From: "David Smith" <dsmith(a)secure-innovations.net&gt; To: scap-security-guide(a)lists.fedorahosted.org Sent: Friday, June 27, 2014 6:37:14 PM Subject: [PATCH] Added vsftpd OVAL check and modified packages_installed.csv file

Signed-off-by: David Smith <dsmith(a)secure-innovations.net&gt; --- RHEL/6/input/checks/package_vsftpd_installed.xml | 26 ++++++++++++++++++++ .../input/checks/templates/packages_installed.csv | 1 + 2 files changed, 27 insertions(+), 0 deletions(-) create mode 100644 RHEL/6/input/checks/package_vsftpd_installed.xml diff --git a/RHEL/6/input/checks/package_vsftpd_installed.xml b/RHEL/6/input/checks/package_vsftpd_installed.xml new file mode 100644 index 0000000..e4153a1 --- /dev/null +++ b/RHEL/6/input/checks/package_vsftpd_installed.xml @@ -0,0 +1,26 @@ +<def-group> + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. --> + <definition class="compliance" id="package_vsftpd_installed" + version="1"> + <metadata> + <title>Package vsftpd Installed</title> + <affected family="unix"> + <platform>Red Hat Enterprise Linux 6</platform> + </affected> + <description>The RPM package vsftpd should be installed.</description> + <reference source="swells" ref_id="20130829" ref_url="test_attestation"/> + </metadata> + <criteria> + <criterion comment="package vsftpd is installed" + test_ref="test_package_vsftpd_installed" /> + </criteria> + </definition> + <linux:rpminfo_test check="all" check_existence="all_exist" + id="test_package_vsftpd_installed" version="1" + comment="package vsftpd is installed"> + <linux:object object_ref="obj_package_vsftpd_installed" /> + </linux:rpminfo_test> + <linux:rpminfo_object id="obj_package_vsftpd_installed" version="1"> + <linux:name>vsftpd</linux:name> + </linux:rpminfo_object> +</def-group> diff --git a/RHEL/6/input/checks/templates/packages_installed.csv b/RHEL/6/input/checks/templates/packages_installed.csv index ef6e737..dc0ae21 100644 --- a/RHEL/6/input/checks/templates/packages_installed.csv +++ b/RHEL/6/input/checks/templates/packages_installed.csv @@ -13,3 +13,4 @@ postfix psacct rsyslog screen +vsftpd -- 1.7.1 -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide https://github.com/OpenSCAP/scap-security-guide/

From: "David Smith" <dsmith(a)secure-innovations.net&gt; To: "SCAP Security Guide" <scap-security-guide(a)lists.fedorahosted.org&gt; Sent: Friday, June 27, 2014 8:21:20 PM Subject: Re: [PATCH] Added vsftpd OVAL check and modified packages_installed.csv file Jan, I may be missing something, then. The 'install_vsftpd' rule was flagged by 'make validate', and I was unable to locate the OVAL referenced in the XCCDF - in either the RHEL/6 or shared/oval directories. Here's my verification/sanity check of this from just a second ago: [root@localhost checks]# git pull Already up-to-date. [root@localhost checks]# ls | grep package_vsftpd ; file package_vsftpd_installed.xml package_vsftpd_installed.xml package_vsftpd_removed.xml package_vsftpd_installed.xml: ASCII HTML document text [root@localhost checks]# ls ../../../../shared/oval/package_ package_aide_installed.xml package_ntp_installed.xml package_openssh-server_removed.xml [root@localhost checks]# ls ../../../../shared/oval/package_

Dave On Fri, Jun 27, 2014 at 1:06 PM, Jan Lieskovsky < jlieskov(a)redhat.com > wrote: Hello David, ----- Original Message ----- > From: "David Smith" < dsmith(a)secure-innovations.net > > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Friday, June 27, 2014 6:37:14 PM > Subject: [PATCH] Added vsftpd OVAL check and modified > packages_installed.csv file Just wondering, what's the motivation behind adding this check? If I am not wrong, the package_vsftpd_installed.xml in RHEL/6 is used from shared/oval directory: scap-security-guide]$ file RHEL/6/input/checks/package_vsftpd_installed.xml RHEL/6/input/checks/package_vsftpd_installed.xml: symbolic link to `../../../../shared/oval/package_vsftpd_installed.xml' So the corresponding XCCDF definition should work without issues. If not, the problem should be fixed (but the rules which can be shared we would like to keep in the /shared directory). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > > > Signed-off-by: David Smith < dsmith(a)secure-innovations.net > > --- > RHEL/6/input/checks/package_vsftpd_installed.xml | 26 > ++++++++++++++++++++ > .../input/checks/templates/packages_installed.csv | 1 + > 2 files changed, 27 insertions(+), 0 deletions(-) > create mode 100644 RHEL/6/input/checks/package_vsftpd_installed.xml > > diff --git a/RHEL/6/input/checks/package_vsftpd_installed.xml > b/RHEL/6/input/checks/package_vsftpd_installed.xml > new file mode 100644 > index 0000000..e4153a1 > --- /dev/null > +++ b/RHEL/6/input/checks/package_vsftpd_installed.xml > @@ -0,0 +1,26 @@ > +<def-group> > + <!-- THIS FILE IS GENERATED by create_package_installed.py. DO NOT EDIT. > --> > + <definition class="compliance" id="package_vsftpd_installed" > + version="1"> > + <metadata> > + <title>Package vsftpd Installed</title> > + <affected family="unix"> > + <platform>Red Hat Enterprise Linux 6</platform> > + </affected> > + <description>The RPM package vsftpd should be installed.</description> > + <reference source="swells" ref_id="20130829" > ref_url="test_attestation"/> > + </metadata> > + <criteria> > + <criterion comment="package vsftpd is installed" > + test_ref="test_package_vsftpd_installed" /> > + </criteria> > + </definition> > + <linux:rpminfo_test check="all" check_existence="all_exist" > + id="test_package_vsftpd_installed" version="1" > + comment="package vsftpd is installed"> > + <linux:object object_ref="obj_package_vsftpd_installed" /> > + </linux:rpminfo_test> > + <linux:rpminfo_object id="obj_package_vsftpd_installed" version="1"> > + <linux:name>vsftpd</linux:name> > + </linux:rpminfo_object> > +</def-group> > diff --git a/RHEL/6/input/checks/templates/packages_installed.csv > b/RHEL/6/input/checks/templates/packages_installed.csv > index ef6e737..dc0ae21 100644 > --- a/RHEL/6/input/checks/templates/packages_installed.csv > +++ b/RHEL/6/input/checks/templates/packages_installed.csv > @@ -13,3 +13,4 @@ postfix > psacct > rsyslog > screen > +vsftpd > -- > 1.7.1 > > -- > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/ -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide https://github.com/OpenSCAP/scap-security-guide/ -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide https://github.com/OpenSCAP/scap-security-guide/