openscap 0.4.9 → 0.5.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (51) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +7 -18
  3. data/Rakefile +2 -2
  4. data/lib/openscap/all.rb +1 -1
  5. data/lib/openscap/ds/arf.rb +3 -3
  6. data/lib/openscap/ds/sds.rb +8 -2
  7. data/lib/openscap/openscap.rb +9 -0
  8. data/lib/openscap/source.rb +10 -4
  9. data/lib/openscap/text.rb +34 -5
  10. data/lib/openscap/version.rb +1 -1
  11. data/lib/openscap/xccdf/benchmark.rb +67 -15
  12. data/lib/openscap/xccdf/fix.rb +7 -14
  13. data/lib/openscap/xccdf/fixtext.rb +19 -0
  14. data/lib/openscap/xccdf/group.rb +27 -1
  15. data/lib/openscap/xccdf/ident.rb +4 -10
  16. data/lib/openscap/xccdf/item.rb +37 -65
  17. data/lib/openscap/xccdf/item_common.rb +40 -0
  18. data/lib/openscap/xccdf/policy.rb +12 -3
  19. data/lib/openscap/xccdf/policy_model.rb +16 -15
  20. data/lib/openscap/xccdf/profile.rb +10 -10
  21. data/lib/openscap/xccdf/reference.rb +5 -21
  22. data/lib/openscap/xccdf/rule.rb +40 -20
  23. data/lib/openscap/xccdf/ruleresult.rb +5 -7
  24. data/lib/openscap/xccdf/session.rb +28 -30
  25. data/lib/openscap/xccdf/status.rb +34 -0
  26. data/lib/openscap/xccdf/tailoring.rb +7 -16
  27. data/lib/openscap/xccdf/testresult.rb +18 -28
  28. data/lib/openscap/xccdf/value.rb +1 -2
  29. data/lib/openscap/xccdf.rb +1 -1
  30. metadata +15 -48
  31. data/test/common/testcase.rb +0 -38
  32. data/test/data/arf.xml +0 -275156
  33. data/test/data/invalid.xml +0 -20
  34. data/test/data/sds-complex.xml +0 -132
  35. data/test/data/tailoring.xml +0 -31
  36. data/test/data/testresult.xml +0 -225
  37. data/test/data/xccdf.xml +0 -3046
  38. data/test/ds/arf_test.rb +0 -96
  39. data/test/ds/sds_test.rb +0 -71
  40. data/test/integration/arf_waiver_test.rb +0 -91
  41. data/test/openscap_test.rb +0 -21
  42. data/test/source_test.rb +0 -78
  43. data/test/text_test.rb +0 -19
  44. data/test/xccdf/arf_test.rb +0 -44
  45. data/test/xccdf/benchmark_test.rb +0 -115
  46. data/test/xccdf/policy_test.rb +0 -20
  47. data/test/xccdf/profile_test.rb +0 -20
  48. data/test/xccdf/session_ds_test.rb +0 -116
  49. data/test/xccdf/session_test.rb +0 -33
  50. data/test/xccdf/tailoring_test.rb +0 -30
  51. data/test/xccdf/testresult_test.rb +0 -99
data/test/data/invalid.xml DELETED
@@ -1,20 +0,0 @@
1
- <?xml version="1.0" encoding="utf-8"?>
2
- <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_second">
3
- <version>1.0</version>
4
- <status>incomplete</status>
5
- <Profile id="xccdf_moc.elpmaxe.www_profile_1">
6
- <title>is kinda compulsory</title>
7
- <select idref="xccdf_moc.elpmaxe.www_rule_second" selected="true"/>
8
- </Profile>
9
- <Profile id="xccdf_moc.elpmaxe.www_profile_2" extends="xccdf_moc.elpmaxe.www_profile_1">
10
- <title>is kinda compulsory</title>
11
- <select idref="xccdf_moc.elpmaxe.www_group_one" selected="true"/>
12
- </Profile>
13
- <Group selected="false" id="xccdf_moc.elpmaxe.www_group_one">
14
- <Rule selected="false" id="xccdf_moc.elpmaxe.www_rule_second">
15
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
16
- <check-content-ref href="stub-oval.xml"/>
17
- </check>
18
- </Rule>
19
- </Group>
20
- </Benchmark>
data/test/data/sds-complex.xml DELETED
@@ -1,132 +0,0 @@
1
- <?xml version="1.0" encoding="utf-8"?>
2
- <ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_first-xccdf.xml" schematron-version="1.2">
3
- <!-- This is bit more complex Datastream. The purpose is to test that scanner is able to find
4
- * datastream-id scap_org.open-scap_datastream_tst2
5
- * xccdf-id scap_org.open-scap_cref_second-xccdf.xml2
6
- * profile xccdf_moc.elpmaxe.www_profile_2
7
- -->
8
- <ds:data-stream id="scap_org.open-scap_datastream_tst" scap-version="1.2" use-case="OTHER">
9
- <ds:checklists>
10
- <ds:component-ref id="scap_org.open-scap_cref_first-xccdf.xml" xlink:href="#scap_org.open-scap_comp_first-xccdf.xml">
11
- <cat:catalog>
12
- <cat:uri name="stub-oval.xml" uri="#scap_org.open-scap_cref_stub-oval.xml"/>
13
- </cat:catalog>
14
- </ds:component-ref>
15
- <ds:component-ref id="scap_org.open-scap_cref_second-xccdf.xml" xlink:href="#scap_org.open-scap_comp_second-xccdf.xml">
16
- <cat:catalog>
17
- <cat:uri name="stub-oval.xml" uri="#scap_org.open-scap_cref_stub-oval.xml"/>
18
- </cat:catalog>
19
- </ds:component-ref>
20
- </ds:checklists>
21
- <ds:checks>
22
- <ds:component-ref id="scap_org.open-scap_cref_stub-oval.xml" xlink:href="#scap_org.open-scap_comp_stub-oval.xml"/>
23
- </ds:checks>
24
- </ds:data-stream>
25
- <ds:data-stream id="scap_org.open-scap_datastream_tst2" scap-version="1.2" use-case="OTHER">
26
- <ds:checklists>
27
- <ds:component-ref id="scap_org.open-scap_cref_first-xccdf.xml2" xlink:href="#scap_org.open-scap_comp_first-xccdf.xml">
28
- <cat:catalog>
29
- <cat:uri name="stub-oval.xml" uri="#scap_org.open-scap_cref_stub-oval.xml2"/>
30
- </cat:catalog>
31
- </ds:component-ref>
32
- <ds:component-ref id="scap_org.open-scap_cref_second-xccdf.xml2" xlink:href="#scap_org.open-scap_comp_second-xccdf.xml2">
33
- <cat:catalog>
34
- <cat:uri name="stub-oval.xml" uri="#scap_org.open-scap_cref_stub-oval.xml2"/>
35
- </cat:catalog>
36
- </ds:component-ref>
37
- </ds:checklists>
38
- <ds:checks>
39
- <ds:component-ref id="scap_org.open-scap_cref_stub-oval.xml2" xlink:href="#scap_org.open-scap_comp_stub-oval.xml"/>
40
- </ds:checks>
41
- </ds:data-stream>
42
- <ds:component id="scap_org.open-scap_comp_stub-oval.xml" timestamp="2012-10-10T13:33:44">
43
- <oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
44
- <generator>
45
- <oval:schema_version>5.10</oval:schema_version>
46
- <oval:timestamp>0001-01-01T00:00:00+00:00</oval:timestamp>
47
- </generator>
48
- <definitions>
49
- <definition class="compliance" version="1" id="oval:x:def:1">
50
- <metadata>
51
- <title>x</title>
52
- <description>x</description>
53
- <affected family="unix">
54
- <platform>x</platform>
55
- </affected>
56
- </metadata>
57
- <criteria comment="x">
58
- <criterion test_ref="oval:x:tst:1"/>
59
- </criteria>
60
- </definition>
61
- </definitions>
62
- <tests>
63
- <variable_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:tst:1" check="all" comment="x" version="1">
64
- <object object_ref="oval:x:obj:1"/>
65
- </variable_test>
66
- </tests>
67
- <objects>
68
- <variable_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:x:obj:1" version="1" comment="x">
69
- <var_ref>oval:x:var:1</var_ref>
70
- </variable_object>
71
- </objects>
72
- <variables>
73
- <constant_variable id="oval:x:var:1" version="1" comment="x" datatype="string">
74
- <value>x</value>
75
- </constant_variable>
76
- </variables>
77
- </oval_definitions>
78
- </ds:component>
79
- <ds:component id="scap_org.open-scap_comp_first-xccdf.xml" timestamp="2012-10-10T13:34:54">
80
- <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_first">
81
- <status>incomplete</status>
82
- <version>1.0</version>
83
- <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_first">
84
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" negate="true">
85
- <check-content-ref href="stub-oval.xml"/>
86
- </check>
87
- </Rule>
88
- </Benchmark>
89
- </ds:component>
90
- <ds:component id="scap_org.open-scap_comp_second-xccdf.xml2" timestamp="2012-10-10T13:34:54">
91
- <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_second">
92
- <status>incomplete</status>
93
- <version>1.0</version>
94
- <Profile id="xccdf_moc.elpmaxe.www_profile_1">
95
- <title>is kinda compulsory</title>
96
- <select idref="xccdf_moc.elpmaxe.www_rule_second" selected="true"/>
97
- </Profile>
98
- <Profile id="xccdf_moc.elpmaxe.www_profile_2" extends="xccdf_moc.elpmaxe.www_profile_1">
99
- <title>is kinda compulsory</title>
100
- <select idref="xccdf_moc.elpmaxe.www_group_one" selected="true"/>
101
- </Profile>
102
- <Group selected="false" id="xccdf_moc.elpmaxe.www_group_one">
103
- <Rule selected="false" id="xccdf_moc.elpmaxe.www_rule_second">
104
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
105
- <check-content-ref href="stub-oval.xml"/>
106
- </check>
107
- </Rule>
108
- </Group>
109
- </Benchmark>
110
- </ds:component>
111
- <ds:component id="scap_org.open-scap_comp_second-xccdf.xml" timestamp="2012-10-10T13:34:54">
112
- <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_second">
113
- <status>incomplete</status>
114
- <version>1.0</version>
115
- <Profile id="xccdf_moc.elpmaxe.www_profile_1">
116
- <title>is kinda compulsory</title>
117
- <select idref="xccdf_moc.elpmaxe.www_rule_second" selected="true"/>
118
- </Profile>
119
- <Profile id="xccdf_moc.elpmaxe.www_profile_2" extends="xccdf_moc.elpmaxe.www_profile_1">
120
- <title>is kinda compulsory</title>
121
- <select idref="xccdf_moc.elpmaxe.www_rule_second" selected="true"/>
122
- </Profile>
123
- <Group selected="false" id="xccdf_moc.elpmaxe.www_group_one">
124
- <Rule selected="false" id="xccdf_moc.elpmaxe.www_rule_second">
125
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
126
- <check-content-ref href="stub-oval.xml"/>
127
- </check>
128
- </Rule>
129
- </Group>
130
- </Benchmark>
131
- </ds:component>
132
- </ds:data-stream-collection>
data/test/data/tailoring.xml DELETED
@@ -1,31 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
3
- <xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-firefox-ds.xml"/>
4
- <xccdf:version time="2016-11-10T11:24:26">1</xccdf:version>
5
- <xccdf:Profile id="xccdf_org.ssgproject.content_profile_stig-firefox-upstream_customized" extends="xccdf_org.ssgproject.content_profile_stig-firefox-upstream">
6
- <xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Upstream Firefox STIG [CUSTOMIZED]</xccdf:title>
7
- <xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process,
8
- serving as the upstream development environment for the Firefox STIG.
9
-
10
- As a result of the upstream/downstream relationship between the SCAP Security Guide project
11
- and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content.
12
- For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/app-security/browser-guidance/Pages/index.aspx.
13
-
14
- While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note
15
- that commercial support of this SCAP content is NOT available. This profile is provided as example
16
- SCAP content with no endorsement for suitability or production readiness. Support for this
17
- profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The
18
- upstream project homepage is https://fedorahosted.org/scap-security-guide/.
19
- </xccdf:description>
20
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-non-secure_page_warning" selected="true"/>
21
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_status_bar_text" selected="true"/>
22
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_context_menus" selected="true"/>
23
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_status_bar_changes" selected="true"/>
24
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_resizing" selected="true"/>
25
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_changes" selected="true"/>
26
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-auto-update_of_firefox" selected="false"/>
27
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-autofill_passwords" selected="false"/>
28
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-autofill_forms" selected="false"/>
29
- <xccdf:select idref="xccdf_org.ssgproject.content_rule_firefox_preferences-addons_plugin_updates" selected="false"/>
30
- </xccdf:Profile>
31
- </xccdf:Tailoring>
data/test/data/testresult.xml DELETED
@@ -1,225 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <TestResult xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_common" start-time="2014-10-17T09:07:43" end-time="2014-10-17T09:07:55">
3
- <benchmark href="/usr/share/xml/scap/ssg/fedora/ssg-fedora-ds.xml" id="xccdf_org.ssgproject.content_benchmark_FEDORA"/>
4
- <title>OSCAP Scan Result</title>
5
- <identity authenticated="false" privileged="false">root</identity>
6
- <profile idref="xccdf_org.ssgproject.content_profile_common"/>
7
- <target>fedora20.mydomain</target>
8
- <target-address>127.0.0.1</target-address>
9
- <target-address>0:0:0:0:0:0:0:1</target-address>
10
- <target-facts>
11
- <fact name="urn:xccdf:fact:scanner:name" type="string">OpenSCAP</fact>
12
- <fact name="urn:xccdf:fact:scanner:version" type="string">1.0.9</fact>
13
- <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:00:00:00:00:00</fact>
14
- </target-facts><target-id-ref system="http://scap.nist.gov/schema/asset-identification/1.1" name="asset0" href=""/>
15
- <platform idref="cpe:/o:fedoraproject:fedora:20"/>
16
- <rule-result idref="xccdf_org.ssgproject.content_rule_disable_prelink" time="2014-10-17T09:07:43" severity="low" weight="1.000000">
17
- <result>fail</result>
18
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
19
- <check-content-ref name="oval:ssg:def:151" href="#xccdf1"/>
20
- </check>
21
- </rule-result>
22
- <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" time="2014-10-17T09:07:43" severity="high" weight="1.000000">
23
- <result>pass</result>
24
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
25
- <check-content-ref name="oval:ssg:def:140" href="#xccdf1"/>
26
- </check>
27
- </rule-result>
28
- <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" time="2014-10-17T09:07:43" severity="high" weight="1.000000">
29
- <result>pass</result>
30
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
31
- <check-content-ref name="oval:ssg:def:149" href="#xccdf1"/>
32
- </check>
33
- </rule-result>
34
- <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" time="2014-10-17T09:07:51" severity="medium" weight="1.000000">
35
- <result>fail</result>
36
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
37
- <check-content-ref name="oval:ssg:def:137" href="#xccdf1"/>
38
- </check>
39
- </rule-result>
40
- <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" time="2014-10-17T09:07:53" severity="medium" weight="1.000000">
41
- <result>pass</result>
42
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
43
- <check-content-ref name="oval:ssg:def:124" href="#xccdf1"/>
44
- </check>
45
- </rule-result>
46
- <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
47
- <result>pass</result>
48
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
49
- <check-content-ref name="oval:ssg:def:161" href="#xccdf1"/>
50
- </check>
51
- </rule-result>
52
- <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
53
- <result>pass</result>
54
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
55
- <check-content-ref name="oval:ssg:def:154" href="#xccdf1"/>
56
- </check>
57
- </rule-result>
58
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
59
- <result>notchecked</result>
60
- <message severity="info">No candidate or applicable check found.</message>
61
- <check system="ocil-transitional">
62
- <check-export export-name="the /etc/securetty file is not empty" value-id="xccdf_org.ssgproject.content_value_conditional_clause"/>
63
- <check-content xmlns:xhtml="http://www.w3.org/1999/xhtml">
64
- To ensure root may not directly login to the system over physical consoles,
65
- run the following command:
66
- <pre xmlns="http://www.w3.org/1999/xhtml">cat /etc/securetty</pre>
67
- If any output is returned, this is a finding.
68
- </check-content>
69
- </check>
70
- </rule-result>
71
- <rule-result idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
72
- <result>fail</result>
73
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
74
- <check-content-ref name="oval:ssg:def:109" href="#xccdf1"/>
75
- </check>
76
- </rule-result>
77
- <rule-result idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
78
- <result>pass</result>
79
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
80
- <check-content-ref name="oval:ssg:def:144" href="#xccdf1"/>
81
- </check>
82
- </rule-result>
83
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_root_webbrowsing" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
84
- <result>notselected</result>
85
- <check system="ocil-transitional">
86
- <check-export export-name="this is not the case" value-id="xccdf_org.ssgproject.content_value_conditional_clause"/>
87
- <check-content xmlns:xhtml="http://www.w3.org/1999/xhtml">
88
- Check the <xhtml:code>root</xhtml:code> home directory for a <xhtml:code>.mozilla</xhtml:code> directory. If
89
- one exists, ensure browsing is limited to local service administration.
90
- </check-content>
91
- </check>
92
- </rule-result>
93
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
94
- <result>notselected</result>
95
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
96
- <check-content-ref name="oval:ssg:def:122" href="#xccdf1"/>
97
- </check>
98
- <check system="ocil-transitional">
99
- <check-export export-name="any system account (other than root) has a login shell" value-id="xccdf_org.ssgproject.content_value_conditional_clause"/>
100
- <check-content xmlns:xhtml="http://www.w3.org/1999/xhtml">
101
- To obtain a listing of all users,
102
- their UIDs, and their shells, run the command:
103
- <pre xmlns="http://www.w3.org/1999/xhtml">$ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd</pre>
104
- Identify the system accounts from this listing. These will
105
- primarily be the accounts with UID numbers less than 500, other
106
- than root.
107
- </check-content>
108
- </check>
109
- </rule-result>
110
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_uidzero_except_root" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
111
- <result>pass</result>
112
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
113
- <check-content-ref name="oval:ssg:def:118" href="#xccdf1"/>
114
- </check>
115
- </rule-result>
116
- <rule-result idref="xccdf_org.ssgproject.content_rule_root_path_default" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
117
- <result>notselected</result>
118
- <check system="ocil-transitional">
119
- <check-export export-name="any of these conditions are not met" value-id="xccdf_org.ssgproject.content_value_conditional_clause"/>
120
- <check-content xmlns:xhtml="http://www.w3.org/1999/xhtml">
121
- To view the root user's <xhtml:code>PATH</xhtml:code>, run the following command:
122
- <pre xmlns="http://www.w3.org/1999/xhtml"># env | grep PATH</pre>
123
- If correctly configured, the <xhtml:code>PATH</xhtml:code> must: use vendor default settings,
124
- have no empty entries, and have no entries beginning with a character
125
- other than a slash (/).
126
- </check-content>
127
- </check>
128
- </rule-result>
129
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" time="2014-10-17T09:07:55" severity="high" weight="1.000000">
130
- <result>fail</result>
131
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
132
- <check-content-ref name="oval:ssg:def:111" href="#xccdf1"/>
133
- </check>
134
- </rule-result>
135
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_hashes_outside_shadow" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
136
- <result>pass</result>
137
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
138
- <check-content-ref name="oval:ssg:def:107" href="#xccdf1"/>
139
- </check>
140
- </rule-result>
141
- <rule-result idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
142
- <result>notselected</result>
143
- <check system="ocil-transitional">
144
- <check-export export-name="there is output" value-id="xccdf_org.ssgproject.content_value_conditional_clause"/>
145
- <check-content xmlns:xhtml="http://www.w3.org/1999/xhtml">
146
- To ensure all GIDs referenced in <xhtml:code>/etc/passwd</xhtml:code> are defined in <xhtml:code>/etc/group</xhtml:code>,
147
- run the following command:
148
- <pre xmlns="http://www.w3.org/1999/xhtml"># pwck -qr</pre>
149
- There should be no output.
150
- </check-content>
151
- </check>
152
- </rule-result>
153
- <rule-result idref="xccdf_org.ssgproject.content_rule_no_netrc_files" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
154
- <result>pass</result>
155
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
156
- <check-content-ref name="oval:ssg:def:157" href="#xccdf1"/>
157
- </check>
158
- </rule-result>
159
- <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
160
- <result>fail</result>
161
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
162
- <check-export export-name="oval:ssg:var:213" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs"/>
163
- <check-content-ref name="oval:ssg:def:133" href="#xccdf1"/>
164
- </check>
165
- </rule-result>
166
- <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
167
- <result>fail</result>
168
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
169
- <check-export export-name="oval:ssg:var:214" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
170
- <check-content-ref name="oval:ssg:def:159" href="#xccdf1"/>
171
- </check>
172
- </rule-result>
173
- <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
174
- <result>fail</result>
175
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
176
- <check-export export-name="oval:ssg:var:211" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
177
- <check-content-ref name="oval:ssg:def:113" href="#xccdf1"/>
178
- </check>
179
- </rule-result>
180
- <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
181
- <result>pass</result>
182
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
183
- <check-export export-name="oval:ssg:var:215" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
184
- <check-content-ref name="oval:ssg:def:163" href="#xccdf1"/>
185
- </check>
186
- </rule-result>
187
- <rule-result idref="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
188
- <result>fail</result>
189
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
190
- <check-content-ref name="oval:ssg:def:129" href="#xccdf1"/>
191
- </check>
192
- </rule-result>
193
- <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
194
- <result>fail</result>
195
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
196
- <check-content-ref name="oval:ssg:def:142" href="#xccdf1"/>
197
- </check>
198
- </rule-result>
199
- <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" time="2014-10-17T09:07:55" severity="medium" weight="1.000000">
200
- <result>fail</result>
201
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
202
- <check-content-ref name="oval:ssg:def:115" href="#xccdf1"/>
203
- </check>
204
- </rule-result>
205
- <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" time="2014-10-17T09:07:55" severity="high" weight="1.000000">
206
- <result>pass</result>
207
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
208
- <check-content-ref name="oval:ssg:def:146" href="#xccdf1"/>
209
- </check>
210
- </rule-result>
211
- <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
212
- <result>fail</result>
213
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
214
- <check-export export-name="oval:ssg:var:212" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
215
- <check-content-ref name="oval:ssg:def:120" href="#xccdf1"/>
216
- </check>
217
- </rule-result>
218
- <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" time="2014-10-17T09:07:55" severity="low" weight="1.000000">
219
- <result>fail</result>
220
- <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
221
- <check-content-ref name="oval:ssg:def:135" href="#xccdf1"/>
222
- </check>
223
- </rule-result>
224
- <score system="urn:xccdf:scoring:default" maximum="100.000000">34.722221</score>
225
- </TestResult>