Note
This is an example report template to be used when responding to SCAP Scan results.
The following is a short example from a CentOS 7 scan. You will need to adjust all content as appropriate.
6.5.1.1. TEMPLATE - SSG Scan - EL 7 STIG¶
- Scan Date: 1/1/1970
- SIMP Version:
6.1.0-RC1 - SSG Version:
0.1.36 - Data Stream:
ssh-centos7-ds.xml - SIMP Enforcement Profile:
disa_stig
Terminology:
- Finding
- Valid issues found by the scanner
- Alternate Implementation
- Valid implementations per policy that do not match the scan
- Exception
- Items that will need to be declared as a policy exception for the stated reason
- False Positive
- Bugs in the scanner that should be reported
6.5.1.1.1. Ensure gpgcheck Enabled for Repository Metadata¶
- Rule ID:
xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata - Type: Exception
- Recommend SSG Feedback
- This should not be a
highseverity if using TLS - This opens potential vulnerabilities to all client systems
- Discussion ongoing on SSG mailing list and OpenSCAP/scap-security-guide#2455
- This should not be a
6.5.1.1.1.1. Justification¶
The way that YUM works means that all GPG keys become trusted by the entire system. Enabling repository metadata signatures globally means that RPMs will be trusted that come from any system with a trusted GPG key and may allow software to be installed on systems that does not come from the vendor.
6.5.1.1.2. Configure Periodic Execution of AIDE¶
- Rule ID:
xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking - Type: Alternate Implementation
6.5.1.1.2.1. Notes¶
We use the Puppet cron resource to add the AIDE rule to the root user’s
crontab.
6.5.1.1.2.2. System Result¶
# crontab -l
# Puppet Name: aide_schedule 5 4 *
* 0 /bin/nice -n 19 /usr/sbin/aide -C
6.5.1.1.3. Build and Test AIDE Database¶
- Rule ID:
xccdf_org.ssgproject.content_rule_aide_build_database - Type: False Positive
6.5.1.1.3.1. System Result¶
# ls /var/lib/aide/
aide.db.gz