1:04 a.m.
Hi all,
as briefly mentioned already in yesterdays’ Contributor Workshop,
our customer wants to enrich the SSG content by adding references to their internal
security requirements.
I wonder how I could add my own Security Identifiers, because when trying to simply add
e.g. a „customerident“ attribute into the shorthand XCCDF as per below,
my build fails with:
[...]
xmllint --format --output output/shorthand.xml output/shorthand.xml
xsltproc --stringparam ssg_version "0.1.27" -o
output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt output/shorthand.xml
oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml
output/xccdf-unlinked-unresolved.xml
File 'output/xccdf-unlinked-unresolved.xml' line 153: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 167: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 182: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 190: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
Invalid XCCDF Checklist content(1.1) in output/xccdf-unlinked-unresolved.xml.
../../shared/product-make.include:60: recipe for target
'output/xccdf-unlinked-empty-groups.xml' failed
make: *** [output/xccdf-unlinked-empty-groups.xml] Error 1
Do I have to „register“/„declare“ the new identifier type, and if so where and how?
Example of what I'm trying to achieve:
<Rule id="sshd_allow_only_protocol2">
<title>My Title</title>
<description>My description</description>
<rationale>My rationale</rationale>
<ident cce="27072-8" customerident="1234"
stig="RHEL-06-000227"/>
<oval id="sshd_allow_only_protocol2"/>
<ref disa="776,774,1436" nist="AC-3(10),IA-5(1)(c)"/>
</Rule>
Any pointers highly appreciated :-) !
Thanks & regards
Oliver
8:24 a.m.
Hi Oliver,
It needs to be referenced in the following file:
<PROJECT>\transforms\shorthand2xccdf.xslt
Using RHEL 6 as an example, observe the following lines:
<!-- expand reference to ident types -->
<xsl:template match="Rule/ident">
<xsl:for-each select="@*">
<ident>
<xsl:choose>
<xsl:when test="name() = 'cce'">
<xsl:attribute name="system">
<xsl:value-of select="$cceuri" />
</xsl:attribute>
<xsl:choose>
<xsl:when test="starts-with(translate(., 'ce',
'CE'),
'CCE')">
<xsl:value-of select="." />
</xsl:when>
<xsl:otherwise>
<xsl:value-of select="concat('CCE-', .)" />
</xsl:otherwise>
</xsl:choose>
</xsl:when>
<xsl:when test="name() = 'stig'">
<xsl:attribute name="system">
<xsl:value-of select="$cceuri" />
</xsl:attribute>
<xsl:value-of select="." />
</xsl:when>
<xsl:otherwise>
<xsl:value-of select="." />
</xsl:otherwise>
</xsl:choose>
</ident>
</xsl:for-each>
</xsl:template>
You could add in an additional identifier 'customerid', as follows:
<xsl:when test="name() = 'customerid'">
<xsl:attribute name="system">
<xsl:value-of select="$cceuri" />
</xsl:attribute>
<xsl:value-of select="." />
</xsl:when>
Which would then look like this:
<!-- expand reference to ident types -->
<xsl:template match="Rule/ident">
<xsl:for-each select="@*">
<ident>
<xsl:choose>
<xsl:when test="name() = 'cce'">
<xsl:attribute name="system">
<xsl:value-of select="$cceuri" />
</xsl:attribute>
<xsl:choose>
<xsl:when test="starts-with(translate(., 'ce',
'CE'),
'CCE')">
<xsl:value-of select="." />
</xsl:when>
<xsl:otherwise>
<xsl:value-of select="concat('CCE-', .)" />
</xsl:otherwise>
</xsl:choose>
</xsl:when>
<xsl:when test="name() = 'stig'">
<xsl:attribute name="system">
<xsl:value-of select="$cceuri" />
</xsl:attribute>
<xsl:value-of select="." />
</xsl:when>
<xsl:when test="name() = 'customerid'">
<xsl:attribute name="system">
<xsl:value-of select="$cceuri" />
</xsl:attribute>
<xsl:value-of select="." />
</xsl:when>
<xsl:otherwise>
<xsl:value-of select="." />
</xsl:otherwise>
</xsl:choose>
</ident>
</xsl:for-each>
</xsl:template>
On Tue, 2016-01-12 at 07:04 +0000, oliver.skiebe(a)uniqpartners.com wrote:
Hi all,
as briefly mentioned already in yesterdays’ Contributor Workshop,
our customer wants to enrich the SSG content by adding references to their internal
security requirements.
I wonder how I could add my own Security Identifiers, because when trying to simply add
e.g. a „customerident“ attribute into the shorthand XCCDF as per below,
my build fails with:
[...]
xmllint --format --output output/shorthand.xml output/shorthand.xml
xsltproc --stringparam ssg_version "0.1.27" -o
output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt
output/shorthand.xml
oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml
output/xccdf-unlinked-unresolved.xml
File 'output/xccdf-unlinked-unresolved.xml' line 153: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 167: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 182: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 190: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
Invalid XCCDF Checklist content(1.1) in output/xccdf-unlinked-unresolved.xml.
../../shared/product-make.include:60: recipe for target
'output/xccdf-unlinked-empty-groups.xml' failed
make: *** [output/xccdf-unlinked-empty-groups.xml] Error 1
Do I have to „register“/„declare“ the new identifier type, and if so where and how?
Example of what I'm trying to achieve:
<Rule id="sshd_allow_only_protocol2">
<title>My Title</title>
<description>My description</description>
<rationale>My rationale</rationale>
<ident cce="27072-8" customerident="1234"
stig="RHEL-06-000227"/>
<oval id="sshd_allow_only_protocol2"/>
<ref disa="776,774,1436" nist="AC-3(10),IA-5(1)(c)"/>
</Rule>
Any pointers highly appreciated :-) !
Thanks & regards
Oliver
--
SCAP Security Guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedo...
https://github.com/OpenSCAP/scap-security-guide/
--
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com
Disclaimer
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at
2016-01-12 09:24:58 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others
authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you
are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this
information is strictly prohibited and may be unlawful.
8:25 a.m.
Hello Oliver,
thank you for checking with us.
----- Original Message -----
From: "oliver skiebe"
<oliver.skiebe(a)uniqpartners.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Tuesday, January 12, 2016 8:04:29 AM
Subject: Adding Custom "ident" Sources in shorthand XCCDFs
Hi all,
as briefly mentioned already in yesterdays’ Contributor Workshop,
our customer wants to enrich the SSG content by adding references to their
internal security requirements.
I wonder how I could add my own Security Identifiers, because when trying to
simply add e.g. a „customerident“ attribute into the shorthand XCCDF as per
below,
my build fails with:
There's a need to define "an action" for the newly / to be added
"customerident" attribute in the particular XSLT transformation
of a concrete product, e.g. should we suppose the case of
RHEL/6 product the code responsible to expanding the attribute
('cce', 'stig') values of the "ident" attribute is defined
here:
[1]
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/transf...
So in short a new code block fro 'customerident' should be added
there (of course should the customer be interested in different
product, also to 'shorthand2xccdf.xslt' transformation of that
product).
For example if the intention is to rewrite the value of
'customerident' attribute to an actual URL of the internal
document, the underlying code might look like in the similar
'pcidss' attribute case of the 'ref' attribute.
The particular patches that have added PCI-DSS support
('pcidss' attribute support for the 'ref' element) are as
follows:
[2]
https://github.com/ybznek/scap-security-guide/commit/7b6abe98b9557417f35f...
(define the new constant)
[3]
https://github.com/ybznek/scap-security-guide/commit/cb3d7c7c47aeb7be17ff...
(define the action to perform when the 'pcidssuri' reference
is provided)
So hopefully something similar could be implemented for the
<ident> element's 'customerident' attribute case?
For further information about the expected format of the
<xccdf:reference> element type, see:
[4]
http://scap.nist.gov/specifications/xccdf/xccdf_element_dictionary.html#r...
[...]
xmllint --format --output output/shorthand.xml output/shorthand.xml
xsltproc --stringparam ssg_version "0.1.27" -o
output/xccdf-unlinked-unresolved.xml transforms/shorthand2xccdf.xslt
output/shorthand.xml
oscap xccdf resolve -o output/xccdf-unlinked-empty-groups.xml
output/xccdf-unlinked-unresolved.xml
File 'output/xccdf-unlinked-unresolved.xml' line 153: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 167: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 182: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
File 'output/xccdf-unlinked-unresolved.xml' line 190: Element
'{http://checklists.nist.gov/xccdf/1.1}ident': The attribute 'system' is
required but missing.
Invalid XCCDF Checklist content(1.1) in output/xccdf-unlinked-unresolved.xml.
../../shared/product-make.include:60: recipe for target
'output/xccdf-unlinked-empty-groups.xml' failed
make: *** [output/xccdf-unlinked-empty-groups.xml] Error 1
Do I have to „register“/„declare“ the new identifier type, and if so where
and how?
See above.
Example of what I'm trying to achieve:
<Rule id="sshd_allow_only_protocol2">
<title>My Title</title>
<description>My description</description>
<rationale>My rationale</rationale>
<ident cce="27072-8" customerident="1234"
stig="RHEL-06-000227"/>
<oval id="sshd_allow_only_protocol2"/>
<ref disa="776,774,1436" nist="AC-3(10),IA-5(1)(c)"/>
</Rule>
Any pointers highly appreciated :-) !
Hope this helps. Let us know if we can be of any further assistance.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> Thanks & regards
> Oliver
> --
> SCAP Security Guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/scap-security-guide@lists.fedo...
> https://github.com/OpenSCAP/scap-security-guide/
>
3:39 p.m.
Thanks for elaborating Jan - much appreciated as well as I'm also changing the
references a bit!
Cheers
Oliver
3028
days inactive
3028
days old
scap-security-guide@lists.fedorahosted.org
4 comments
3 participants
participants (3)
-
Jan Lieskovsky -
Oliver Skiebe -
Trey Henefield