<div dir="ltr">It's the other way around. Most DOD Information Assurance departments use the DISA IASE stuff that are based off of a Vulnerability ID (VID). The VIDs are normally associated with a CCI or CCE; sometimes both or one or the other. The VIDs are sometimes the results of the Information Assurance Vulnerability Management (IAVM) creating Information Assurance Vulnerability Alerts (IAVA). An example is IAVM gets aware of the Meltdown vulnerability so they create an IAVA to notify people to do "temporary" mitigation. Later a VID is stated to use a kernel version that not vulnerable to the Meltdown vulnerability. <div><br></div><div>VID, IAVA, IAVM are DoD terms whereas CCI and CCE are industry standard terms. IMO is the DOD doing the "Security through obscurity" method to confuse everyone. LOL. That's also where oscap used to need the --stig-viewer option for DOD to use it with the "Approved" STIG Viewer. And I believe XCCDF 1.2 kind of help to address some of those issues to standardize the XML reports. Pretty much every where I've seen outside of DOD use CCI and CCE as identifiers, not VID.<br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div><br></div><div>That being said... You could ask most DOD Information Assurance folks to explain what a CCI or CCE is and they'd be lost. Ask them what a VID is and they'll recite the official documented definition of what it is and how it's handled. Let's not even get started on CVEs.<br><br><br>
<hr align="left" width="25%">
Thank you for your time,<br><br>Boyd H. Ako<br><br><a href="mailto:boyd.hanalei.ako@gmail.com" target="_blank">boyd.hanalei.ako@gmail.com</a></div><div><a href="https://www.boydhanaleiako.me" target="_blank">https://www.boydhanaleiako.me<br>
</a><table>
<tbody>
<tr>
<td></td>
<td></td></tr>
<tr>
<td>Cell Phone:</td>
<td><a value="+18082268245">(424) 244-9653</a></td></tr></tbody></table>PGP/GPG Public Key: <a href="https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134" target="_blank">https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134</a><br>
<hr>
</div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 11, 2019 at 4:07 PM Ruben Oliva <<a href="mailto:david.oliva@verizon.net">david.oliva@verizon.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><font color="black" size="2" face="arial">
<div> <font size="2">Hello folks. Here's my two cents.</font></div>
<div><font size="2"><br>
</font></div>
<div><font size="2">The CCI is not an SCAP specification but a DISA one. In my observations, it appears that Red Hat has worked with DISA to support CCI, but this does not mean that Red Hat is promoting the use of CCI outside of DoD. Is this correct?</font></div>
<div><font size="2"><br>
</font></div>
<div><font size="2"><br>
</font></div>
<div><font size="2">David Oliva</font><br>
</div>
<div> <br>
</div>
<div> <br>
</div>
<div style="font-family:arial,helvetica;font-size:10pt;color:black">-----Original Message-----<br>
From: Boyd Ako <<a href="mailto:boyd.hanalei.ako@gmail.com" target="_blank">boyd.hanalei.ako@gmail.com</a>><br>
To: Jan Cerny <<a href="mailto:jcerny@redhat.com" target="_blank">jcerny@redhat.com</a>><br>
Cc: open-scap-list <<a href="mailto:open-scap-list@redhat.com" target="_blank">open-scap-list@redhat.com</a>><br>
Sent: Fri, Jan 11, 2019 8:06 pm<br>
Subject: Re: [Open-scap] Making Fix Templates<br>
<br>
<div id="gmail-m_6293156050086977149yiv4409409448">
<div>
<div dir="ltr">What do you mean by "map" the XCCDFs of SSG and DISA? I've looked into the the DISA Vunerability IDs referenceing the CCI/CCEs that it's for. I haven't checked it against the SSG XCCDF though.
<div><br clear="none"></div>
<div>Yeah... I know the "generate fix" thing is muck. I'm actually having to rebuild a system because the script killed my bootloader.</div>
<div><br clear="none"></div>
<div>I'm essentially trying to use the "generate fix" functionality using external snippets. It's pretty obvious the snippets and the results are not that dependable to use on production systems. It's what the template used to do. It finds CCI XXX as open and searches the template for function CCI XXX and adds the snippet to script. The snippet it's self would also "double check" the finding and "fix" the finding in means that you could run it over and over again and it'd only do something when the snippet actually finds the finding as open.</div>
<div><br clear="none"></div>
<div>I get why the snippets are included into the XCCDF. However, it doesn't have the ability to take in logic and conditions on a "per system" basis. I know that's where the "tailoring" comes in. But that's also to "static". By using a template, in the PRE section I can state that "if 3rd IP octet is 130 do not run fix for CCI XXX or use value of blah for CCI XXX setting" noting some official documentation for exception. </div>
<div><br clear="none"></div>
<div>That all being said, all Open SCAP then does is essentially just scan the system. And in my work environment the SPAWAR SCC is the more approved scanner. And I could make a script to read the results XML and generate a fix script like Open SCAP would do. But, that would imply that we don't need Open SCAP to begin with and remove a justification for the department to purchase Red Hat Satellite. ... However, if I can use the Open SCAP to use the stated authorized and approved DISA XCCDF and then use a template to fill in the blanks for the finding snippets that would be a means more likely to be approved.<br clear="all">
<div>
<div class="gmail-m_6293156050086977149yiv4409409448gmail_signature" dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div><br clear="none"></div>
<div><br clear="none"></div>
<div>All the XCCDFs are good for scanning. But, the fixing and remediation is where most of the Sys Ads complain. And the XCCDF code snippets are not reliable because only a really tiny group of people are able to update the XCCDF files; officially. If the template function worked, I'd imagine a bunch of people collaborating on making fix templates on GITHUB or where ever. The XCCDF file needs to be official and authorized. The fix templates do not.</div>
<div><br clear="none"><br clear="none">
<hr width="25%" align="left">
Thank you for your time,<br clear="none"><br clear="none">Boyd H. Ako<br clear="none"><br clear="none"><a rel="noopener noreferrer" shape="rect" href="mailto:boyd.hanalei.ako@gmail.com" target="_blank">boyd.hanalei.ako@gmail.com</a></div>
<div><a rel="noopener noreferrer" shape="rect" href="https://www.boydhanaleiako.me" target="_blank">https://www.boydhanaleiako.me<br clear="none">
</a><table><tbody><tr><td colspan="1" rowspan="1"></td><td colspan="1" rowspan="1"></td></tr><tr><td colspan="1" rowspan="1">Cell Phone:</td><td colspan="1" rowspan="1"><a rel="nofollow" shape="rect">(424) 244-9653</a></td></tr></tbody></table>PGP/GPG Public Key: <a rel="noopener noreferrer" shape="rect" href="https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134" target="_blank">https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134</a><br clear="none">
<hr>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br clear="none"></div>
</div>
<br clear="none">
<div class="gmail-m_6293156050086977149yiv4409409448gmail_quote">
<div class="gmail-m_6293156050086977149yiv4409409448yqt3143708186" id="gmail-m_6293156050086977149yiv4409409448yqtfd28077">
<div dir="ltr">On Thu, Jan 10, 2019 at 9:27 PM Jan Cerny <<a rel="noopener noreferrer" shape="rect" href="mailto:jcerny@redhat.com" target="_blank">jcerny@redhat.com</a>> wrote:<br clear="none"></div>
<blockquote class="gmail-m_6293156050086977149yiv4409409448gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br clear="none">
<br clear="none">
I have looked into this quickly. But I haven't able to get that working. I haven't found<br clear="none">
anything in the source code that uses it. It seems to me that the feature has been removed<br clear="none">
without changing the documentation. I'm not sure if the removal was intended or if it is<br clear="none">
a regression.<br clear="none">
<br clear="none">
The "oscap xccdf generate fix" command only extracts the code snippets from the input<br clear="none">
XCCDF or DS file. There is no magic logic behind that, it is a very simple transformation.<br clear="none">
It doesn't understand or doesn't analyze the rules that are there.<br clear="none">
<br clear="none">
It isn't clear to me what you need. Do you try to map SSG XCCDF to XCCDF provided by DISA?<br clear="none">
<br clear="none">
Regards<br clear="none">
<br clear="none">
Jan Černý<br clear="none">
Security Technologies | Red Hat, Inc.<br clear="none">
<br clear="none">
----- Original Message -----<br clear="none">
> From: "Boyd Ako" <<a rel="noopener noreferrer" shape="rect" href="mailto:boyd.hanalei.ako@gmail.com" target="_blank">boyd.hanalei.ako@gmail.com</a>><br clear="none">
> To: <a rel="noopener noreferrer" shape="rect" href="mailto:open-scap-list@redhat.com" target="_blank">open-scap-list@redhat.com</a><br clear="none">
> Sent: Wednesday, January 9, 2019 1:32:48 AM<br clear="none">
> Subject: [Open-scap] Making Fix Templates<br clear="none">
> <br clear="none">
> Aloha,<br clear="none">
> <br clear="none">
> So I had a couple questions.<br clear="none">
> <br clear="none">
> A) Is using the Fix Template function still being supported?<br clear="none">
> <br clear="none">
> B) Is there more detailed documentation on creating the template? I'm already<br clear="none">
> aware of the XSL "legacy" files in /usr/share/openscap/xsl. I seem to be<br clear="none">
> having issues with openscap outputing anything from the<br clear="none">
> legacy-fixtpl-bash.xml as it is or when I try to modify the "fixentry" to<br clear="none">
> map to a rule.<br clear="none">
> <br clear="none">
> C) If the Fix Template function is more or less dead in the water, is there a<br clear="none">
> way I can "convey" fixes for the remediation script generation that's either<br clear="none">
> local or on premise? I know that OpenSCAP does have a bunch of fixes for the<br clear="none">
> SSGs. But I can't really reach them due to isolation and even if I could it<br clear="none">
> wouldn't be permitted since it's "external" to "DISA Approved" stuff.<br clear="none">
> <br clear="none">
> <br clear="none">
> My environment: As awesome as it is that there's SSGs for DISA RHEL 7, I<br clear="none">
> can't use it because it doesn't have the MAC and Sensitivity profiles in the<br clear="none">
> actual RHEL 7 Benchmark from the DISA XCCDF. So, I'm using the the XCCDF<br clear="none">
> from DISA with the appropriate profile and none of the "rules" seem to match<br clear="none">
> any of the remediation fixes for the failed rules. Also due to networking<br clear="none">
> infrastructure, I'm more or less isoalted so fetching remote resources is<br clear="none">
> out.<br clear="none">
> <br clear="none">
> <br clear="none">
> <br clear="none">
> <br clear="none">
> Thank you for your time,<br clear="none">
> <br clear="none">
> Boyd H. Ako<br clear="none">
> <br clear="none">
> <a rel="noopener noreferrer" shape="rect" href="mailto:boyd.hanalei.ako@gmail.com" target="_blank">boyd.hanalei.ako@gmail.com</a><br clear="none">
> <a rel="noopener noreferrer" shape="rect" href="https://www.boydhanaleiako.me" target="_blank">https://www.boydhanaleiako.me</a><br clear="none">
> <br clear="none">
> <br clear="none">
> Cell Phone: (424) 244-9653 PGP/GPG Public Key:<br clear="none">
> <a rel="noopener noreferrer" shape="rect" href="https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134" target="_blank">https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134</a><br clear="none">
> <br clear="none">
> <br clear="none">
> _______________________________________________<br clear="none">
> Open-scap-list mailing list<br clear="none">
> <a rel="noopener noreferrer" shape="rect" href="mailto:Open-scap-list@redhat.com" target="_blank">Open-scap-list@redhat.com</a><br clear="none">
> <a rel="noopener noreferrer" shape="rect" href="https://www.redhat.com/mailman/listinfo/open-scap-list" target="_blank">https://www.redhat.com/mailman/listinfo/open-scap-list</a><br clear="none">
</blockquote></div>
</div>
</div>
</div>
<div class="gmail-m_6293156050086977149yqt3143708186" id="gmail-m_6293156050086977149yqtfd65211">_______________________________________________<br clear="none">Open-scap-list mailing list<br clear="none"><a shape="rect" rel="noopener noreferrer" href="mailto:Open-scap-list@redhat.com" target="_blank">Open-scap-list@redhat.com</a><br clear="none"><a shape="rect" rel="noopener noreferrer" href="https://www.redhat.com/mailman/listinfo/open-scap-list" target="_blank">https://www.redhat.com/mailman/listinfo/open-scap-list</a></div>
</div>
</font></blockquote></div>