shawndwells
commented
6 years ago (edited OP to add formatting of console output)
Closed boydhako closed 2 years ago
shawndwells
commented
6 years ago (edited OP to add formatting of console output)
shawndwells
commented
6 years ago Running a basic scan does not generate a core dump. Using:
oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-2_Sensitive ./U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.xmlHowever when using all the flags from the OP, I get the exact same results:
$ oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-2_Sensitive --results oscap-results-xccdf.xml --stig-viewer oscap-results-xccdf-stig-viewer.xml --oval-results --check-engine-results --fetch-remote-resources --verbose-log-file oscap-xccdf-eval-$(date +%F_%H%M%S).log --verbose DEVEL ./U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.xml
.............
..........
Title The system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
Rule xccdf_mil.disa.stig_rule_SV-87827r3_rule
Ident CCE-80158-9
Ident CCI-000366
Result fail
Segmentation fault (core dumped)after running scans, incrementally adding all the various flags, the core dump only happens when --stig-viewer is used.
e.g.
oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-2_Sensitive --stig-viewer oscap-results-xccdf-stig-viewer.xml ./U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.xml@boydhako if you're able, because this effects OpenSCAP in RHEL, would you consider opening a formal support case? In reality the issue will be worked on by the same people anyway, but a formal support case carries Red Hat-backed SLAs and helps engineers justify/document why they're spending time on this.
Here's the link: https://access.redhat.com/support/cases/#/case/new
boydhako
commented
6 years ago CASE 02164600 created as requested. Kind of really need the STIG Viewer thing to work to switch off of depending on the SPAWAR SCC.
boydhako
commented
6 years ago Sorry... Fat fingers...
jan-cerny
commented
6 years ago Hi @boydhako,
Thank you very much for reporting your problem.
It seems to me that DISA STIG content has changed its format. The --stig-viewer option relies on having a <reference> element with href attribute set to "http://iase.disa.mil/stigs/Pages/stig-viewing-guidance.aspx". See the relevant section in OpenSCAP User manual for more details: https://github.com/OpenSCAP/openscap/blob/maint-1.2/docs/manual/manual.adoc#235-result-stig-viewer
But there is no such URL in content at https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.zip
I think the assumptions about the DISA STIG content are not valid anymore and therefore the --stig-viewer feature needs to be reworked completely.
The segmentation fault is caused by a null pointer deference at
https://github.com/OpenSCAP/openscap/blob/afd18c1e5ffdc6ade20ab56701c84a8507e1a721/src/XCCDF/result.c#L1099 , where oscap_reference_get_href(ref) retures NULL because the file contains reference elements without href attribute.
EDIT: Note for investigation: See https://github.com/OpenSCAP/openscap/pull/894 for implementation details.
jan-cerny
commented
6 years ago On the other hand, our SCAP Security guide contains those elements.
boydhako
commented
6 years ago Yeah, the DISA XCCDF format changed recently. Rumor has it that it was changed to be more compliant with the open standard. Emphasis on "more". The STIG viewer and stuff still go by the Vulnerability IDs instead of the other stuff in the results and reports.
matusmarhefka
commented
6 years ago Hello, please try the following:
Scan your machine using oscap tool and use rhel7 datastream file from scap-security-guide package:
# oscap xccdf eval --profile stig-rhel7-disa --stig-viewer results-stig.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xmlOpen DISA STIG Viewer (DSV), you might first need to configure java not to use openjdk, run:
alternatives --config javaand select the java binary from oracle. Then in DSV select File -> Import STIG and choose the .zip file you downloaded from DISA: https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.zip
Then in DSV, in STIGs table select the "RHEL7 security implementation guide" and create a checklist by selecting Checklist -> Create Checklist - this will open a new tab for you in DSV.
In new checklist tab, select Import -> XCCDF Results File and select the results-stig.xml file which you have generated in the first step using oscap tool.
You should see the results of the scan in DSV.
shawndwells
commented
6 years ago +cc @tbrunell: any chance you're aware of DISA's specification roadmap? Having insight could mean getting ahead of tools breaking in RHEL (or at least documenting what versions are interoperable).
tedbrunell
commented
6 years ago @shawndwells I am not aware of any specification changes, but I will request that they keep the project aware of any changes.
jmackani
commented
6 years ago According to the XCCDF schema the min occurs for the references is 0. Did we have a previous agreement that we would always provide this field from the DISA? I do not see this reference to the best of my knowledge being used in other xccdf by DISA unless it was specific to RHEL7.
On Mon, Aug 20, 2018 at 11:34 AM, tedbrunell notifications@github.com wrote:
@shawndwells https://github.com/shawndwells I am not aware of any specification changes, but I will request that they keep the project aware of any changes.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/OpenSCAP/scap-security-guide/issues/3207#issuecomment-414360802, or mute the thread https://github.com/notifications/unsubscribe-auth/AKA2v7eHhsdDCP4FCgF7XISp89Y0JIA6ks5uStbsgaJpZM4WCUih .
boydhako
commented
6 years ago @tedbrunell @shawndwells They moved to using SCAP 1.2 Content about a few months ago using some NVD schema.
https://scap.nist.gov/specifications/xccdf/#resource-1.2 https://scap.nist.gov/revision/1.2/index.html https://scap.nist.gov/events/2011/itsac/presentations/day3/Halbardier%20-%20SCAP%201.2%20Data%20Model.pdf
@matusmarhefka Thanks. But, I can see the stuff using the obligatory trusted SPAWAR SCC scanner. I'm trying to setup OpenSCAP for remediation/fixes based off of the DISA STIG XCCDF.
jan-cerny
commented
6 years ago I have looked into this further. I think we are mixing multiple things together. I'm sorry for the initial confusion. Correct me if I'm wrong but here is what I think:
When we implemented --stig-viewer feature in OpenSCAP in October 2017 we have used this content from DISA: https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R3_STIG.zip
which we got from: https://iase.disa.mil/stigs/os/unix-linux/Pages/index.aspx
This content is just XCCDF 1.1, there is no OVAL. (There is an updated version, but it is still the same format).
Since there was no OVAL in that content, the expected workflow was to:
scap-security-guide package and export results using --stig-viewerWhich is basically the workflow described by @matusmarhefka in on of the previous posts here. That means int was never meant to run OpenSCAP on their file from the aforementioned zip.
I was wrong in my previous reply, because there is no <reference> element with href attribute set to "http://iase.disa.mil/stigs/Pages/stig-viewing-guidance.aspx" in the aforementioned zip by DISA. That element is always only in content in scap-security-guide package. AFAIK, in SCAP Security Guide we have a mapping from our rule IDs to their IDs which are populated to the <reference> element.
The new content from DISA used by @boydhako https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.zip can be found at different place on DISA website. https://iase.disa.mil/stigs/scap/Pages/index.aspx . It is very different from the previous one. It's a SCAP 1.2 datastream. And it contains OVALs, which means it is normally usable for scanning by OpenSCAP.
So I think it's expected to run OpenSCAP scan on that content directly and see the results in STIG viewer. (No exporting using special options).
However, if I remember it well, STIG Viewer didn't support standard XCCDF results, it wanted a document with TestResults as a root element. That needs to be checked if it's still the case. Also, we need to check if it still expects the rule IDs without prefix. If those limitations of STIG Viewer are still valid, we need to implement another output option to enable the import into STIG Viewer.
@matusmarhefka Could you check if it's possible to use the XCCDF results directly? If not, wouldn't it be enough to just extract the TestResults element from XCCDF results?
@tedbrunell @shawndwells I'm confused that there are 2 different STIGs for RHEL7 on DISA website at 2 different places:
Both of them have the same release date. The version is confusing here. Could you please clarify which of these 2 pages is the right page? Which content is expected to be used by users? Which of them is supposed to be used with STIG Viewer?
jmackani
commented
6 years ago Option 1 is to be used by tools for automation. Option two is only meant for manually reviewing a system. In the early days, xccdf did not have a test type for ocil. So we had to separate the files for people who were only needing to read and secure a system manually which is option two.
Sent from my iPad
On Aug 21, 2018, at 3:36 AM, Jan Černý notifications@github.com wrote:
I have looked into this further. I think we are mixing multiple things together. I'm sorry for the initial confusion. Correct me if I'm wrong but here is what I think:
When we implemented --stig-viewer feature in OpenSCAP in October 2017 we have used this content from DISA: https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R3_STIG.zip which we got from: https://iase.disa.mil/stigs/os/unix-linux/Pages/index.aspx This content is just XCCDF 1.1, there is no OVAL. (There is an updated version, but it is still the same format).
Since there was no OVAL in that content, the expected workflow was to:
perform a scan using OpenSCAP using content from scap-security-guide package and export results using --stig-viewer open the file from the aforementioned zip by DISA in STIG VIewer import the results generated by OpenSCAP in (1) to STIG VIewer Which is basically the workflow described by @matusmarhefka in on of the previous posts here. That means int was never meant to run OpenSCAP on their file from the aforementioned zip.
I was wrong in my previous reply, because there is no
element with href attribute set to "http://iase.disa.mil/stigs/Pages/stig-viewing-guidance.aspx" in the aforementioned zip by DISA. That element is always only in content in scap-security-guide package. AFAIK, in SCAP Security Guide we have a mapping from our rule IDs to their IDs which are populated to the element. The new content from DISA used by @boydhako https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.zip can be found at different place on DISA website. https://iase.disa.mil/stigs/scap/Pages/index.aspx . It is very different from the previous one. It's a SCAP 1.2 datastream. And it contains OVALs, which means it is normally usable for scanning by OpenSCAP.
So I think it's expected to run OpenSCAP scan on that content directly and see the results in STIG viewer. (No exporting using special options). However, if I remember it well, STIG Viewer didn't support standard XCCDF results, it wanted a document with TestResults as a root element. That needs to be checked if it's still the case. Also, we need to check if it still expects the rule IDs without prefix. If those limitations of STIG Viewer are still valid, we need to implement another output option to enable the import into STIG Viewer. @matusmarhefka Could you check if it's possible to use the XCCDF results directly? If not, wouldn't it be enough to just extract the TestResults element from XCCDF results?
@tedbrunell @shawndwells I'm confused that there are 2 different STIGs for RHEL7 on DISA website at 2 different places:
https://iase.disa.mil/stigs/scap/Pages/index.aspx which provides SCAP 1.2 Datastream https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.zip https://iase.disa.mil/stigs/os/unix-linux/Pages/index.aspx which provides XCCDF only: https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R4_STIG.zip which then has to be used together with SSG. Both of them have the same release date. The version is confusing here. Could you please clarify which of these 2 pages is the right page? Which content is expected to be used by users? Which of them is supposed to be used with STIG Viewer?
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
shawndwells
commented
6 years ago @jan-cerny both would be expected for use with STIG Viewer
shawndwells
commented
6 years ago two different uses like @jmackani shared
boydhako
commented
6 years ago @jan-cerny @jmackani @shawndwells Note that the file names one has Benchmark. The benchmark one is normally used with the SPAWAR SCC since it somehow contains the means of doing the "checks" for the finds. The one that doesn't have the benchmark in the name doesn't really check the newly added items. In short the Benchmark has more info and does more and the other is like a documented checklist.
The scanning does work using the DISA XCCDF. However, the output doesn't match the STIG viewer since it notes findings by the Vulnerability ID (V-XXXXX). I was under the impression that the --stig-viewer option would output the results file using the VID association instead of the CCE and CCI references.
If possible, I recommend seeing if "Red Hat" can get a copy of the new SCC scanner. You kind of need PKI access to download it.
https://powhatan.iiie.disa.mil/stigs/downloads/zip/scc-5.0.2_rhel7_x86_64_bundle.zip
jan-cerny
commented
6 years ago --stig-viewer option is supposed to work with SCAP Security Guide DSs, which contains <reference> elements
jmackani
commented
6 years ago On August 22, 2018 at 4:09 AM Jan Černý notifications@github.com wrote:
--stig-viewer option is supposed to work with SCAP Security Guide DSs, which contains <reference> elements — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/OpenSCAP/scap-security-guide/issues/3207#issuecomment-414949070 , or mute the thread https://github.com/notifications/unsubscribe-auth/AKA2v-OaD8jRCVfaQvfQ6SzYyJeEcgQHks5uTRGdgaJpZM4WCUih .
The DISA STIG Viewer can ingest regular SCAP 1.2/XCCDF 1.2 Results files. It has had the capability since version 2.6, released almost a year ago. OpenSCAP does not need a special XCCDF export format.
jan-cerny
commented
6 years ago Thank @jmackani for clarification.
@boydhako Do you use STIG VIewer >= 2.6? If yes, does using --result instead of --stig-viewer work for you with the STIG Viewer?
mpreisler
commented
6 years ago @jmackani Thank you for your input. Could you please refer the exact version and release changelog? I want to verify and include it in our docs that you only need this option if you are using the old STIG Viewer.
boydhako
commented
6 years ago @jan-cerny Sorry for the delay. Got busy manually STIG checking stuff.
Okay, so yes just doing the --results does work with the STIG Viewer.
However... I might need some guidance on how oscap is supposed to work to get the remediation scripts. Because the Results file literally lists all the STIGs in the STIG viewer; not just the open ones. I tried doing the oscap xccdf generate fix thing using the Results file and it lists all the STIGSs as well.
Attached are the files I got from it.
jamescassell
commented
5 years ago Hello,
I've reproduced this issue. I'd guess the issue is actually with the openscap tool.
With the ssg content, I'm able to successfully run oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig-rhel7-disa --stig-viewer results.xml scap-security-guide-0.1.43/ssg-rhel7-ds.xml
I'm then able to import that into the STIG Viewer.
However, when I substitute the profile and file for the DISA IASE-provided benchmark file using
oscap xccdf eval xccdf_mil.disa.stig_profile_MAC-1_Classified --stig-viewer results.xml U_Red_Hat_Enterprise_Linux_7_V2R2_STIG_SCAP_1-2_Benchmark.xml, I get a segfault at the end:
[ 648.535392] oscap[6584]: segfault at 0 ip 00007ff7b7bd8ba0 sp 00007ffd0dd99430 error 4 in libopenscap.so.8.14.1[7ff7b7b1b000+112000]
E: probe_sysctl: An error ocured while receiving SEAP message. errno=103, Software caused connection abort.
Segmentation faultI get a successful result with the DISA benchmark using: oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-1_Classified --results results.xml U_Red_Hat_Enterprise_Linux_7_V2R2_STIG_SCAP_1-2_Benchmark.xml
The segfault is a bug, but otherwise it seems there should be a warning that says "use --results rather than --stig-viewer when using DISA content"
This is on RHEL 7.6 latest.
marcusburghardt
commented
2 years ago I agree this is related to the scanner and not to the content. There is already an issue reported in the OpenSCAP project: https://github.com/OpenSCAP/openscap/issues/1613 I am closing this issue here and recommend any follow up in the mentioned issue.
Description of problem:
Using the OSCAP command results in a segmentation fault with using DISA IASE XCCDF benchmark.
SCAP Security Guide Version:
Steps to Reproduce:
Extract XCCDF from DISA IASE for RHEL7; https://iasecontent.disa.mil/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.zip
Run
oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-2_Sensitive --results oscap-results-xccdf.xml --stig-viewer oscap-results-xccdf-stig-viewer.xml --oval-results --check-engine-results --fetch-remote-resources --verbose-log-file oscap-xccdf-eval-$(date +%F_%H%M%S).log --verbose DEVEL ./U_Red_Hat_Enterprise_Linux_7_V1R2_STIG_SCAP_1-2_Benchmark.xmlActual Results:
Last output before seg fault dump
Title The system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages. Rule xccdf_mil.disa.stig_rule_SV-87827r3_rule Ident CCE-80158-9 Ident CCI-000366 Result pass
Segmentation fault (core dumped)
Expected Results:
... not a segmentation fault ...
Addition Information/Debugging Steps: