<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Thanks Gary! Got your other note. Will look into your comments there and will pursue going after RedHawk 6.5 (my other task) using RedHat 5.5 OpenScap and DISA xccdf, oval, etc. for that (as suggested by RedHawk folks), if I get stuck on Ubuntu, to validate the current oscap process and work out any other issues first. Not out of oxygen yet!<o:p></o:p> <o:p> </o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com">william.boucher@mza.com</a><o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Gary Gapinski [mailto:gapinski@nasa.gov] Sent: Monday, February 4, 2019 10:26 AM To: Boucher, William <William.Boucher@mza.com> Cc: open-scap-list@redhat.com Subject: Re: [Open-scap] Benchmark for Canonical Ubuntu 16.04 LTS<o:p></o:p> </div> </div> <o:p> </o:p> <div> I can look but if your oxygen will run out before 48 hours you may wish to order out for extra.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> <o:p> </o:p> </div> <div> On 2/4/19 11:05 AM, Boucher, William wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Gary,<o:p></o:p> <o:p></o:p> Is anybody looking at this on the development side (determining why so many rules end up nonapplicable and if the passes and fails are the result of an accurate evaluation)?<o:p></o:p> <o:p></o:p> Thanks,<o:p></o:p> <o:p></o:p> --Bill<o:p></o:p> <o:p></o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com">william.boucher@mza.com</a><o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:open-scap-list-bounces@redhat.com">open-scap-list-bounces@redhat.com</a> [<a href="mailto:open-scap-list-bounces@redhat.com">mailto:open-scap-list-bounces@redhat.com</a>] On Behalf Of Boucher, William Sent: Monday, February 4, 2019 9:04 AM To: Gary Gapinski <a href="mailto:gapinski@nasa.gov"><gapinski@nasa.gov></a> Cc: <a href="mailto:open-scap-list@redhat.com">open-scap-list@redhat.com</a> Subject: Re: [Open-scap] Benchmark for Canonical Ubuntu 16.04 LTS<o:p></o:p> </div> </div> <o:p></o:p> Gary,<o:p></o:p> <o:p></o:p> Similar results with Ububtu 16.04. Not all results were notapplicable, score was given as 25%.<o:p></o:p> <o:p></o:p> After building openscap and ComplianceAsCode/content I ran:<o:p></o:p> <o:p></o:p> sudo oscap xccdf eval –profile standard –results ./xccdf-results.xml –cpe /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-cpe-dictionary.xml /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml<o:p></o:p> <o:p></o:p> sudo oscap oval eval –results ./oval-results.xml /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-oval.xml<o:p></o:p> <o:p></o:p> sudo oscap xccdf generate report –oval-template ./oval-results.xml ./xccdf-results.xml > ./report-xccdf-oval.html<o:p></o:p> <o:p></o:p> 15 rules passed, 6 inconclusive (unknown) and all the rest (24) notapplicable.<o:p></o:p> <o:p></o:p> Running:<o:p></o:p> <o:p></o:p> sudo oscap xccdf eval –profile standard –results-arf ./results-arf.xml –report ./report-ds.html –results ./results-ds.xml /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml<o:p></o:p> <o:p></o:p> produced the same numbers in the ds-generated report.<o:p></o:p> <o:p></o:p> I see the value in using the data stream. But the “notapplicable” items are largely applicable and should be evaluated.<o:p></o:p> <o:p></o:p> --Bill<o:p></o:p> <o:p></o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com">william.boucher@mza.com</a><o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Gary Gapinski [<a href="mailto:gapinski@nasa.gov">mailto:gapinski@nasa.gov</a>] Sent: Friday, January 25, 2019 9:50 AM To: Boucher, William <<a href="mailto:William.Boucher@mza.com">William.Boucher@mza.com</a>> Cc: <a href="mailto:open-scap-list@redhat.com">open-scap-list@redhat.com</a> Subject: Re: [Open-scap] Benchmark for Canonical Ubuntu 16.04 LTS<o:p></o:p> </div> </div> <o:p></o:p> <div> On 1/25/19 10:33 AM, Boucher, William wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Thank you, Gary! I will attempt next to duplicate your process with Ubuntu 1604.<o:p></o:p> </blockquote> I may as well but cannot guarantee timeliness.<o:p></o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> If I am building OpenSCAP over my previous install of the libopenscap8 package, do I need to remove libopenscap8 first or can I just make-install over it?<o:p></o:p> </blockquote> I place the OpenSCAP install in <tt>/usr/local</tt> and ensure it is used separately and preferentially (via <tt>$PATH</tt>) rather than the one from the distro (or just not install from the distro). I use <tt>cmake-gui ../</tt> from within the <tt> openscap/build</tt> directory and change <tt> CMAKE_INSTALL_PREFIX</tt> to <tt>/usr/local</tt> (<tt>cmake-gui,</tt> tweak, configure, generate; <tt>make</tt>; <tt>sudo make install</tt>). Installing on top of the distro version will likely cause undesirable results.<o:p></o:p> I do not typically install ComplianceAsCode but simply access the content from the cloned (and built) repo, but if you install it I think it best to choose the same installation target (e.g., <tt>/usr/local</tt>) as that of OpenSCAP.<o:p></o:p> A functional (and available) install of OpenSCAP is a pre-requisite for building ComplianceAsCode.<o:p></o:p> Regards,<o:p></o:p> Gary<o:p></o:p> <div> -- <o:p></o:p> <address>Gary Gapinski — DB Consulting Group NASA Glenn Research Center ℡ <a href="tel:+1%20216%20433%203959">+1 216 433 3959</a> — office ℡ <a href="tel:+1%20216%20820%201849">+1 216 820 1849</a> — mobile <a href="mailto:gapinski@nasa.gov">gapinski@nasa.gov</a> <o:p></o:p></address> </div> </blockquote> <o:p> </o:p> <div> -- <o:p></o:p> <address>Gary Gapinski — DB Consulting Group NASA Glenn Research Center ℡ <a href="tel:+1%20216%20433%203959">+1 216 433 3959</a> — office ℡ <a href="tel:+1%20216%20820%201849">+1 216 820 1849</a> — mobile <a href="mailto:gapinski@nasa.gov">gapinski@nasa.gov</a> <o:p></o:p></address> </div> </div> </body> </html>