<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">I can look but if your oxygen will run out before 48 hours you may wish to order out for extra. </div> <div class="moz-cite-prefix"> </div> <div class="moz-cite-prefix"> </div> <div class="moz-cite-prefix">On 2/4/19 11:05 AM, Boucher, William wrote: </div> <blockquote type="cite" cite="mid:4634fbf2a19346ee8bed6e2fbededf47@ABQ-Ex01.mza.lan"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> <div class="WordSection1"> Gary,<o:p></o:p> <o:p> </o:p> Is anybody looking at this on the development side (determining why so many rules end up nonapplicable and if the passes and fails are the result of an accurate evaluation)?<o:p></o:p> <o:p> </o:p> Thanks,<o:p></o:p> <o:p> </o:p> --Bill<o:p></o:p> <o:p> </o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com" moz-do-not-send="true">william.boucher@mza.com</a><o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a class="moz-txt-link-abbreviated" href="mailto:open-scap-list-bounces@redhat.com">open-scap-list-bounces@redhat.com</a> [<a class="moz-txt-link-freetext" href="mailto:open-scap-list-bounces@redhat.com">mailto:open-scap-list-bounces@redhat.com</a>] On Behalf Of Boucher, William Sent: Monday, February 4, 2019 9:04 AM To: Gary Gapinski <a class="moz-txt-link-rfc2396E" href="mailto:gapinski@nasa.gov"><gapinski@nasa.gov></a> Cc: <a class="moz-txt-link-abbreviated" href="mailto:open-scap-list@redhat.com">open-scap-list@redhat.com</a> Subject: Re: [Open-scap] Benchmark for Canonical Ubuntu 16.04 LTS<o:p></o:p> </div> </div> <o:p> </o:p> Gary,<o:p></o:p> <o:p> </o:p> Similar results with Ububtu 16.04. Not all results were notapplicable, score was given as 25%.<o:p></o:p> <o:p> </o:p> After building openscap and ComplianceAsCode/content I ran:<o:p></o:p> <o:p> </o:p> sudo oscap xccdf eval –profile standard –results ./xccdf-results.xml –cpe /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-cpe-dictionary.xml /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml<o:p></o:p> <o:p> </o:p> sudo oscap oval eval –results ./oval-results.xml /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-oval.xml<o:p></o:p> <o:p> </o:p> sudo oscap xccdf generate report –oval-template ./oval-results.xml ./xccdf-results.xml > ./report-xccdf-oval.html<o:p></o:p> <o:p> </o:p> 15 rules passed, 6 inconclusive (unknown) and all the rest (24) notapplicable.<o:p></o:p> <o:p> </o:p> Running:<o:p></o:p> <o:p> </o:p> sudo oscap xccdf eval –profile standard –results-arf ./results-arf.xml –report ./report-ds.html –results ./results-ds.xml /usr/local/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml<o:p></o:p> <o:p> </o:p> produced the same numbers in the ds-generated report.<o:p></o:p> <o:p> </o:p> I see the value in using the data stream. But the “notapplicable” items are largely applicable and should be evaluated.<o:p></o:p> <o:p> </o:p> --Bill<o:p></o:p> <o:p> </o:p> <div> William B. Boucher, BSEE<o:p></o:p> Embedded Systems Software Engineer Information Systems Security Manager<o:p></o:p> MZA Associates Corporation<o:p></o:p> 4900 Lang Ave. NE, Suite 100<o:p></o:p> Albuquerque, NM 87109-9708<o:p></o:p> Phone: 505.245.9970 x166<o:p></o:p> Fax: 505.245.9971<o:p></o:p> Cell: 505.459.7620<o:p></o:p> <a href="mailto:william.boucher@mza.com" moz-do-not-send="true">william.boucher@mza.com</a><o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Gary Gapinski [<a href="mailto:gapinski@nasa.gov" moz-do-not-send="true">mailto:gapinski@nasa.gov</a>] Sent: Friday, January 25, 2019 9:50 AM To: Boucher, William <<a href="mailto:William.Boucher@mza.com" moz-do-not-send="true">William.Boucher@mza.com</a>> Cc: <a href="mailto:open-scap-list@redhat.com" moz-do-not-send="true">open-scap-list@redhat.com</a> Subject: Re: [Open-scap] Benchmark for Canonical Ubuntu 16.04 LTS<o:p></o:p> </div> </div> <o:p> </o:p> <div> On 1/25/19 10:33 AM, Boucher, William wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Thank you, Gary! I will attempt next to duplicate your process with Ubuntu 1604.<o:p></o:p> </blockquote> I may as well but cannot guarantee timeliness.<o:p></o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> If I am building OpenSCAP over my previous install of the libopenscap8 package, do I need to remove libopenscap8 first or can I just make-install over it?<o:p></o:p> </blockquote> I place the OpenSCAP install in <tt>/usr/local</tt> and ensure it is used separately and preferentially (via <tt>$PATH</tt>) rather than the one from the distro (or just not install from the distro). I use <tt>cmake-gui ../</tt> from within the <tt> openscap/build</tt> directory and change <tt> CMAKE_INSTALL_PREFIX</tt> to <tt>/usr/local</tt> (<tt>cmake-gui,</tt> tweak, configure, generate; <tt>make</tt>; <tt>sudo make install</tt>). Installing on top of the distro version will likely cause undesirable results.<o:p></o:p> I do not typically install ComplianceAsCode but simply access the content from the cloned (and built) repo, but if you install it I think it best to choose the same installation target (e.g., <tt>/usr/local</tt>) as that of OpenSCAP.<o:p></o:p> A functional (and available) install of OpenSCAP is a pre-requisite for building ComplianceAsCode.<o:p></o:p> Regards,<o:p></o:p> Gary<o:p></o:p> <div> -- <o:p></o:p> <address>Gary Gapinski — DB Consulting Group NASA Glenn Research Center ℡ <a href="tel:+1%20216%20433%203959" moz-do-not-send="true">+1 216 433 3959</a> — office ℡ <a href="tel:+1%20216%20820%201849" moz-do-not-send="true">+1 216 820 1849</a> — mobile <a href="mailto:gapinski@nasa.gov" moz-do-not-send="true">gapinski@nasa.gov</a> <o:p></o:p></address> </div> </div> </blockquote> <div class="moz-signature">-- <title></title> <address style="font-size: smaller; text-decoration:none;" xml:lang="en">Gary Gapinski — DB Consulting Group NASA Glenn Research Center ℡ <a href="tel:+1 216 433 3959" style="text-decoration:none;">+1 216 433 3959</a> — office ℡ <a href="tel:+1 216 820 1849" style="text-decoration:none;">+1 216 820 1849</a> — mobile <a href="mailto:gapinski@nasa.gov" style="text-decoration:none;">gapinski@nasa.gov</a> </address> </div> </body> </html>