search

mpreisler / oscap-ssh

A small bash script that allows remote oscap scanning through ssh, similar to what SCAP Workbench does.
GNU Lesser General Public License v2.1
11 stars 12 forks source link

[RFE] oscap-ssh: Add support for 'oscap oval collect' functionality #1

Closed iankko closed 9 years ago

iankko commented 9 years ago

The oscap tool allows to collect selected OVAL objects from the scanned system in question.

For example suppose the RHEL-6 package aide installed test has the OVAL test definition as:

    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg:tst:302" version="1" comment="package aide is installed">
      <linux:object object_ref="oval:ssg:obj:1575"/>
    </linux:rpminfo_test>

then it's possible to obtain / collect OVAL system characteristics by running the following command:

 oscap oval collect --id oval:ssg:obj:1575 --syschar /tmp/aide_collect.out /usr/share/xml/scap/ssg/content/ssg-rhel6-oval.xml
Collected: "oval:ssg:obj:1575" : complete

Subsequently having look at OVAL details in /tmp/aide_collect.out is a big help for OVAL content developing / debugging purposes (since it provides further OVAL entities as collected for that object / definition for the system in question).

Therefore it would be very helpful, if it would be possible to apply the same command: oscap-ssh oval collect --id id_of_the_object_to_collect --syschar path_where_to_store_the_report path_to_OVAL_definitions_file.xml

also for the oscap-ssh utility.

Thanks.

mpreisler commented 9 years ago

Thanks for your RFE.

This has been implemented as part of 6f157cdaccda1ae82b5302032c8fee1a6dddcaf2 and e9fa7e439eb76ab077c0cd4313df72e3c0c81b6e