8:22 a.m.
Shawn,
First, if SCC 3.02 from DISA is installed via rpm (requires PKI CAC), the
documentation is in /opt/scc/documentation. There is a cscc-Readme.txt and
a SCC_UserManual_RHEL.pdf.
I have been using the GUI SCC version of it, however, I just ran ./cscc,
and it also works, however I had already done my configuration through the
GUIĀ
1. ZIP ssg-rhel6-cpe-dictionary.xml ssg-rhel6-cpe-oval.xml
ssg-hel6-oval.xml ssg-rhel6-xccdf.xml
2. Start SCC (hopefully you have X windows installed). cd /opt/scc then
./scc (yea I am root - and it does not work from gnome menu).
3. SCAP Compliance Checker opens. Select Edit -> Check SCAP Analysis and
then select SCAP Content. SCAP Content window opens.
4. Uncheck the RHEL5 content. Click on the Add (top left button), select
your ZIP file from step 1, open. Now it is imported (BTW it places it in
/opt/scc/resources/content)
5. Select/Check ssg-rhel6, then click on the "test" profile to change it
to server, stig-server or what ever. Select OK. (test is the first
profile, that is why it gets used initially)
6. Select Local Computer (if local) and select Analyze Selected Computers.
7. Once it runs, Select Results from the Menu -> Recent Reports ->
yourReport to view it in html.
(note- if you run the stig-server option, it will hang at the end trying
to generate the reports (due to size?), however "server" profile does run
to finish. I can monitor the
/opt/scc/Results/SCAP/mybox/ssg-rhel6/0.1/dateofscan/xxx.htm for the
reports to finish and then Cancel Analysis in the SCC GUI.)
The cscc-Readme goes into how to import content and configure the
/opt/scc/options.xml, but again I have not gotten into that much and
probably won't now I have OpenSCAP working.
I just did a compare between OpenScap results vs. SCC3.02 results using
SSG content. Significant differences. Using the SSG with OpenSCAP is
nearly complete, whereas using it with SSC many of the checks are not run
(Not Selected SSC=216 OpenSCAP=179, Not Checked SSC=28 OpenSCAP=26) .
Things that passed with SCC (for example pam_cracklib.so retry, dcredit,
ucredit, ocredit, lcredit, and on are passing), but with OpenSCAP and SGG
content, they are failing. Not sure why yet of course.
Hopefully this is helpfully and you can run SCC using your content AND
hopefully SPAWAR is paying attention and will update their SCC tool to run
the SGG content!
Very Respectfully,
Brian
On 11/1/12 10:56 PM, "Shawn Wells" <shawn(a)redhat.com> wrote:
On 11/1/12 6:43 PM, Brian Peake wrote:
> Shawn,
> I just checked the DISA website for SCC 3.02 and there is
> documentation avail in PDF. Unfortunately, it is PKI (CAC) required to
> download. Because of this, I cannot send to you.
>
> However, I'll type up a quick howto to run your content with SCC tool
> tomorrow AM. Send to you or post on the list?
I have a copy of SCC but haven't been able to make it work yet. Tried
manually editing the options.xml file, creating a zip.... clearly I'm
doing something wrong. Sending out your notes would be incredibly
helpful and could lay the foundation for us documenting how the RHEL6
STIG & SSG can be used with SCC; please feel free to post to the list as
it's very on topic.
> Key piece is to zip the SSG content (the 4 XML files) and then use the
> SCC tool to import it. Click on the "test" profile to change it to
> server etc... After that I can select analyze and it gives me the
> results in HTML format and XML.
>
> I will be playing tomorrow and will compare results between using SCC
> and OpenSCAP with SSG content to see if they agree etc...
That'd be incredibly helpful, thank you!
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide