[Open-scap] Making Fix Templates

[Boyd Ako]

What do you mean by "map" the XCCDFs of SSG and DISA? I've looked into the
the DISA Vunerability IDs referenceing the CCI/CCEs that it's for. I
haven't checked it against the SSG XCCDF though.

Yeah... I know the "generate fix" thing is muck. I'm actually having to
rebuild a system because the script killed my bootloader.

I'm essentially trying to use the "generate fix" functionality using
external snippets. It's pretty obvious the snippets and the results are not
that dependable to use on production systems. It's what the template used
to do. It finds CCI XXX as open and searches the template for function CCI
XXX and adds the snippet to script. The snippet it's self would also
"double check" the finding and "fix" the finding in means that you could
run it over and over again and it'd only do something when the snippet
actually finds the finding as open.

I get why the snippets are included into the XCCDF. However, it doesn't
have the ability to take in logic and conditions on a "per system" basis. I
know that's where the "tailoring" comes in. But that's also to "static". By
using a template, in the PRE section I can state that "if 3rd IP octet is
130 do not run fix for CCI XXX or use value of blah for CCI XXX setting"
noting some official documentation for exception.

That all being said, all Open SCAP then does is essentially just scan the
system. And in my work environment the SPAWAR SCC is the more approved
scanner. And I could make a script to read the results XML and generate a
fix script like Open SCAP would do. But, that would imply that we don't
need Open SCAP to begin with and remove a justification for the department
to purchase Red Hat Satellite. ... However, if I can use the Open SCAP to
use the stated authorized and approved DISA XCCDF and then use a template
to fill in the blanks for the finding snippets that would be a means more
likely to be approved.


All the XCCDFs are good for scanning. But, the fixing and remediation is
where most of the Sys Ads complain. And the XCCDF code snippets are not
reliable because only a really tiny group of people are able to update the
XCCDF files; officially. If the template function worked, I'd imagine a
bunch of people collaborating on making fix templates on GITHUB or where
ever. The XCCDF file needs to be official and authorized. The fix templates
do not.


------------------------------
Thank you for your time,

Boyd H. Ako

boyd.hanalei.ako at gmail.com
https://www.boydhanaleiako.me
Cell Phone: (424) 244-9653PGP/GPG Public Key:
https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
------------------------------


On Thu, Jan 10, 2019 at 9:27 PM Jan Cerny <jcerny at redhat.com> wrote:

> Hi,
>
> I have looked into this quickly. But I haven't able to get that working. I
> haven't found
> anything in the source code that uses it. It seems to me that the feature
> has been removed
> without changing the documentation. I'm not sure if the removal was
> intended or if it is
> a regression.
>
> The "oscap xccdf generate fix" command only extracts the code snippets
> from the input
> XCCDF or DS file. There is no magic logic behind that, it is a very simple
> transformation.
> It doesn't understand or doesn't analyze the rules that are there.
>
> It isn't clear to me what you need. Do you try to map SSG XCCDF to XCCDF
> provided by DISA?
>
> Regards
>
> Jan Černý
> Security Technologies | Red Hat, Inc.
>
> ----- Original Message -----
> > From: "Boyd Ako" <boyd.hanalei.ako at gmail.com>
> > To: open-scap-list at redhat.com
> > Sent: Wednesday, January 9, 2019 1:32:48 AM
> > Subject: [Open-scap] Making Fix Templates
> >
> > Aloha,
> >
> > So I had a couple questions.
> >
> > A) Is using the Fix Template function still being supported?
> >
> > B) Is there more detailed documentation on creating the template? I'm
> already
> > aware of the XSL "legacy" files in /usr/share/openscap/xsl. I seem to be
> > having issues with openscap outputing anything from the
> > legacy-fixtpl-bash.xml as it is or when I try to modify the "fixentry" to
> > map to a rule.
> >
> > C) If the Fix Template function is more or less dead in the water, is
> there a
> > way I can "convey" fixes for the remediation script generation that's
> either
> > local or on premise? I know that OpenSCAP does have a bunch of fixes for
> the
> > SSGs. But I can't really reach them due to isolation and even if I could
> it
> > wouldn't be permitted since it's "external" to "DISA Approved" stuff.
> >
> >
> > My environment: As awesome as it is that there's SSGs for DISA RHEL 7, I
> > can't use it because it doesn't have the MAC and Sensitivity profiles in
> the
> > actual RHEL 7 Benchmark from the DISA XCCDF. So, I'm using the the XCCDF
> > from DISA with the appropriate profile and none of the "rules" seem to
> match
> > any of the remediation fixes for the failed rules. Also due to networking
> > infrastructure, I'm more or less isoalted so fetching remote resources is
> > out.
> >
> >
> >
> >
> > Thank you for your time,
> >
> > Boyd H. Ako
> >
> > boyd.hanalei.ako at gmail.com
> > https://www.boydhanaleiako.me
> >
> >
> >       Cell Phone:     (424) 244-9653 PGP/GPG Public Key:
> >
> https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
> >
> >
> > _______________________________________________
> > Open-scap-list mailing list
> > Open-scap-list at redhat.com
> > https://www.redhat.com/mailman/listinfo/open-scap-list
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/open-scap-list/attachments/20190111/1c214c86/attachment.htm>