b><br></div><div><br></div><div>Got alerts as below ,</div><div>===============</div><div><br></div><div><div><img src="cid:ii_jlfbs8z91" alt="image.png" style="margin-right:0px" width="902" height="65"><br></div></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div><div>To Fixed it we ran the below commands as suggested by the report <br></div><div><br></div><div><b>service ntp status</b></div><div>● ntp.service - LSB: Start NTP daemon</div><div> Loaded: loaded (/etc/init.d/ntp)</div><div> Active: active (running) since Mon 2018-08-27 18:24:21 IST; 2 days ago</div><div> CGroup: /system.slice/ntp.service</div><div> └─473 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 112:120</div><div><br></div><div>Aug 27 18:24:21 oscapserver ntpd[473]: Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123</div><div>Aug 27 18:24:21 oscapserver ntpd[473]: Listen and drop on 1 v6wildcard :: UDP 123</div><div>Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 2 lo 127.0.0.1 UDP 123</div><div>Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 3 eth0 192.168.8.150 UDP 123</div><div>Aug 27 18:24:21 oscapserver ntpd[473]: Listen normally on 4 lo ::1 UDP 123</div><div>Aug 27 18:24:21 oscapserver ntpd[473]: peers refreshed</div><div>Aug 27 18:24:21 oscapserver ntpd[473]: Listening on routing socket on fd #21 for interface updates</div><div>Aug 27 18:24:21 oscapserver systemd[1]: Started LSB: Start NTP daemon.</div><div>Aug 27 18:24:24 oscapserver ntpd[473]: Listen normally on 5 eth0 fe80::250:56ff:fe94:6150 UDP 123</div><div>Aug 27 18:24:24 oscapserver ntpd[473]: peers refreshed</div><div><br></div><div><br></div><div><div><b>service auditd status</b></div><div>● auditd.service - Security Auditing Service</div><div> Loaded: loaded (/lib/systemd/system/auditd.service; enabled)</div><div> Active: active (running) since Tue 2018-08-28 14:41:28 IST; 1 day 6h ago</div><div> Main PID: 12464 (auditd)</div><div> CGroup: /system.slice/auditd.service</div><div> └─12464 /sbin/auditd -n</div></div><div><br></div><div><br></div><div><div>But even after we ran the scan after fixing it Report still shows as </div><br class="m_-863908304401269487m_2005267040395652278m_-4883267170915001482gmail-Apple-interchange-newline"></div><div><br></div><div><div><img src="cid:ii_jlfborjy0" alt="image.png" style="margin-right:0px" width="773" height="55"><br></div></div><div><br></div><div>Is there any reason for that ?</div><div><br></div><div><br></div><div>Thank You</div><div>Dhanushka</div><div><br></div><div><br></div></div></div></div></div> </blockquote></div> </div></div><br>_______________________________________________<br> Open-scap-list mailing list<br> <a href="mailto:Open-scap-list@redhat.com" target="_blank">Open-scap-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/open-scap-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/open-scap-list</a><br></blockquote></div><br></div> </blockquote></div>