|2010-08-26||From 9:00 to 17:00 UTC||#fedora-test-day (webirc)|
What to test?
Have you ever used any security scanning application? Does the security configuration of your box matters? Do you want to keep you system in consistent state? If you have positive answer to any of these questions then it's probably worth to joint this Fedora Test Day that will focus on OpenSCAP feature.
What is SCAP? It is a line of standards managed by NIST. It was created to provide a standardized approach to maintaining the security of systems, such as automatically verifying the presence of patches, checking system security configuration settings, and examining systems for signs of compromise.
The SCAP suite contains multiple complex data exchange formats that are to be used to transmit important vulnerability, configuration, and other security data. Historically, there have been few tools that provide a way to query this data in the needed format. This lack of tools makes the barrier to entry very high and discourages adoption of these protocols by the community. It's a goal of OpenSCAP project to create a framework of libraries to improve the accessibility of SCAP and enhance the usability of the information it represents.
The following cast of characters will be available testing, workarounds, bug fixes, and general discussion:
- Development - Peter Vrabec (wrabco), Tomas Heinrich (theinric), Maros Barabas (mbarabas), Daniel Kopecek (dkopecek), Lukas Kuklinek (lkukline)
- FirstAidKit development - Martin Sivák (msivak)
- Quality Assurance - Kamil Páral (kparal), Ondrej Moris (omoris)
Prerequisite for Test Day
- A fully updated Fedora 13 or 14.
- This must be a real installation, live CDs are unfortunately not suitable for this test day.
- We are interested in different software setups, so if possible please use your real workstation, rather than clean install of F13 or F14. You don't have to be afraid, this software is not destructive in any way.
- At least 2 GB of RAM is recommended for the system, otherwise the tool may work very slow.
How to test?
- Fully update your Fedora 13 or Fedora 14.
- Install openscap, openscap-utils and openscap-python packages version 0.6.1-testday5. Download them from: http://people.redhat.com/pvrabec/openscap/
- Download required SCAP content: http://people.redhat.com/pvrabec/openscap/content
- Follow the test cases below.
- Write your results to the result matrix.
Please execute as many test cases from the following list of OpenSCAP Test Cases as possible:
If you have problems with any of the tests, report a bug to Bugzilla for the openscap component. If you are unsure about exactly how to file the report or what other information to include, just ask on IRC and we will help you. Once you have completed the tests, add your results to the Results table below, following the example results from the first line as a template.
|User||Fedora default settings||Fedora adjusted settings||secstate tool||FAK plugin||References|
|He Rui||||[long 1]|
|Masami Ichikawa|| |
|Kamil Páral|||| |||
- tested the rule-184.108.40.206.a (Disable the Automounter if Possible), when I stopped the autofs service as the rules suggested, the result was still 'fail'.(Yum remove autofs can get a 'pass' result)
- Tests checking file permissions (rule-220.127.116.11.a, rule-18.104.22.168.a, rule-22.214.171.124.b, rule-126.96.36.199.a, rule-188.8.131.52.b, rule-184.108.40.206.a) eats all memory (4 GiB) and are terminated by kernel – RHBZ #565691
- Test rule-220.127.116.11.4.a (Ensure Package Signature Checking is Not Disabled For Any Repos) fails because I have defined rawhide repositories with disabled signature checking and disabled for installation. I think disabled repositories should not be considered in this test.
- Test rule-18.104.22.168.b (Set net.ipv4.conf.all.accept_redirects for Hosts and Routers) fails. This is default value for F13. F13 should be fixed (/etc/sysctl.conf) or the test removed as far as it can be useful in some scenarios (link with more routers, link with more IP networks).
- Test rule-22.214.171.124.a (Disable X Windows at System Boot) fails if enabled despite my inittab has default runlevel 3. Test is defined as equality to number 5 in oval file. More ever
X Windows' is nonsense. Correct name isX Window' without the `s' suffix. See X(7) manual page. You are breaking trade mark ;)