>From d8fd6e4285b99ca60ea511f9904b603e842f55a0 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 17 Mar 2012 19:28:27 -0400 Subject: [PATCH 3/3] Updated Makefile to backout directory breakouts --- rhel6/src/Makefile | 14 +++++++------- rhel6/src/output/README | 15 ++++++--------- rhel6/src/transforms/shorthand2xccdf.xslt | 2 +- 3 files changed, 14 insertions(+), 17 deletions(-) diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile index 792e887..74b1934 100644 --- a/rhel6/src/Makefile +++ b/rhel6/src/Makefile @@ -2,14 +2,14 @@ IN=input OUT=output TRANS=transforms REFS=references -XCCDF_OUTPUT_DIR=${OUT}/XCCDF -XCCDF_OUTPUT_SHORT=XCCDF +XCCDF_OUTPUT_DIR=${OUT} +XCCDF_OUTPUT_SHORT=${OUT} ## NOTE: The location of the OVAL file is also coded into the ## shorthand2xccdf.xslt file. If you change the OVAL_OUTPUT_DIR, ## make sure you also change the "ovalfile" variable in ## transforms/shorthand2xccdf.xslt. -OVAL_OUTPUT_DIR=${OUT}/OVAL +OVAL_OUTPUT_DIR=${XCCDF_OUTPUT_DIR} HTML_OUTPUT_DIR=${OUT}/HTML POLICYMAPPING_OUTPUT_DIR=${OUT}/PolicyMappings @@ -25,7 +25,7 @@ shorthand2xccdf: xmllint --format --output ${XCCDF_OUTPUT_DIR}/rhel6-xccdf.xml ${XCCDF_OUTPUT_DIR}/rhel6-xccdf.xml checks: - mkdir ${OVAL_OUTPUT_DIR} +# mkdir ${OVAL_OUTPUT_DIR} xmlwf ${IN}/checks/*.xml ${TRANS}/combinechecks.py ${IN}/checks > ${OVAL_OUTPUT_DIR}/rhel6-oval.xml xmllint --format --output ${OVAL_OUTPUT_DIR}/rhel6-oval.xml ${OVAL_OUTPUT_DIR}/rhel6-oval.xml @@ -59,9 +59,9 @@ table-refs: shorthand-guide shorthand2xccdf xsltproc --html -o ${POLICYMAPPING_OUTPUT_DIR}/rhel6-table-nistrefs-delim-sorted.html ${TRANS}/table-sortbyref.xslt ${POLICYMAPPING_OUTPUT_DIR}/rhel6-table-nistrefs-delim.html content: shorthand-guide shorthand2xccdf checks - ${TRANS}/relabelids.py ${XCCDF_OUTPUT_SHORT}/rhel6-xccdf.xml scap-security-guide -# the script chdirs to ./output, so refer to files from there. +# the relabelids.py script chdirs to ./output, so refer to files from there. # this creates rhel6-xccdf-scap-security-guide.xml and rhel6-oval-scap-security-guide.xml + ${TRANS}/relabelids.py rhel6-xccdf.xml scap-security-guide rm ${OUT}/*.ini validate: @@ -78,4 +78,4 @@ eval-common: oscap xccdf eval --profile common --results /tmp/results-test.xml ${XCCDF_OUTPUT_DIR}/rhel6-xccdf-scap-security-guide.xml clean: - rm -rf ${XCCDF_OUTPUT_DIR}/ ${POLICYMAPPING_OUTPUT_DIR}/ ${HTML_OUTPUT_DIR}/ ${OVAL_OUTPUT_DIR}/ + rm -rf ${POLICYMAPPING_OUTPUT_DIR}/ ${HTML_OUTPUT_DIR}/ ${OUT}/*.xml diff --git a/rhel6/src/output/README b/rhel6/src/output/README index 1249f2a..851980f 100644 --- a/rhel6/src/output/README +++ b/rhel6/src/output/README @@ -3,22 +3,19 @@ Welcome to the scap-security-guide! ========= OVERVIEW ========= -The scap-security-guide project, or SSH for short, aims to deliver security guidance, baselines, and associated validation mechanisms for Red Hat Enterprise Linux. We utilize the Security Content Automation Protocol (SCAP) to accomplish this, with specific aims to be fully compliant with SCAP Version 1.1. The SSG homepage is https://fedorahosted.org/scap-security-guide/, where you can find the latest versions, documentation, and any FAQs. +The scap-security-guide project, or SSG for short, aims to deliver security guidance, baselines, and associated validation mechanisms for Red Hat Enterprise Linux. We utilize the Security Content Automation Protocol (SCAP) to accomplish this, with specific aims to be fully compliant with SCAP Version 1.1. The SSG homepage is https://fedorahosted.org/scap-security-guide/, where you can find the latest versions, documentation, a mailing list, and FAQs. As part of this project you'll find the following content: -(1) HTML/ -This directory contains our human readable prose guides in HTML format. You can view these guides in a standard web browser and they contain practical, actionable information for system administrators. These guides not only list out the security recommendations, but also contain reasoning and a mapping back to a U.S. Government security policy where applicable. This should be your starting point to understand the content that the SSG ships. +(1) scap-security-guide/ +Under the parent directory you will find a number of XML files which represent our XCCDF and OVAL content. These are machine readable formats of the SCAP Security Guide which can be used in your security compliance tool of choice (oscap, FirstAidKit, etc). -(2) OVAL/ -System configuration recommendations in the SSG are paired with an OVAL check script that can scan your system to ensure compliance. These scripts do NOT make any changes to your system, they merely validate system compliance. +(2) HTML/ +This directory contains our human readable prose guides in HTML format. You can view these guides in a standard web browser and they contain practical, actionable information for system administrators. These guides not only list out the security recommendations, but also contain reasoning and a mapping back to a U.S. Government security policy where applicable. This should be your starting point to understand the content that the SSG ships. (3) PolicyMappings/ In reviewing feedback from the user community it quickly became apparent that having a table which maps SSG recommendations back to U.S. Government policies would be incredibly helpful. Within the PolicyMappings/ directory you will find tables which link SSG recommendations back to U.S. Government policies, such as NIST 800-53 and DCID 6/3. -(4) XCCDF -While humans can review the content in the HTML/ directory, it's non-trivial to translate that HTML back to machine readable formats. We've selected the XCCDF content standard to provide a machine readable version of our prose guide, of which can be imported into security scanning tools (secstate, FirstAidKit, oscap, etc). By providing content in the XCCDF standard we offer you the choice of using any XCCDF compliant scanning tool you wish. - Project Homepage: https://fedorahosted.org/scap-security-guide/ Project Mailing List: https://fedorahosted.org/mailman/listinfo/scap-security-guide @@ -27,7 +24,7 @@ Project Mailing List: https://fedorahosted.org/mailman/listinfo/scap-security-gu ========= USAGE ========= To run a scan against the included "Generic Server" profile, run the following command: -$ oscap xccdf eval --profile server XCCDF/rhel6-xccdf-scap-security-guide.xml +$ oscap xccdf eval --profile server rhel6-xccdf-scap-security-guide.xml You will receive output displayed to your console indicating which checks your system has passed (or failed), simular to the output below: Rule ID: xwindows_remote_listening diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt b/rhel6/src/transforms/shorthand2xccdf.xslt index 090d757..d870828 100644 --- a/rhel6/src/transforms/shorthand2xccdf.xslt +++ b/rhel6/src/transforms/shorthand2xccdf.xslt @@ -7,7 +7,7 @@ exclude-result-prefixes="xccdf"> oval:org.scap-security-guide.rhel:def: -OVAL/rhel6-oval.xml +rhel6-oval.xml -- 1.7.1