<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> Internal Use - Confidential<o:p></o:p> <o:p> </o:p> Hi<o:p></o:p> <o:p> </o:p> Wow, this is a great resource! Thank you very much for sharing it! This will be a huge help to my team, and will save us a lot of manual mapping time.<o:p></o:p> <o:p> </o:p> My first question is about format. What you attached is delivered to me as an html file with this format. I’m wondering if this is what you sent, or if it was changed by my company’s email protection system. What say you?<o:p></o:p> <o:p> </o:p> <img width="713" height="442" style="width:7.4291in;height:4.6041in" id="Picture_x0020_1" src="cid:image001.jpg@01D74E4C.39434570"><o:p></o:p> <o:p> </o:p> Second, are you planning to make this file available as a routine download, available for everyone?<o:p></o:p> <o:p> </o:p> Thanks again!<o:p></o:p> tl<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:open-scap-list-bounces@redhat.com"> open-scap-list-bounces@redhat.com</a> <<a href="mailto:open-scap-list-bounces@redhat.com">open-scap-list-bounces@redhat.com</a>> On Behalf Of Vojtech Polasek Sent: Tuesday, May 18, 2021 3:35 AM To: <a href="mailto:open-scap-list@redhat.com">open-scap-list@redhat.com</a> Subject: Re: [Open-scap] Using the 'STIG ID' value to identify a rule<o:p></o:p> </div> </div> <o:p> </o:p> <div> [EXTERNAL EMAIL] <o:p></o:p> </div> Hello Terry,<o:p></o:p> Alex is probably right. This is afaik not supported in Openscap. But maybe I can help you with the mapping. We are generating a table which I attach during the build process of the content for each product. It shows mapping of references to rules. Maybe this is something you can start with.<o:p></o:p> I hope it helps,<o:p></o:p> Vojta<o:p></o:p> <o:p> </o:p> <div> Dne 18. 05. 21 v 9:20 Alexander Bergmann napsal(a):<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre>Hi Terry,<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>>From what I see inside the 'oscap-xccdf.c' functions [1] there is no way<o:p></o:p></pre> <pre>to select anything else than the rule itself. So yes, your team would<o:p></o:p></pre> <pre>need to implement a mapping between the STIG ID and the rule name<o:p></o:p></pre> <pre>outside of the scap-security-guide profile.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Regards,<o:p></o:p></pre> <pre>Alex~<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>[1] <a href="https://urldefense.com/v3/__https:/github.com/OpenSCAP/openscap/blob/maint-1.3/utils/oscap-xccdf.c__;!!LpKI!0KlfNz5teRWcCGukU3oNEOoO4R4cOEUJHDLcz3nDa2XEcOVSP7OGQaXjqUWEEK7z$">https://github.com/OpenSCAP/openscap/blob/maint-1.3/utils/oscap-xccdf.c [github.com]</a><o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>On Mon, May 17, 2021 at 07:39:21PM +0000, Lemons, Terry wrote:<o:p></o:p></pre> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre>Internal Use - Confidential<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Hi Alex<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Thanks very much for this informative reply!<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>So, am I correct in understanding that it is not possible to select a rule via any mechanism other than the rule's 'Rule ID' value, as in below:<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_ftp_present_banner --profile xccdf_org.ssgproject.content_profile_stig /tmp/scap-security-guide-0.1.55/ssg-sle12-ds.xml<o:p></o:p></pre> <pre>WARNING: Datastream component 'scap_org.open-scap_cref_pub-projects-security-oval-suse.linux.enterprise.12.xml' points out to the remote '<a href="https://urldefense.com/v3/__https:/ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.12.xml__;!!LpKI!0KlfNz5teRWcCGukU3oNEOoO4R4cOEUJHDLcz3nDa2XEcOVSP7OGQaXjqaQUV511$">https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.12.xml [ftp.suse.com]</a>'. Use '--fetch-remote-resources' option to download it.<o:p></o:p></pre> <pre>WARNING: Skipping '<a href="https://urldefense.com/v3/__https:/ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.12.xml__;!!LpKI!0KlfNz5teRWcCGukU3oNEOoO4R4cOEUJHDLcz3nDa2XEcOVSP7OGQaXjqaQUV511$">https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.12.xml [ftp.suse.com]</a>' file which is referenced from datastream<o:p></o:p></pre> <pre>WARNING: Skipping ./pub-projects-security-oval-suse.linux.enterprise.12.xml file which is referenced from XCCDF content<o:p></o:p></pre> <pre>Title Create Warning Banners for All FTP Users<o:p></o:p></pre> <pre>Rule xccdf_org.ssgproject.content_rule_ftp_present_banner<o:p></o:p></pre> <pre>Ident CCE-83059-6<o:p></o:p></pre> <pre>Result pass<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>If so, then to meet my team's needs, we'll need to create a manual mapping between the SLES 12 STIG ID values that we know and the OpenSCAP 'Rule ID' value that implements the check and fix for that rule; true?<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Thanks!<o:p></o:p></pre> <pre>tl<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre><o:p> </o:p></pre> <pre>-----Original Message-----<o:p></o:p></pre> <pre>From: Alexander Bergmann <a href="mailto:abergmann@suse.com"><abergmann@suse.com></a> <o:p></o:p></pre> <pre>Sent: Monday, May 17, 2021 11:58 AM<o:p></o:p></pre> <pre>To: Lemons, Terry<o:p></o:p></pre> <pre>Cc: <a href="mailto:open-scap-list@redhat.com">open-scap-list@redhat.com</a><o:p></o:p></pre> <pre>Subject: Re: [Open-scap] Using the 'STIG ID' value to identify a rule<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Hi Terry,<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>I haven't checked the code in detail (yet), but as far as I can tell there is now way to select a rule via a present reference.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>The STIG ID is listed as a reference inside the Rule statement itself.<o:p></o:p></pre> <pre>>From the technical point it should be possible to implement such a feature inside OpenSCAP, but I'm not sure if this is desirable. A reference is simply not a clear identifier. Some references will also be used several times in different rules.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre><xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="false" severity="high"> ...<o:p></o:p></pre> <pre> <xccdf-1.2:reference href=<a href="https://urldefense.com/v3/__https:/public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems*2Cunix-linux__;JQ!!LpKI!0KlfNz5teRWcCGukU3oNEOoO4R4cOEUJHDLcz3nDa2XEcOVSP7OGQaXjqdpbuoLq$">"https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux" [public.cyber.mil]</a>>SLES-12-010000</xccdf-1.2:reference><o:p></o:p></pre> <pre>...<o:p></o:p></pre> <pre></xccdf-1.2:Rule><o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>>From the SCAP point of view, STIG is only one profile of many.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Maybe one way to explore would be the use of CCEs as a direct rule identifier. We assign CCEs to each STIG requirement 1:1 and they are listed inside the OpenSCAP output.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Title The Installed Operating System Is Vendor Supported<o:p></o:p></pre> <pre>Rule xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported<o:p></o:p></pre> <pre>Ident CCE-83001-8<o:p></o:p></pre> <pre>Result pass<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>So may that would be something for a future release.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre><o:p> </o:p></pre> <pre>Regards,<o:p></o:p></pre> <pre>Alex~<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>On Fri, May 14, 2021 at 05:45:59PM +0000, Lemons, Terry wrote:<o:p></o:p></pre> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre>Internal Use - Confidential<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Hi<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>I recently learned about OpenSCAP, and it seems to fill a need in my team. My team needs to address (close) all of the rules in the SLES 12 STIG on our product. It seems that using oscap, along with the most-recent 'scap-security-guide' (which appears to cover 146 SLES 12 STIG rules), will allow me to see which rules are open ('oscap xccdf eval') and to implement changes to close those rules ('oscap xccdf eval -remediate').<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>I know that I can use the '-rule' option to specify the name of a single rule to evaluate or remediate.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Our group identifies rules to be fixed, in our work management system and other systems, by the SLES 12 STIG 'STIG ID' value (ex., SLES-12-010000). I tried to use this value in the '-rule' option, and it failed to identify/find that rule.<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>How can I make oscap operate on a rule identified by 'STIG ID' value (or, even better, on a file containing a list of 'STIG ID' rules?<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Thanks!<o:p></o:p></pre> <pre>tl<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>Terry Lemons<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>[DellEMC_Logo_Hz_Blue_rgb_10percent]<o:p></o:p></pre> <pre>Data Management<o:p></o:p></pre> <pre>Infrastructure Solutions Group<o:p></o:p></pre> <pre><o:p> </o:p></pre> <pre>176 South Street, MS 2/B-34<o:p></o:p></pre> <pre>Hopkinton MA 01748<o:p></o:p></pre> <pre><a href="mailto:terry.lemons@dell.com">terry.lemons@dell.com</a><a href="mailto:terry.lemons@dell.com"><mailto:terry.lemons@dell.com></a><o:p></o:p></pre> <pre><o:p> </o:p></pre> </blockquote> <pre><o:p> </o:p></pre> <pre><o:p> </o:p></pre> <pre><o:p> </o:p></pre> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre>_______________________________________________<o:p></o:p></pre> <pre>Open-scap-list mailing list<o:p></o:p></pre> <pre><a href="mailto:Open-scap-list@redhat.com">Open-scap-list@redhat.com</a><o:p></o:p></pre> <pre><a href="https://urldefense.com/v3/__https:/listman.redhat.com/mailman/listinfo/open-scap-list__;!!LpKI!0KlfNz5teRWcCGukU3oNEOoO4R4cOEUJHDLcz3nDa2XEcOVSP7OGQaXjqSHI2E-R$">https://listman.redhat.com/mailman/listinfo/open-scap-list [listman.redhat.com]</a><o:p></o:p></pre> </blockquote> <pre><o:p> </o:p></pre> <pre><o:p> </o:p></pre> <pre>--<o:p></o:p></pre> <pre>Alexander Bergmann <a href="mailto:abergmann@suse.com"><abergmann@suse.com></a><o:p></o:p></pre> <pre>Security Engineer, GPG: E30A 65A4 0F50 0066 B2B5 F614 DE54 E875 9FFA 4886 SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nuremberg, Germany (HRB 36809, AG N�rnberg) Managing Director: Felix Imend�rffer<o:p></o:p></pre> <pre><o:p> </o:p></pre> </blockquote> <pre><o:p> </o:p></pre> <o:p> </o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>Open-scap-list mailing list<o:p></o:p></pre> <pre><a href="mailto:Open-scap-list@redhat.com">Open-scap-list@redhat.com</a><o:p></o:p></pre> <pre><a href="https://urldefense.com/v3/__https:/listman.redhat.com/mailman/listinfo/open-scap-list__;!!LpKI!0KlfNz5teRWcCGukU3oNEOoO4R4cOEUJHDLcz3nDa2XEcOVSP7OGQaXjqSHI2E-R$">https://listman.redhat.com/mailman/listinfo/open-scap-list [listman.redhat.com]</a><o:p></o:p></pre> </blockquote> </div> </body> </html>