<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Thank you, Gary! I will attempt next to duplicate your process with Ubuntu 1604.<o:p></o:p> <o:p> </o:p> If I am building OpenSCAP over my previous install of the libopenscap8 package, do I need to remove libopenscap8 first or can I just make-install over it?<o:p></o:p> <o:p> </o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com">william.boucher@mza.com</a><o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Gary Gapinski [mailto:gapinski@nasa.gov] Sent: Wednesday, January 23, 2019 9:03 PM To: Boucher, William <William.Boucher@mza.com> Cc: open-scap-list@redhat.com Subject: Re: [Open-scap] Benchmark for Canonical Ubuntu 16.04 LTS<o:p></o:p> </div> </div> <o:p> </o:p> <div> I just took a look at OpenSCAP and ComplianceAsCode.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> I obtained results that were at variance with yours, and which failed to attain Glorious Victory.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Some comments inline.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> On 1/23/19 10:10 AM, Boucher, William wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> OK! I downloaded the latest scap-security-guide source from Git and built it for Ubuntu 1604. It compiles and runs!<o:p></o:p> </blockquote> Using an Ubuntu 18.04 instance as a platform, I obtained, built, and installed <a href="https://github.com/OpenSCAP/openscap">https://github.com/OpenSCAP/openscap</a>.<o:p></o:p> I also obtained and built <a href="https://github.com/ComplianceAsCode/content"> https://github.com/ComplianceAsCode/content</a> on the same system.<o:p></o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Next challenge, during the compile it had trouble scanning the Oval file for controls it was to evaluate, and it marked all of those it didn’t find as “not applicable”. So I got a score of 100%, but none of the challenging controls were evaluated. (I used an oval file I found in the source tree but I guess it was not complete.)<o:p></o:p> </blockquote> Using «<tt>oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --results-arf results-arf.xml --report report.html --results results.xml ssg-ubuntu1804-ds.xml</tt>» all results were <tt>notapplicable</tt>.<o:p></o:p> I commented out line #10606 (the <tt><platform></tt> designator) in <tt>ssg-ubuntu1804-ds.xml</tt> and ran the evaluation again. This time some of the rules were evaluated, some passed, some failed, some resulted in error, some were notapplicable (for no apparent reason).<o:p></o:p> I then ran the same evaluation as root («<tt>sudo oscap …</tt>»), and obtained passes, fails, and notapplicables, but no errors. The report was at variance with the input data stream with respect to rules selected in the data stream (the profile selects more rules than appear in the eval report — 45 vs 38 respectively).<o:p></o:p> Note that I am using the data stream (<tt>ssg-ubuntu1804-ds.xml</tt>) and not, directly, the related OVAL (<tt>ssg-ubuntu1804-oval.xml</tt>). I have a profound antipathy toward OVAL, and prefer to avoid close contact.<o:p></o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Apparently I need more or better benchmark files for Ubuntu in the OpenSCAP “/usr/share/openscap” and “/usr/share/openscap/cpe” directories (openscap-cpe-dictionary.xml, openscap-cpe-oval.xml, openscap-ubuntu1604-cpe-dictionary.xml and openscap-ubuntu1604-cpe-oval.xml in the openscap/cpe directory and scap-ubuntu1604-oval.xml, scap-ubuntu1604-ocil.xml and scap-ubuntu-1604-ds.xml in the openscap directory).<o:p></o:p> </blockquote> I used git head to build the content I used. The data stream encapsulates the related XCCDF and OVAL documents.<o:p></o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> These files do not appear to be in the source from Git and they were not installed with the libopenscap8 package. Google is not helping me with this challenge. Can you guys direct me to where I can find these files so I can build and run a complete scan of my system(s)?<o:p></o:p> </blockquote> I expect you would obtain similar results on 16.04. Determining why rules end up notapplicable, or seem to be skipped during evaluation, will require additional inspection, as will evaluating the veracity of the passes and fails.<o:p></o:p> Regards,<o:p></o:p> Gary<o:p></o:p> <div> -- <o:p></o:p> <address>Gary Gapinski — DB Consulting Group NASA Glenn Research Center ℡ <a href="tel:+1%20216%20433%203959">+1 216 433 3959</a> — office ℡ <a href="tel:+1%20216%20820%201849">+1 216 820 1849</a> — mobile <a href="mailto:gapinski@nasa.gov">gapinski@nasa.gov</a> <o:p></o:p></address> </div> </div> </body> </html>